Re: Commands for Limited Users
[email protected] Mon, 11 Sep 2006 11:18:47 -0400
| Newsgroups | gmane.comp.systems.as400.security |
|---|---|
| Message-ID | <OFC2E06E48.AC69FD5D-ON852571E6.0053ED3D-852571E6.00541E3E@dekko.com> |
Create a file library, 26 times, that has all the files used by BPCS. Have every file in the library owned by a user profile specific to that library, like SSA01, SSA02, SSA03... Now add all of these user profiles as supplemental groups to 10 or 12 users. Rob Berendt -- Group Dekko Services, LLC Dept 01.073 PO Box 2000 Dock 108 6928N 400E Kendallville, IN 46755 http://www.dekko.com [email protected] Sent by: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] 09/07/2006 09:23 PM Please respond to Security Administration on the AS400 / iSeries <security400-Zwy7GipZuJhWk0Htik3J/[email protected]> To Security Administration on the AS400 / iSeries <security400-Zwy7GipZuJhWk0Htik3J/[email protected]> cc Subject Re: [Security400] Commands for Limited Users We might also point out that under these circumstances, the group profile(s) would essentially be the only user(s) entered on the authorization lists. The links in the authority chain can be very concise this way. I'd be interested in how Rob's group profiles were set up so that they caused long save-times. Tom Liotta john.earl wrote: > Rob, > > I don't believe Authority lists and Group Profiles are mutually > exclusive, I think they are complimentary. The way we have always > practiced (and preached) it is like this: > > Group Profiles are used to assemble users who do a similar function into > a group. Authority lists assemble objects that should be secured > similarly into an object group. The combination of the two provides for > the most efficient way that I know of to secure individual objects in > OS/400. > > You could choose to use just one or the other, but they are not mutually > exclusive. > >> -----Original Message----- >> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] >> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of >> rob >> >> I much prefer authorization lists over groups. >> Supplemental groups make >> me shudder. The overhead on them is tremendous. A simple >> SAVSYS went >> from 4 minutes to 44 minutes when we tinkered around with >> them. IBM >> dialed in and via PRTPVTAUT determined supplemental groups >> to be the >> culprit. Besides, we had more supplemental groups than >> you could put in >> CHGUSRPRF SUPGRPPRF(...). Lots of divisions, and then >> each division had a >> different software vendor between accounting and ERP. >> When you have two >> different divisions feeding two different fierce >> competitors we had to >> demonstrate a pretty solid line between the two. >> >> >> "David Morris" >> Sent by: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] >> >> Adopted authority is nearly as outdated as limited >> capability. It >> doesn't work well with triggers or IFS files and is >> incompletely >> implemented. Adoption is ineffective in exits but based on >> your message >> you may have overcome some of the limitations I have run >> up against. The >> biggest reason to avoid adoption is that it is often >> implemented >> incorrectly and is frequently the source of serious >> security problems. >> >> A few years back, I started using a technique that gives >> similar >> function by swapping in or setting effective groups and >> supplemental >> groups. -- Tom Liotta The PowerTech Group, Inc. 19426 68th Avenue South Kent, WA 98032 Phone 253-872-7788 x313 Fax 253-872-7904 http://www.powertech.com _______________________________________________ This is the Security Administration on the AS400 / iSeries (Security400) mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/security400 or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/security400. _______________________________________________ This is the Security Administration on the AS400 / iSeries (Security400) mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/security400 or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/security400.