Re: Is it possible to lock down ODBC connections?

Thanks Rob


-----Original Message-----
From: [email protected]
To: Security Administration on the AS400 / iSeries <security400-Zwy7GipZuJhWk0Htik3J/[email protected]>
Sent: Fri, 11 Jul 2008 1:16 pm
Subject: Re: [Security400] Is it possible to lock down ODBC connections?



iNav is pretty general on this.  Your choice is all or nothing.  You have:
- Default access for all users
- Default access for users with All Object authority
- Individual users or groups  (See "Customize")
Within those it's whether or not you allow them to use ODBC.  No 
restrictions as to what statements, databases or whatever are allowed.
If you are looking for the granularity shown in:
STRQM
10. Work with Query Manager profiles 
2=Change
Select allowed SQL statements  . . . .   Y
You are SOL.  See third party packages...



Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





[email protected] 
Sent by: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
07/11/2008 12:48 PM
Please respond to
Security Administration on the AS400 / iSeries  <security400-Zwy7GipZuJhWk0Htik3J/[email protected]>


To
security400-Zwy7GipZuJhWk0Htik3J/[email protected]
cc

Subject
Re: [Security400] Is it possible to lock down ODBC connections?






So, the preventing of use of ODBC can't really be done by restricting it 
via Ops Nav???An exit point must be written???
?







-----Original Message-----
From: John Earl <john.earl-Ua2wos9bJ7y1Z/[email protected]>
To: Security Administration on the AS400 / iSeries 
<security400-Zwy7GipZuJhWk0Htik3J/[email protected]>
Sent: Thu, 10 Jul 2008 5:21 pm
Subject: Re: [Security400] Is it possible to lock down ODBC connections?



Mile,

That is correct - you only need to write an exit program for one of
those exit points.  And the QIBM_QZDA_SQL2 exit point is vastly
preferable because it passes SQL strings up to 32K (may be larger now)
rather than just the 512 bytes passed by the QIBM_QZDA_SQL1 exit point.
Obviously if you used the QIBM_QZDA_SQL1 exit point you could miss a lot
of important object references that happened to be embedded at bytes
513+.

jte

--
 
John Earl, VP and Chief Technology Officer
PowerTech:   253-872-7788
Direct:          253-479-1408
Mobile:          206-669-3336
John.Earl-Ua2wos9bJ7y1Z/[email protected]
 

 
 
Email is an excellent way to communicate material that is not time
sensitive.  If your communication is of a more urg
ent nature, please
call. 
 
===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.
 

> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] 
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Mike
> Sent: Thursday, July 10, 2008 12:52 PM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] Is it possible to lock down ODBC 
> connections?
> 
> So looking at the conversation here and some of the things I 
> have read; I would have to parse the SQL in order to do 
> object-level security in the
> QIBM_QZDA_SQL1 or QIBM_QZDA_SQL2 exit points?
> 
> --
> Mike Wills
> Midrange Programmer/Analyst
> 
> Sick of corporate radio and hungry for something new?
> http://thenextgenerationofradio.com
> Stalking me? http://twitter.com/MikeWills | 
> http://friendfeed.com/mikewills 
> _______________________________________________
> This is t
he Security Administration on the AS400 / iSeries 
> (Security400) mailing list To post a message email: 
> Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change 
> list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, 
> please take a moment to review the archives at 
> http://archive.midrange.com/security400.
> 
> 
> 
_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) 
mailing 
list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or 
email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) 
mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.





_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing 
list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.