21
Sat, Dec
3 New Articles
  1. You are here:  
  2. Home
  3. Security
  4. IBM i (OS/400, i5/OS)
  5. Security Patrol: Security Questions and Answers

Security Patrol: Security Questions and Answers

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Q: I restrict access to a library to limit the users that have authority to the objects in the library. Can I use a similar method to restrict access to a folder and limit access to the documents in the folder?

A:The security of folders does not work like the security of libraries. If a user is not authorized to a folder, the user cannot list the contents of the folder. However, if a user knows the fully qualified name of a document-for example, FLDR1/FLDR2/DOC-the user does not require authority to any of the qualifying folders. The only way to restrict access to the documents is to secure the documents.

I recommend use of the same authorization list to secure both the documents and the folder. If you secure a folder with an authorization list, then new documents added to the folder will automatically be secured by the authorization list. Documents currently in the folder will need to be secured using the Change Document Library Object Authority (CHGDLOAUT) command.

Q:User manuals for software products usually indicate that the security officer (QSECOFR) should perform the installation. Why is this so? Can another profile be used? If another profile is used, what is the minimum authority required for installs?

A:Installation instructions often call for the QSECOFR user profile because the application package may contain programs that adopt their owner's authority. When these programs are restored, OS/400 revokes all access to them unless the restoration is performed by a security officer or the owner of the programs.

If the user profile that installs the software has *ALLOBJ and *SECADM special authority, access to the adopting program is not revoked. IBM and other software vendors simplify the instructions by indicating that QSECOFR should install the software. In most cases, the profile responsible for the installation does not need to be QSECOFR. Any profile that has *ALLOBJ and *SECADM will suffice.

A second reason for the use of QSECOFR is that IBM and other software vendors usually test the install process using QSECOFR. They direct the customer to use this profile because they are confident the software will work smoothly if installed by the QSECOFR user profile.

Special considerations apply when you install changes to PC Support or OfficeVision/400-the user performing the installation must be enrolled in the system distribution directory. The QSECOFR user profile is automatically enrolled in the system distribution directory. If you elect to use another profile, you must enroll the alternate profile in the distribution directory.

If you want operations personnel to install a software package, you are faced with a dilemma. You probably will not want to give them access to a user profile that has *ALLOBJ and *SECADM special authorities. An alternative is to write a program that adopts a security officer's profile and prompts for a restore library command. You can write your own program or use the Restore Any Library (RSTANYLIB) command from library QUSRTOOL.

Q: How can I rename a user profile? The Rename Object (RNMOBJ) command does not allow the renaming of a user profile.

A:IBM does not support RNMOBJ for user profile objects because other objects reference the user profile, such as job descriptions and distribution directory entries. The following example shows how a security officer can create a profile with a new name which retains all the authorities of an existing user profile. The old profile name is OLDMARY the new user profile name is NEWMARY:

Sign on as a user that has *ALLOBJ and *SECADM special authority.

1. Use the Work with User Profile (WRKUSRPRF) command to display the Work with User Enrollment panel. Depending on how your system values and user profile parameters are set, you may need to press F21 and select the basic assistance level to view this screen. The difference between the Work with User Profile and Work with User Enrollment panels is that the enrollment panel gives you access to both user profiles and OfficeVision enrollments.

2. Select the copy option (option 3) to copy the old profile (OLDMARY) to the new profile (NEWMARY).

3. Give new profile NEWMARY all the private authorities of the old profile OLDMARY, using the Grant User Authority (GRTUSRAUT) command:

 GRTUSRAUT USER(NEWMARY) + REFUSER(OLDMARY)

4. Change the ownership of any documents and folders owned by the old profile to the new profile using the Change Document Library Object Owner (CHGDLOOWN) command:

 CHGDLOOWN OWNER(OLDMARY) + NEWOWN(NEWMARY)

5. Delete the old profile and transfer ownership of all other owned objects to the new profile. The Delete User Profile (DLTUSRPRF) command will change ownership of objects to the new profile and remove the old profile:

 DLTUSRPRF USRPRF(OLDMARY) + OWNOBJOPT(*CHGOWN NEWMARY)
BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: