Unconfigured Ad Widget

Collapse

Announcement

Collapse
No announcement yet.

RVKOBJ/GRTOBJ *exclude with *allobj

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • #31
    RVKOBJ/GRTOBJ *exclude with *allobj

    Hmmmmmmmm. If you have non-admin non-operational types with *ALLOBJ authority in a large shop, that would be cause for concern. David, you'd be surprised. When I first arrived in my last shop, the "local" guy with the "SuperID" had ZERO as/400 training or interest. He was a Novell LAN and PC Tech type of guy, not an AS/400 security adminsitrator. I literally had to cut and paste AS/400 commands into e-mails so that he could paste them into his 5250 session and run the commands for me. He had NO clue what the commands were for, but he was the only guy onsite with the authority to run them. (Our machine and operations staff were physically located in another state.) You betcha, that situation was a cause for concern! P.S. Because he wouldn't learn the 400, yours truly ended becoming the "security expert" on that machine, mostly because I was the only one aware enough to be alarmed by the situation! What a nightmare!

    Comment


    • #32
      RVKOBJ/GRTOBJ *exclude with *allobj

      Ed Fishel is doing a great job of busting OS/400 security myths in this thread, but he missed this one....
      >My philosophy is that if anybody outside QSECOFR and QSECADM have *allobj authority, it SHOULD be the <<
      There is no IBM shipped profile called QSECADM. If you have QSECADM on your system, it is because someone at your site created it (it's apparantly a popular back door). You might want to look at who controls the password on that little beastie. jte MC Security Editor

      Comment

      Working...
      X