IBM i Security News Bytes

LinkedIn Passwords Hacked
LinkedIn was recently hacked for possibly millions of member passwords. Details are still emerging. If you have not yet changed your LinkedIn password, I encourage you to do so. In response to the attack, IBM i security and encryption vendor Townsend Security has created a webcast focusing on the LinkedIn password hack and other related incidents.
Townsend Security Webcast On LinkedIn Breach

Cilasoft Introduces "EAM" - Elevated Authority Manager For IBM i
Elevated Authority Manager(EAM) is a software solution that allows you to temporarily provide elevated capabilities to specified users; including reports, alerts, and a full audit trail of activities.
More information and Download a Trial

Skyview Partners Introduces Managed Services for IBM i and AIX Compliance
SkyView Partners announced a new managed service for both the IBM i and AIX platforms. The new service covers monthly compliance monitoring and annual vulnerability assessments and includes licenses of SkyView’s compliance related software.
See More Information from Skyview

IBM i Security Calendar of Events

Live Security Related Webcasts and Training for IBM i

Coffee with Carol
Step by Step Approach to Implementing Object Level Security
Webcast - Featuring Carol Woodbury - Sponsored by Skyview Partners
Wednesday June 27 10:00 AM CDT
More Information and Register to Attend

Live 4-Day Hands-On Expanded Security Workshop for IBM i
Full Length Training Workshop - August 21-24 9:00am - 4:00pm Central Time
Dan Riehl presents his 4-Day Live Online Hands-on Security Workshop for the IBM i.
More Information and Register to Attend

Security Shorts -

Caveat - Managing User Profiles Under Adopted Authority

By Dan Riehl

We often use the facility called "adopted authority" to allow a user to perform operations that they have no inherent authority to perform. For example, many of us use adopted authority to allow help desk users to reset a blown password or reset a user status from *DISABLED to *ENABLED.

You can also use adopted authority to allow the help desk to create user profiles or change other attributes of existing user profiles. But there is one major caveat when creating or changing user profiles under adopted authority; adopted authority cannot be used to assign a user to a group profile.

As an example, a help desk user runs a program to create a user profile. The program adopts the authority of Security Officer (QSECOFR), temporarily making the user "all powerful."

But in order to assign a user to a group profile (or supplemental group profile), the help desk user must have his or her own authority to the group profile being assigned to the user. Adopted authority cannot be used to assign the group.

The IBM documentation states that the user creating or changing the profile must have *CHANGE and *OBJMGT rights to the group profile in order to assign a user to the group and that the authority cannot come from the use of adopted authority.

This bothered me, as I did not want to give the help desk users that much authority to groups that they may need to assign. With *CHANGE authority, the help desk users would be able to run jobs as the group or otherwise hijack the group. (For more information on this exposure, see my article on "Protecting Your User Profiles.")

In my testing, I was able to confirm that I could remove the *EXECUTE right for the help desk user to the groups they need to assign, thereby preventing the misuse of the group profiles.

So, yes, you assign the help desk users *CHANGE and *OBJMGT rights to the group profile they need to assign and then remove their *EXECUTE rights, in order to protect the group from being misused.

It is interesting that the help desk users can change the other attributes of a user profile while running under QSECOFR adopted authority, but they cannot assign a new group to which they are not authorized.

See the IBM support document on this topic.