Unconfigured Ad Widget

Collapse

Announcement

Collapse
No announcement yet.

IBM default passworkds

Collapse
X
Collapse
 
  • Page of 1
  • Filter
  • Time
  • Show
Clear All
new posts
Previous template Next
  • #1

    IBM default passworkds

    I just started a new job and since the last person was terminated, the Pres. wants ALL the passwords changed. Can I just change the IBM supplied profiles to a new password? I thought I could not do this for those. I asked one of our consultants and he didn't know either. TIA Cheri
    Tags: None
  • #2
    IBM default passworkds

    Cheri, Of course you can change the default passwords. In fact, if they have not been changed and you allow dial-up or internet communication, your system is wide open. Most of your defaults can be changed to *NONE so they can't be signed on. Of course there are some like the server profiles that must be enabled, but can have their password changed. One of the most reliable ways of knocking out outside communications is to dial into the system, attempt to sign on as QSRV or other service profile. Even if you don't get the password correct, you can keep trying and hope that you disable the profile after too many incorrect signon attempts. I suggest that you write a CL to read each user profile, set the default password to the user profile with the password expired. This will force everybody to set up a new password. -bret P.S. Cheri, look at the book store on the MC homepage. There is a book by Wayne O Evans called AS/400 security. I just purchased it to keep up to date. The best part? It's only 15 dollars for the time being. Here is the link to the book. http://www.mc-store.com/mc-store/wayoevonasse.html

    Comment

    • #3
      IBM default passworkds

      Cheri, If you use a profile with *SecAdm authority, it can change anyone it wants. If you would like to do this quickly, I would suggest doing a WrkUsrPrf *all. You can then put a 2 in front of every profile and on the command line put PwdExp(*Yes) . This will set every profile's password to an expired status and this results in everyone needing to change their password at the next signon (note: You may run into trouble trying to start PC connections with expired profiles). You can then modify the Q* profile however you wish. You might do a WrkUsrPrf Q*; then put a 2 in front of every profile and on the command line put Password(*None). This will disallow signing on for this profile. You would probably then want to go to specific profiles and give them other passwords (QSecOfr, QSrv, etc.) Bill

      Comment

      • #4
        IBM default passworkds

        Bill, A minor correction... you need *SECADM and *ALLOBJ to change everybody's user-id. *SECADM alone does not guarantee you can modify everybody's user-id, specially for user-ids created using another administrator's id.

        Comment

        • #5
          IBM default passworkds

          Cheri, For purposes of security, you should change all user passwords to *NONE. Do this also for QSYSOPR, QPGMR, QUSER, QSRV, and QSRVBAS. You should also change the passwords for QSECOFR and DST. Is this safe to do? In most cases, probably "yes". But only you can answer that question with certainty. You have to dig through all your application program code to see if there are hard-coded user-ids and passwords.

          Comment

          • #6
            IBM default passworkds

            Cheri - Personally, I like the idea of changing QSECOFR's password AND DISABLING the user profile. This prevents QSECOFR from being using anywhere except the system console (you can always sign on from the console using QSECOFR). HTH, Steve

            Comment

            • #7
              IBM default passworkds

              If you use QSECOFR to crate the program and have it adopt the owner authority then you won't have to worry about the authority of the profile you use to run it.

              Comment

              • #8
                IBM default passworkds

                If you are FTP'n to the AS/400 you also have to check any code that is being used on other machines.

                Comment

                • #9
                  IBM default passworkds

                  On other thing to look at. Under Security Tools there is an option to analyze default passwords. This function will list all the profiles that have the passwords as the signon.

                  Comment

                  • #10
                    IBM default passworkds

                    Cheri, I agree with Steve's suggestion here. I had forgotten about that. I have QSECOFR, QSECADM, QSYSOPR set to *none and *disabled. I created a profile with SECOFR authority for when I need to sign on and do something that only QSECOFR could do. This really is not much, and when I do software installs or updates, I still do it from the console under QSECOFR for continuity. -bret

                    Comment

                    Previous template Next
                    Working...
                    X