How to restrict required libraries and through error message when tried to access. in as/400
Remove
production libraries from system value QUSRLIBL. Having these libraries in the library list
when a user signs on it effect gives them authority to the libraries. Ssecurity enhancements have to be implemented to users who do not have specific authority to these libraries and should experience errors when trying to sign on
Software/Hardware used:
Software/Hardware used:
ASKED:
November 26, 2009 12:31 PM
UPDATED:
November 30, 2009 9:37 PM
Answer Wiki:
Having libraries in a library list does nothing that "gives them authority". If a user <i>doesn't have authority</i> to a library in QUSRLIBL and QUSRLIBL is assigned as that user's library list, then the user will not be able to signon. An authority failure will stop the logon. The user must already have authority to the library in order to signon when the library is part of the user's library list.
However, <i>if the user has authority</i> to the library, then the authority will be available whether the library is in the library list or not. The only difference is that the library can't be accessed through the library list. It can still be accessed by name.
Regardless, "production" libraries should not be listed in QUSRLIBL. There is no reason to make libraries automatically available when the libraries contain objects that don't need to be advertised.
Further, the libraries should have PUBLIC *EXCLUDE which should make them unusable in QUSRLIBL.
But, what as Philpl1jb asked, what is the question?
Tom
To see all answers submitted to the Answer Wiki: View Answer History.
Is there a question here?
I think the key point here is that security on the AS/400 includes OBJECT authority restrictions. You can restrict a user or group of users from libraries or from specific files or restrict how they can use these or anyother objects.
Phil
Are you asking how to restrict users form certain libraries? If so, this can be done through a variety of means. Object authority, group profiles and authorization list are just a few that come to mind.