Re: Commands for Limited Users

Phil, 

Would you care for a little open and spirited debate?

>From an academic perspective, your arguments about LMTCPB seem sound,
but from a practical perspective, I don't think you could ever get
yourself to a place where Object Level Security was so tight that you
could leave all your users at LMTCPB(*NO).

The most obvious (to me) examples would be where you have an object
level security plan that gives a user *USE access to the Customer file,
and *CHANGE access to the Inventory File.   If this user is LMTCPB(*NO),
they can use the EDTF command to modify the contents of the Inventory
file in ways that are inconsistent with (and may break) the application.
The user could also use the OS/400 FTP command to send the Customer file
to a PC or another server and thereby compromise the entire data set in
one fell swoop.

The problem with straight object level security is that users are often
allowed to access data only with in a specific context - that is - it's
ok for Jane to access the Inventory file within the context on a well
crafted application program that controls what she can see and change.
But we don't want Jane to change some fields in the file (like re-order
point, etc.).  So *CHANGE authority would not in itself be adequate to
secure the resource.  

These are just two quick examples, and I am sure there are a lot more.
LMTCPB(*YES) gives system administrators a valuable tool that is easy to
implement and very effective at providing Context sensitive security.  I
don't believe it is antiquated, and I doubt it will every be obsolete.

But that is just MHO.

jte





--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl-Ua2wos9bJ7y1Z/[email protected]
www.powertech.com 
Celebrating our 10th Anniversary Year!
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--

> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of
> Phil Ashe
> Sent: Wednesday, September 06, 2006 2:22 PM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] Commands for Limited Users
> 
> I wanted to clarify some things about limit capabilities
> and command
> security.
> 
> Limit capabilities is part of the legacy support for
> systems at security
> level 10 or 20. It is a tool to solve a problem you
> probably don't have.
> It is designed to enforce a menu security system on
> terminals when you
> have no other security.
> 
> At security level 20 (security level 10 hasn't been
> supported for
> years), you aren't interested in managing object-level
> security and you
> have a very small set of tools to control user actions. In
> this
> environment, every user has *ALLOBJ rights and has the
> ability to run
> every command. There is no "security" except that which is
> provided by
> limit capabilities and menus. Limit capabilities and menus
> provide the
> means of controlling what users can do in an ad hoc
> fashion.
> 
> At security level 20, you don't have object-level
> security. As John Earl
> pointed out, limit capabilities won't secure commands from
> non-command
> line interfaces, including commands from remote servers
> and within
> programs. It wasn't meant to. Limit capabilities was
> designed for menu
> security and not object-level security. This behavior
> outside of menus
> is to be expected.
> 
> Neither FTP nor Rexec is a classic OS/400 command line
> interface managed
> by limit capabilities functionality. Many of these types
> of interfaces
> didn't exist when the limit capabilities support was
> created. If you
> want to control access to commands in all interfaces
> (programs
> included), you need an object-level security scheme.
> 
> At security level 30 or higher, you have other options for
> controlling
> the actions of users, including object-level security. You
> can simulate
> the functionality of limit capabilities by a combination
> of command
> proxies, programs, specialized signon screens, and object-
> level
> security.
> 
> The benefit for managing limited capabilities is very
> small at security
> level 30 or higher, especially since you can provide for
> similar
> functionality through other means. For a similar amount of
> effort, you
> can turn on action auditing for users and determine actual
> commands
> being run. After an analysis of that data, you then hone
> your object
> security plan. Well-managed object security provides a
> much bigger
> benefit than limited capabilities.
> 
> CHGPWD shows some of the problems with limited
> capabilities. The CHGPWD
> command has no parameters. It's a command that almost
> everybody should
> have access to, but it is shipped with "Allow limited
> user" set to
> "*NO".
> 
> Why is it OK for a capabilities-limited user to access
> CHGPWD by typing
> "8" on the User Tasks menu (GO USER) but not type out
> "CHGPWD" on a
> command line on the same menu? It makes no sense.
> 
> Limit capabilities doesn't provide real security. It
> doesn't provide
> consistent security. Any auditor who insists on using
> limit capabilities
> doesn't understand the issues. I could argue that its use
> does not
> constitute a "Best Practice" in iSeries security.
> 
> Phil Ashe
> NetIQ (A division of Attachmate)
> 1233 West Loop South, Suite 1800 | Houston, TX 77027 USA
> 713.418.5279 phone
> [email protected]
> www.netiq.com
> 
> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of
> John Earl
> Sent: Wednesday, August 30, 2006 1:28 AM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] Commands for Limited Users
> 
> Jim,
> 
> Sorry, I should have been more clear.  This is the list of
> commands that
> limited capabilities are allowed to run from an OS/400
> command line.
> But as I mentioned earlier, there are other interfaces
> that limited
> capability users can use to run these (and other)
> commands.
> 
> LMTCPB users can are not restricted from running other
> commands from
> within a compiled program - assuming they have at least
> *USE authority
> to the command object.
> 
> jte
> 
> 
> 
> --
> John Earl | Chief Technology Officer
> The PowerTech Group
> 19426 68th Ave. S
> Seattle, WA 98032
> (253) 872-7788 ext. 302
> john.earl-Ua2wos9bJ7y1Z/[email protected]
> www.powertech.com
> Celebrating our 10th Anniversary Year!
> 
> 
> 
> This email message and any attachments are intended only
> for the use of
> the intended recipients and may contain information that
> is privileged
> and confidential. If you are not the intended recipient,
> any
> dissemination, distribution, or copying is strictly
> prohibited. If you
> received this email message in error, please immediately
> notify the
> sender by replying to this email message, or by telephone,
> and delete
> the message from your email system.
> --
> 
> > -----Original Message-----
> > From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> > [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of
> Jim
> > Franz
> > Sent: Tuesday, August 29, 2006 3:57 PM
> > To: Security Administration on the AS400 / iSeries
> > Subject: Re: [Security400] Commands for Limited Users
> >
> > John - is this list commands they can execute from a
> > command line, or the
> > total list of commands they can execute, even if the
> > command is within
> > a clp program (assuming normal auth to the pgm, not
> > adopted, and the program
> > executing under the authority of the user of the
> program,
> > not the owner)?
> > It was my understanding that this list was a limitation
> of
> > what a limited
> > user
> > can do on a command line.
> > Jim Franz
> >
> > ----- Original Message -----
> > From: "John Earl" <john.earl-Ua2wos9bJ7y1Z/[email protected]>
> > To: "Security Administration on the AS400 / iSeries"
> > <security400-Zwy7GipZuJhWk0Htik3J/[email protected]>
> > Sent: Tuesday, August 29, 2006 4:59 PM
> > Subject: Re: [Security400] Commands for Limited Users
> >
> >
> > > Dave,
> > >
> > > I'm reciting this from memory, so it may not be an
> > exhaustive list, but
> > > if I recall correctly there were somewhere around 8
> > commands shipped
> > > with the operating system that are available to
> limited
> > users.  Let's
> > > see which ones I can remember, and then we'll see if
> > others can chime in
> > > with any I may have missed.
> > >
> > > DSPJOB
> > > DSPJOBLOG
> > > DSPMSG
> > > SIGNOFF
> > > SNDMSG
> > > STRPCO
> > > WRKENVVAR
> > > WRKMSG
> > >
> > > Of these, SIGNOFF is virtually essential, and the
> three
> > "DSP" and the
> > > SNDMSG command are relatively inconsequential risk
> > (assuming you are
> > > doing appropriate tightening elsewhere, as you have
> > said).  STRPCO is
> > > risky, and probably completely unnecessary, and,
> absent
> > a specific
> > > reason to leave them open, the WRKENVVAR and WRKMSG
> > could afford to be
> > > restricted as well.
> > >
> > > This list only includes commands that are allowed by
> > Limited Capability
> > > users as shipped from the factory.  You may have more
> OS
> > commands or
> > > application commands that have been opened to Limited
> > Capability users
> > > as well.  There is at least one commercial product
> (uh,
> > why yes, that
> > > would be a PowerTech product :) ) that will show you
> > this list quickly
> > > in a single report (and help you ensure that the list
> > stays constant),
> > > but I am not aware of any automated facility in the OS
> > that will track
> > > this parameter for you.
> > >
> > > HTH,
> > >
> > > jte
> > >
> > >
> > > --
> > > John Earl | Chief Technology Officer
> > > The PowerTech Group
> > > 19426 68th Ave. S
> > > Seattle, WA 98032
> > > (253) 872-7788 ext. 302
> > > john.earl-Ua2wos9bJ7y1Z/[email protected]
> > > www.powertech.com
> > > Celebrating our 10th Anniversary Year!
> > >
> > >
> > >
> > > This email message and any attachments are intended
> only
> > for the use of
> > > the intended recipients and may contain information
> that
> > is privileged
> > > and confidential. If you are not the intended
> recipient,
> > any
> > > dissemination, distribution, or copying is strictly
> > prohibited. If you
> > > received this email message in error, please
> immediately
> > notify the
> > > sender by replying to this email message, or by
> > telephone, and delete
> > > the message from your email system.
> > > --
> > >
> > >> -----Original Message-----
> > >> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> > >> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf
> Of
> > >> Turnidge, Dave
> > >> Sent: Tuesday, August 29, 2006 11:19 AM
> > >> To: Security Administration on the AS400 / iSeries
> > >> Subject: [Security400] Commands for Limited Users
> > >>
> > >> I am trying to get a handle on security on our
> systems,
> > >> and have now
> > >> arrived at "Commands for Limited Users." I have an
> > Excel
> > >> spreadsheet
> > >> which has all the commands in this category on our
> > >> systems.
> > >>
> > >> First, I would like to know what are the commands for
> > >> limited users that
> > >> come with the system as shipped from IBM. Second, do
> > you
> > >> agree with that
> > >> list? I.e., should there be ANY commands available to
> > >> limited users?
> > >>
> > >> I await your reply.
> > >>
> > >> Thank you,
> > >>
> > >> Dave
> > >>
> > >> _______________________________________________
> > >> This is the Security Administration on the AS400 /
> > iSeries
> > >> (Security400) mailing list
> > >> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> > >> To subscribe, unsubscribe, or change list options,
> > >> visit:
> > >>
> http://lists.midrange.com/mailman/listinfo/security400
> > >> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> > >> Before posting, please take a moment to review the
> > >> archives
> > >> at http://archive.midrange.com/security400.
> > >>
> > >
> > >
> > > _______________________________________________
> > > This is the Security Administration on the AS400 /
> > iSeries (Security400)
> > > mailing list
> > > To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> > > To subscribe, unsubscribe, or change list options,
> > > visit:
> > http://lists.midrange.com/mailman/listinfo/security400
> > > or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> > > Before posting, please take a moment to review the
> > archives
> > > at http://archive.midrange.com/security400.
> > >
> >
> >
> > _______________________________________________
> > This is the Security Administration on the AS400 /
> iSeries
> > (Security400) mailing list
> > To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> > To subscribe, unsubscribe, or change list options,
> > visit:
> > http://lists.midrange.com/mailman/listinfo/security400
> > or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> > Before posting, please take a moment to review the
> > archives
> > at http://archive.midrange.com/security400.
> >
> 
> 
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries
> (Security400)
> mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/security400.
> 
> 
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries
> (Security400) mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/security400.
> 


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.