Re: Seeing all authorities on DSPOBJAUT???

On the IBM SECTOOLS menu (go sectools) opt 49 Print User Profiles has
a select to print special authorities.
Lots of other good reports.
Jim Franz

----- Original Message ----- 
From: "Gary Monnier" <gary.monnier-Ua2wos9bJ7y1Z/[email protected]>
To: "Security Administration on the AS400 / iSeries" 
<security400-Zwy7GipZuJhWk0Htik3J/[email protected]>
Sent: Friday, November 11, 2005 1:00 PM
Subject: RE: [Security400] Seeing all authorities on DSPOBJAUT???


> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Dan
> Sent: Friday, November 11, 2005 9:09 AM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] Seeing all authorities on DSPOBJAUT???
>
>
>
> <*ALLOBJ trumps *PUBLIC *EXCLUDE?
>
> <Seems to be a catch-22 here. Assuming someone here can sign on as a
> *secofr
> <w/ *ALLOBJ authority, is there an easy way to quickly determine all of
> the
> <profiles that have *ALLOBJ authority?
>
> Yep.  *ALLOBJ means the user has all object authority to any object on
> the system.  Working for a security software vendor I can say there sure
> is - buy our products <G>.  As a member of this list I suggest searching
> the archives or simply doing a DSPUSRPRF to an outfile and then scan the
> file for *ALLOBJ, *SECADM, *AUDIT, *IOSYSCFG and *SERVICE.  Then have
> users with profiles containing these authorities justify why they need
> them.
>
> <When you talk about "clones of QSECOFR", I presume you are thinking of
> <copying the QSECOFR profile to another profile. But isn't the real
> clincher
> <to this is the new profile assumes the same *ALLOBJ authority that
> QSECOFR
> <has? Or is there some other property precludes the need for *ALLOBJ
> <authority?
>
> A profile that is an exact dulicate of QSECOFR has the ability to
> perform virtually any function on the system.  This includes creating,
> changing and deleting user profiles as well as any other object on the
> system.
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries (Security400) 
> mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
>
> 


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.