IBM i Security News Bytes

Linoma Announces Outlook 2010 Plugin for GoAnywhere

Linoma Software has announced the introduction of an Outlook 2010 Plugin for users of GoAnywhere Services Secure Mail.

This new support allows employees to send files, regardless of size, to one or more recipients using a combination of email (for notifications) and HTTPS protocol (for file retrieval). Recipients click on an encrypted HTTPS link within the email notification to securely download the file(s). Senders can add password protection and other parameters to increase the security of the transmission.
More Information from Linoma.

IBM i Security Calendar of Events

Live Security Related Webcasts and Training for IBM i

GoAnywhere Services Secure Mail Live Demo
Live Web Demo - Sponsored by Linoma Software
WednesdayAugust 15 Noon CDT
More Information and Register to Attend

Crowd Control - Managing Access For Powerful Users
Live webcast - Sponsored by Powertech
Wednesday August 29 1:00 PM CDT
More Information and Register to Attend

Live 4-Day Hands-On Expanded Security Workshop for IBM i
Full Length Training Workshop - August 21-24 9:00am - 4:00pm Central Time
Dan Riehl presents his 4-Day Live Online Hands-on Security Workshop for the IBM i.
More Information and Register to Attend

Security Shorts -

Copying Authorities from one User to Another

By Dan Riehl

I always encourage administrators to use or create a special "owner" profile to own all of our production objects/ For example, instead of the Distribution application programs and files being owned by a conglomeration of programmers and other IT people, the objects should be owned by a special owning profile, like DSTOWNER. DSTOWNER is not a group profile, and it has no password, so it cannot be used to sign on.

I also advise that certain system objects that we create, like User Profiles, be owned by QSECOFR. It might requires an extra step to assign the ownership to QSECOFR, but doing so avoids the problem of these objects being owned by IT staff members, who, sadly, come and go.

Creating a New User

When a new user must be created on your system, it is usually rather straightforward. However, if you have fallen into the trap of assigning object authorities at the user profile level, it becomes much more difficult to create the new user.

Let's say that you have a new system administrator and this new user needs to have the same authorities as an existing system administrator. You can easily copy the existing user profile to the new one. The Copy User profile option is available as Option 3 from the WRKUSRPRF(Work with User Profiles) display.

But, copying a user profile in this way does not copy the private authorities of the original user. For example, if the existing user owns a collection of libraries or files, that existing user has *ALL authority to those objects. How do we grant *ALL authority to the new user.

If the original user has private authorities, or ownership of 50 commands, 10 libraries, 200 files and a few job descriptions, you will need to grant all those same authorities to the new user. IBM has provided the tool to copy these authorities using the command GRTUSRAUT(Grant User Authority).

When using the command GRTUSRAUT, make sure you are signed-on as QSECOFR or as an *ALLOBJ user, otherwise, certain objects or authorities may be skipped.

Copying the Authorities

Here is a command that will copy the private authorities(including those granted through ownership) from OLDUSER to NEWUSER.

GRTUSRAUT USER(NEWUSER) REFUSER(OLDUSER)

When you run this command, it would be best to submit it to batch, since it may take a log time to run. So use the command

SBMJOB CMD(GRTUSRAUT USER(NEWUSER) REFUSER(OLDUSER))

Here is the IBM Documentation on GRTUSRAUT command.