Re: Seeing all authorities on DSPOBJAUT???
Dan <[email protected]>
| Newsgroups | gmane.comp.systems.as400.security |
|---|---|
| Message-ID | <[email protected]> |
On 11/11/05, Gary Monnier <gary.monnier-Ua2wos9bJ7y1Z/[email protected]> wrote: > > Yep. *ALLOBJ means the user has all object authority to any object on > the system. Working for a security software vendor I can say there sure > is - buy our products <G>. As a member of this list I suggest searching > the archives or simply doing a DSPUSRPRF to an outfile and then scan the > file for *ALLOBJ, *SECADM, *AUDIT, *IOSYSCFG and *SERVICE. Then have > users with profiles containing these authorities justify why they need > them. Well, I should clarify that we haven't made any determination yet whether anyone (other than our security officer, of course) even has these authorities, but like I mentioned earlier, we were trying to narrow our search for the possibilities. <When you talk about "clones of QSECOFR", I presume you are thinking of > <copying the QSECOFR profile to another profile. But isn't the real > clincher > <to this is the new profile assumes the same *ALLOBJ authority that > QSECOFR > <has? Or is there some other property precludes the need for *ALLOBJ > <authority? > > A profile that is an exact dulicate of QSECOFR has the ability to > perform virtually any function on the system. This includes creating, > changing and deleting user profiles as well as any other object on the > system. And an exact duplicate of QSECOFR also has *ALLOBJ authority, which is the thing that makes it dangerous in the wrong hands, correct? In response to Jim's post: This is good to know. I kinda feel better that no one that is in the office today can even *get* to that menu, since this leads me to the implication that our security officer has done things right. But I guess we'll have to wait until Monday now to know for certain. Thanks guys! - Dan _______________________________________________ This is the Security Administration on the AS400 / iSeries (Security400) mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/security400 or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/security400.