Home > AS/400 Tips > iSeries security tips > Controlling access to spool files

	iSeries 400 Tips:	EMAIL THIS

	TIPS & NEWSLETTERS TOPICS

	ISERIES SECURITY TIPS Controlling access to spool files Rich Loeber 07.26.2005 Rating: -4.31- (out of 5) Digg This!     StumbleUpon     Del.icio.us    A nice feature of OS/400 is it enables you to view the contents of spool files before they have been printed or distributed electronically. For a lot of users, that saves time and paper. But not all spool files should be able to be viewed by every user. This tip takes a look at some ways to control who is allowed to see which spool files on your system. Print spool files are special objects on your system that are stored in the QSPL library. You cannot control access at the spool file level on your OS/400 system. Access to the spool files must be controlled through the output queue that is associated with each spool file. [TABLE]			[IMAGE]

If you have sensitive or confidential information stored in a print spool file, the best way to secure it is to create a special output queue (or set of output queues) that are secure to a known set of users. Directing the spool file into the right output queue can sometimes be tricky. OS/400 generally checks the following sequence of things to direct the output from a job:

To direct your sensitive output to the right output queue, your best bet is to specify it in the printer file being used by your application.

Output queues can be created in any library on your system. Output queues for printer devices generally get created in the QUSRSYS library, but you are not limited by that. To improve security, create your secure output queue in a separate library that has limited access at the library level.

Once the output queue has been create

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT iSeries security tips Checking in on your IBM i authorization lists PCI data security standards and the System i Securing the integrated file system on IBM System i Contextual security on IBM i: Limit user profile access Time for a security checkup for your i Security monitoring on IBM i: Watching your super users Tracking System i program object changes Recovering your AS/400 security configuration System values on i: Setting them up and locking i down A guide to System i security, Part 3: Digging in to the System i security environment Printing on iSeries Acknowledging control characters in a print file on IBM i without writing a program Set up a HP Deskjet 6988 with a built-in internal NIC as a stand-alone printer Determine printing options available for preprinted medical forms Direct default print job to tray 2 from IBM i Solve printing problems when using Personal Communications 5.7 Messages and spool hanging up SAVLIB jobs when OUTPUT(*PRINT) is specified Using AFPRSC to print .jpg or .pdf files from the IFS on AS/400 Print overlays from the AS/400 using the IBM AFP printer driver Setting up double-sided printing from the AS/400 Do AS/400 printers have to be IPDS compatible? Printing on iSeries Research

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary Advanced Function Printing  (Search400.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

d, you can then limit access to it using the Grant Object Authority (GRTOBJAUT) command and Edit Object Authority (EDTOBJAUT) command. To specifically limit general access to the output queue, the PUBLIC setting for the *OUTQ object must be set to *EXCLUDE. Then, in the individual user authorities, you can provide access for specific user profiles or group profiles.

You should also note that user profiles with the special authority of *SPLCTL will be able to view and work with spool files regardless of their access control limitations to your secure output queue. This is a form of all object authority, but applied to only spool files. You should limit the number of profiles on your system that have the *SPLCTL authority in order to maintain the security of your sensitive output queues.

The output queue also has a special setting called the "Display Data" (DSPDTA) parameter that can be used to control viewing spool files. When you set it to *NO, only the spool file owner profile can view the contents of the spool files in the output queue. You can check the value of this parameter using the Work with Output Queue Description (WRKOUTQD) command to see how it is set up for your secure output queue.

There are some other intricacies covered in the OS/400 security manual. If you have any questions about this topic, you can reach me at rich@kisco.com, I'll give it my best shot. All e-mail messages will be answered.

---------------------------------------

Rate this Tip To rate tips, you must be a member of Search400.com. Register now to start rating these tips. Log in if you are already a member. Submit a Tip DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.