Help! Need to give program QSECOFR authority.

Help! Need to give program QSECOFR authority.

Post by Lee Stonema » Thu, 06 Jun 1996 04:00:00



Help!

Can somebody please tell me how to give a program QSECOFR authority. I
need to allow a user to run end of month processing as QSECOFR. I used to
be able to do it under the previous release, but ever since changing to
v3.1 it stopped working.

Any help would be appreciated. IBM ASSIST/400 cannot seem to help. Is
this a loophole in the OS that has subsequetly been closed or does
another method exist.

Thanks,

Lee Stoneman
Systems Developer
DAS Legal Expenses.

 
 
 

Help! Need to give program QSECOFR authority.

Post by Ian Haine » Thu, 06 Jun 1996 04:00:00


Sign on as QSECOFR.

Re-compile the program but with USRPRF(*OWNER) on the CRT*PGM command.  
Then when the program is run it will adopt the authority of the
program's owner, QSECOFR.

 
 
 

Help! Need to give program QSECOFR authority.

Post by Paolo SPELL » Thu, 06 Jun 1996 04:00:00



> Can somebody please tell me how to give a program QSECOFR authority.

Just use these 2 commands:

CHGOBJOWN OBJ(pgm_libr/pgm_name)
          OBJTYPE(*pgm)
          NEWOWN(qsecofr)

CHGPGM    PGM(pgm_libr/pgm_name)
          USER(*OWNER)

The syntax is not sure but I home is clear the meaning.

P.S.: every program running with QSECOFR authority is a security exposure,
even more if you call another program from this one. Be carefull.

bye

Paolo

 
 
 

Help! Need to give program QSECOFR authority.

Post by Charles Green » Thu, 06 Jun 1996 04:00:00



> Help!

> Can somebody please tell me how to give a program QSECOFR authority. I
> need to allow a user to run end of month processing as QSECOFR. I used to
> be able to do it under the previous release, but ever since changing to
> v3.1 it stopped working.

> Any help would be appreciated. IBM ASSIST/400 cannot seem to help. Is
> this a loophole in the OS that has subsequetly been closed or does
> another method exist.

> Thanks,

> Lee Stoneman
> Systems Developer
> DAS Legal Expenses.You can try changing the object owner from *user to qsecofr if it is not

already.  I have several jobs that run in a similar fashion with little
or no difficulty.
 
 
 

Help! Need to give program QSECOFR authority.

Post by Gary McMeek » Fri, 07 Jun 1996 04:00:00



>Sign on as QSECOFR.
>Re-compile the program but with USRPRF(*OWNER) on the CRT*PGM command.  
>Then when the program is run it will adopt the authority of the
>program's owner, QSECOFR.

You have to have USEADPAUT(*NO) too, I thought. Otherwise it adopts
the authority from the previous level.

--

Marcam Corp,95 Wells Ave, Newton MA 02159
Tel: 617 928 8018       Fax: 617 965 7484

 
 
 

Help! Need to give program QSECOFR authority.

Post by Jeff Crosb » Sat, 08 Jun 1996 04:00:00



> Help!

> Can somebody please tell me how to give a program QSECOFR authority. I
> need to allow a user to run end of month processing as QSECOFR. I used to
> be able to do it under the previous release, but ever since changing to
> v3.1 it stopped working.

After compiling the program, do the following:

        1)  CHGOBJOWN OBJ(yourprogramname) OBJTYPE(*PGM) NEWOWN(QSECOFR)
        2)  CHGPGM PGM(yourprogramname) USRPRF(*OWNER)

This should do it for you.

--
-Jeff


 
 
 

Help! Need to give program QSECOFR authority.

Post by Jacques Fuente » Sat, 08 Jun 1996 04:00:00



> Sign on as QSECOFR.

> Re-compile the program but with USRPRF(*OWNER) on the CRT*PGM command.
> Then when the program is run it will adopt the authority of the
> program's owner, QSECOFR.If the security level of your AS400 is set to 40 or higher (QSECURITY),

the user must have the authority on the QSECOFR profile.
 
 
 

Help! Need to give program QSECOFR authority.

Post by Gord Hutchins » Sun, 09 Jun 1996 04:00:00




>> Help!

>> Can somebody please tell me how to give a program QSECOFR authority. I
>> need to allow a user to run end of month processing as QSECOFR. I used to
>> be able to do it under the previous release, but ever since changing to
>> v3.1 it stopped working.

>After compiling the program, do the following:
>    1)  CHGOBJOWN OBJ(yourprogramname) OBJTYPE(*PGM) NEWOWN(QSECOFR)
>    2)  CHGPGM PGM(yourprogramname) USRPRF(*OWNER)
>This should do it for you.
>--
>-Jeff


Having a program adopt QSECOFR authority can be very dangerous if you're
not careful.  As long as this program is in your program stack, any program
called subsequently will also run with QSECOFR authority.

Gord

--
Gord Hutchinson,
Mississauga, Ontario,
Canada
"The reasonable man adapts himself to the world: the unreasonable
one persists in trying to adapt the world to himself.  
Therefore all progress depends on the unreasonable man."  
George Bernard Shaw

 
 
 

Help! Need to give program QSECOFR authority.

Post by HarryHil » Tue, 11 Jun 1996 04:00:00



Hutchinson) writes:
>>> Can somebody please tell me how to give a program QSECOFR authority. I
>>> need to allow a user to run end of month processing as QSECOFR. I used
to
>>> be able to do it under the previous release, but ever since changing
to
>>> v3.1 it stopped working.

>>After compiling the program, do the following:
>>        1)  CHGOBJOWN OBJ(yourprogramname) OBJTYPE(*PGM) NEWOWN(QSECOFR)
>>        2)  CHGPGM PGM(yourprogramname) USRPRF(*OWNER)
>>This should do it for you.
>>--
>>-Jeff

>Having a program adopt QSECOFR authority can be very dangerous if you're
>not careful.  As long as this program is in your program stack, any
program
>called subsequently will also run with QSECOFR authority.

Just a note -- only those called programs that have the USEADPAUT(*YES)
attribute will use the adopted authority of previous programs in the call
stack. By default, programs are assigned this attribute when they're
created. To change programs to not use adopted authority, run the
following command:

CHGPGM PGM(library-name/program-name) USEADPAUT(*NO)

The program being changed must have its observable information.


Software authoring & consulting for the AS/400
Los Angeles, CA USA