IBM i Security News Bytes

See The Top Industry News - Above

IBM i Security Calendar of Events

Live Security Related Webcasts and Training for IBM i

How to Track Sensitive Database Changes at the Field Level
Webcast - Sponsored by Cilasoft Security Solutions and Read Technologies
Wednesday July 18 10:00 AM CDT
More Information and Register to Attend

Configuring and Using IBM i Auditing Functions
Webcast - Sponsored by Powertech
Thursday July 19 1:00 PM CDT
More Information and Register to Attend

IBM i: Achieving PCI 2.0 Compliance with Virtual and Cloud Computing
iProDeveloper Webcast - Featuring Mel Beckman - Sponsored by Enforcive
Thursday July 26 11:00 AM CDT
More Information and Register to Attend

Live 4-Day Hands-On Expanded Security Workshop for IBM i
Full Length Training Workshop - August 21-24 9:00am - 4:00pm Central Time
Dan Riehl presents his 4-Day Live Online Hands-on Security Workshop for the IBM i.
More Information and Register to Attend

Security Shorts -

Watch out for CHGPRF!

By Dan Riehl

Did you know that your end users and IT staff members may be able to change their own user profile?

Just like users can run the CHGPWD(Change Password) command to change their own password, they can run the CHGPRF(Change Profile) command to change their own user profile.

Almost all user profile attributes can be changed using this command. Certain attributes like Group Profile and Supplemental Group Profile cannot be changed. But that's little consolation when we find that our end users can change their initial program, initial menu, current library, job description, attention program, etc.

The CHGPRF command ships from IBM as *PUBLIC use, so it is available for general use. As you might suspect, the user must have at least *USE authority to the specified initial program, menu, job description, attention program, current library, etc. in order to make those kind of changes.

Certain parameters of the CHGPRF command are sensitive to the LMTCPB(Limit capabilities) attribute of the user's profile. For instance, if the user is LMTCPB(*PARTIAL), they cannot change their initial program, current library or attention key handling program. They can however change their initial menu and all the other attributes. If the user is LMTCPB(*YES), they cannot change their initial program, initial menu, current library or attention key program, but they can change all the rest of their profile attributes like job description, user options, output queue, printer and even the textual description of their user profile.

You may be thinking that this is not really such a big deal since the only people on your system that can run this command are IT folks and a limited number of users that have access to the command line. Users that are defined as LMTCPB(*YES) cannot enter this command on a command line, and I doubt you would place this option on their menu. But, any user that has IBM i Access(Client Access) installed on their PC can use the RMTCMD command to run the CHGPRF command. It's as simple as going to a DOS prompt and running the command:

RMTCMD     CHGPRF   INLMNU(MAIN)   JOBD(QGPL/HIGHPRI)   TEXT('I am so cool')

The RMTCMD.exe on your PC does not pay any attention to the LMTCPB attribute of the user running the command. The user can run any command to which they are authorized. And, since RMTCMD is an integral part of IBM i Access, you cannot just remove it from all your PCs. It's best to write or buy an exit program for the remote command server that would control this type of activity.

My recommendation to you is to change the object authority of the CHGPRF command to make it *PUBLIC AUT(*EXCLUDE). To make that change, you can use either the EDTOBJAUT(Edit Object Authority) command or the GRTOBJAUT(Grant Object Authority) command.