|
I'm assuming that your auditors want you to use the QLMTSECOFR system
value. If you turn it "on" that means that users with *ALLOBJ and/or
*SERVICE special authority can only sign on devices to which they have
been given explicit authority of *CHANGE. You can give QSECOFR *CHANGE
authority to specific devices and then all *ALLOBJ or *SERVICE users can
sign on the device. However, as you point out, this is very difficult
when you are using DHCP. In your case, the only way you can implement
this is to use "named devices." That is, instead of QPADEV*, a TELNET
exit program assigns an actual device name to the session. Then you can
grant authority to that device. Otherwise, you have to grant authority
to all virtual devices and that defeats the purpose. I believe there is
an example of this type of exit program here. ==================================
MORE INFORMATION ON THIS TOPIC
==================================
The Best Web Links: Tips, tutorials and more.
Search400.com's targeted search engine: Get relevant information on security.
Ask your systems management questions--or help out your peers by answering them--in our live discussion forums.
Read this Search400.com Featured Topic: Secure your iSeries
|
