Live Security Related Webcasts and Training for IBM i

August Events

7 Habits Of Highly Secure Organizations
Live Webcast - Presented by PowerTech
Wednesday, August 21 1:00pm CDT
More Information and Register to Attend

Live Hands-On - Expanded Control Language Programming Workshop
with Dan Riehl
Full Length Training Workshop - August 19-23
Dan Riehl, Co-Author of the textbook Control Language Programming for the IBM i
presents this 5-Day Live Online Hands-on Workshop.
More Information and Register to Attend

September Events

Live Hands-On - IBM i System Administration and Control Workshop
with Dan Riehl
Full Length Training Workshop - September 4,5,6 and 11,12
Dan Riehl presents this 5-Day Live Online Hands-on Workshop.
More Information and Register to Attend

COMMON 2013 Fall Conference and Expo
Three Day Conference and Expo - September 9-11
Renaissance Grand St. Louis • St. Louis, Missouri
More Information and Register to Attend

October Events

Live Hands-On - QAUDJRN Auditing and Forensic Analysis Workshop for IBM i
with Dan Riehl
Full Length Training Workshop - oct 2-3
Dan Riehl presents this 2-Day Live Online Hands-on Workshop.
More Information and Register to Attend

Live Hands-On - Expanded Security Workshop for IBM i
with Dan Riehl
Full Length Training Workshop - October 7-10
Dan Riehl presents this 4-Day Live Online Hands-on Workshop.
More Information and Register to Attend

Security Shorts

Copying Authorities from one User to Another

By Dan Riehl

I always encourage administrators to use or create a special "owner" profile to own all of our production objects/ For example, instead of the Distribution application programs and files being owned by a conglomeration of programmers and other IT people, the objects should be owned by a special owning profile, like DSTOWNER. DSTOWNER is not a group profile, and it has no password, so it cannot be used to sign on.

I also advise that certain system objects that we create, like User Profiles, be owned by QSECOFR. It might requires an extra step to assign the ownership to QSECOFR, but doing so avoids the problem of these objects being owned by IT staff members, who, as we all know, come and go.

Creating a New User

When a new user must be created on your system, it is usually rather straightforward. However, if you have fallen into the trap of assigning object authorities at the user profile level, it becomes much more difficult to create the new user.

Let's say that you have a new system administrator and this new user needs to have the same authorities as an existing system administrator. You can easily copy the existing user profile to the new one. The Copy User profile option is available as Option 3 from the WRKUSRPRF(Work with User Profiles) display.

But, copying a user profile in this way does not copy the private authorities of the original user. For example, if the existing user owns a collection of libraries or files, that existing user has *ALL authority to those objects. How do we grant *ALL authority to the new user.

If the original user has private authorities, or ownership of 50 commands, 10 libraries, 200 files and a few job descriptions, you will need to grant all those same authorities to the new user. IBM has provided the tool to copy these authorities using the command GRTUSRAUT(Grant User Authority).

When using the command GRTUSRAUT, make sure you are signed-on as QSECOFR or as an *ALLOBJ user, otherwise, certain objects or authorities may be skipped.

Copying the Authorities

Here is a command that will copy the private authorities(including those granted through ownership) from OLDUSER to NEWUSER.

GRTUSRAUT USER(NEWUSER) REFUSER(OLDUSER)

When you run this command, it would be best to submit it to batch, since it may take a long time to run. So use the command

SBMJOB CMD(GRTUSRAUT USER(NEWUSER) REFUSER(OLDUSER))

Here is the IBM Documentation on GRTUSRAUT command.