Re: Commands for Limited Users
"Phil Ashe" <[email protected]>
| Newsgroups | gmane.comp.systems.as400.security |
|---|---|
| Message-ID | <[email protected]> |
John: Your opinion is valid. There are many shops that haven't crafted a complete plan to access the resources on their servers. LMTCPB is designed only to stop commands from a classic command line interface. We are in agreement that it is useless for anything else. As you have pointed out it is possible to execute remote commands on the local server (including executing commands against 127.0.0.1) to get around the limitations imposed by LMTCPB. I have three basic problems with LMTCPB and commands. 1) It's obsolete in that it hasn't been updated to check commands in newer interfaces. [limited scope] 2) It's checked after the user has already been determined to have object authority to the command. 3) It's difficult to find the LMTCPB "violations". They aren't placed in the system audit journal. [more obsolescence] When used in the environment for which it was designed, LMTCPB can be a tool of last resort to stop some undesired activity. You need to look hard to find out that LMTCPB is doing anything of value on your system. The information is in the joblog. But it also can interfere with desired activity, requiring a bunch of work-arounds. Anyway, let's talk about the Inventory Master. By giving a user *CHANGE rights to the master file, you give them rights to the file in all interfaces. The user can get at the file through EDTF/DFU or Excel, as well as the expected application interfaces. I would use adopted authority for access through the expected application interfaces and use proxy commands to limit the use of EDTF or DFU to well-defined views of the data, then take away the data rights to the file. The object authority is still checked on the remote server interfaces. If you need access to the file from one or more remote servers, you can use exit programs to give you this authority. Database administration is bunch of landmines. How you implement your security plan can have a significant impact on performance. I prefer to start out with a simple plan (then resist all efforts to make it more complex). Phil Ashe NetIQ (A division of Attachmate) 1233 West Loop South, Suite 1800 | Houston, TX 77027 USA 713.418.5279 phone [email protected] www.netiq.com Phil, Would you care for a little open and spirited debate? <snip> sure! _______________________________________________ This is the Security Administration on the AS400 / iSeries (Security400) mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/security400 or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/security400.