There is a serious security risk that, as far as I can see, is not documented in the Security Concepts and Planning manual, regarding the LMTCPB(*YES) setting - that is, limiting the capabilities of users.
When LMTCPB(*YES) is specified for a user profile, the user will not be able to execute any OS/400 commands manually except for the following five:
Display Message (DSPMSG) Send Message (SNDMSG) Sign Off (SIGNOFF) Display Job (DSPJOB) Display Job Log (DSPJOBLOG)
To accomplish this, IBM has apparently placed some code in the standard menu driver program so that only these five commands are acceptable. Unfortunately, they forgot to do the same in the Command Entry screen (program QSYS/QCMD) - even if the user has limited capabilities, he or she will be able to run any OS/400 command provided that authority has not been specifically revoked.
So, do not set QCMD/QSYS as the attention-key handling program on users that should have limited capabilities, or your entire security system could be breached. Do not call this program from any other programs that may be executed by limited-capability users, either. Ignoring this warning could result in users deleting database files or entire libraries from the Command Entry program!
- Ernie Malaga
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online