Re: Disabled Userids

I agree with the others .. Profiles used exclusively for batch
processing shouldn't be getting disabled unless someone is mis-using
them or you have some external process that's disabling them [like
ANZDFTPWD ACTION(*DISABLE)].

That said there are workarounds.  A band aid would be to have your batch
PGM call a PGM that adopts authority to a SECADM-level account and does
a CHGUSRPRF XXXXX STATUS(*ENABLED) PASSWORD(YYYYY) before the profile is
needed.  Or put that code in some PGM that runs each day.

But the real fix is to find what's disabling the profile and take care
of that.  For instance, with the ANZDFTPWD command you can create a list
of profiles for the command to ignore.  Or, if you see invalid signon
attempts for the profile, track down who is trying to use the batch
profile interactively.

-- 
John A. Jones, CISSP
Americas Information Security Officer
Jones Lang LaSalle, Inc.
V: +1-630-455-2787 F: +1-312-601-1782
john.jones-4kQQZ61tH+/[email protected]

-----Original Message-----
From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
[mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Jim Franz
Sent: Wednesday, May 09, 2007 8:24 AM
To: Security Administration on the AS400 / iSeries
Subject: Re: [Security400] Disabled Userids

The system value rules for # times bad password and what action are
global. But you can in the profile set this "batch-only" profile to not
expire to avoid an expire problem.
Set password to expired  . . . .   *NO
If it is "batch-only", then how did you hit this problem?
jim

----- Original Message -----
From: "Neeland, Steve" <[email protected]>
To: "Security Administration on the AS400 / iSeries" 
<security400-Zwy7GipZuJhWk0Htik3J/[email protected]>
Sent: Wednesday, May 09, 2007 9:14 AM
Subject: [Security400] Disabled Userids


> Is anyone aware if a way exists to exempt a userid profile from
> switching to a *DISABLED status when too many invalid passwords may be
> entered?  We have some special userids used for batch-only
applications,
> and if they happened to get disabled the applications would return
> abends.
>
> Thanks!
> Steve
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries
(Security400) 
> mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
> 


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400)
mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.


This email is for the use of the intended recipient(s) only.  If you have 
received this email in error, please notify the sender immediately and then 
delete it.  If you are not the intended recipient, you must not keep, use, 
disclose, copy or distribute this email without the author's prior 
permission.  We have taken precautions to minimize the risk of transmitting 
software viruses, but we advise you to carry out your own virus checks on 
any attachment to this message.  We cannot accept liability for any loss 
or damage caused by software viruses.  The information contained in this 
communication may be confidential and may be subject to the attorney-client 
privilege. If you are the intended recipient and you do not wish to receive 
similar electronic messages from us in the future then please respond to the 
sender to this effect.

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.