IBM i Security Calendar of Events

Live Security Related Webcasts and Training for IBM i

Top 10 Security and Compliance Considerations for Cloud Computing
with Carol Woodbury
Live Webcast - Presented by Skyview Partners
Thursday, April 25 10:00am CDT
More Information and Register to Attend

Automatic Encryption with FIELDPROC on the IBM i
with Patrick Townsend
Live Webcast - Sponsored by Townsend Security
Tuesday, April 30, 12:00 Noon CDT
More Information and Register to Attend

10th Anniversary: PowerTech's "State of IBM i Security Study 2013"
Live Webcast - Sponsored by PowerTech
Robin Tatam, Director of Security Technologies for PowerTech, will reveal the
latest results from a decade of ongoing research into the security configuration of IBM i. Wednesday, May 1, 1:00 PM CDT
More Information and Register to Attend

Live Hands-On IBM i Expanded Security Workshop for IBM i
with Dan Riehl
Full Length Training Workshop - May 7 - 10
Dan Riehl presents this 4-Day Live Online Hands-on Expanded Security Workshop.
More Information and Register to Attend

Live Hands-On IBM i Security Assessment Workshop for IBM i
with Dan Riehl
Full Length Training Workshop - May 21 - 24
Dan Riehl presents this 3.5-Day Live Online Hands-on Security Assessment Workshop.
More Information and Register to Attend

Security Shorts -

Watch out for the CL Command CHGPRF!

By Dan Riehl

Did you know that your end users and IT staff members can change their own user profile?

Just like users can run the CHGPWD(Change Password) command to change their own password, they can run the CHGPRF(Change Profile) command to change their own user profile.

Almost all user profile attributes can be changed using this command. Certain attributes like Group Profile and Supplemental Group Profile cannot be changed. But that's little consolation when we find that our end users can change their initial program, initial menu, current library, job description, attention program, etc.

The CHGPRF command ships from IBM as *PUBLIC use, so it is available for general use. As you might suspect, the user must have at least *USE authority to the specified initial program, menu, job description, attention program, current library, etc. in order to make those kind of changes.

Certain parameters of the CHGPRF command are sensitive to the LMTCPB(Limit capabilities) attribute of the user's profile. For instance, if the user is LMTCPB(*PARTIAL), they cannot change their initial program, current library or attention key handling program. They can however change their initial menu and all the other attributes. If the user is LMTCPB(*YES), they cannot change their initial program, initial menu, current library or attention key program, but they can change all the rest of their profile attributes like job description, user options, output queue, printer and even the textual description of their user profile.

You may be thinking that this is not really such a big deal since the only people on your system that can run this command are IT folks and a limited number of users that have access to the command line. Users that are defined as LMTCPB(*YES) cannot enter this command on a command line, and I doubt you would place this option on their menu. But, any user that has IBM i Access(Client Access) installed on their PC can use the RMTCMD command to run the CHGPRF command. It's as simple as going to a DOS prompt and running the command:

RMTCMD     CHGPRF     JOBD(QGPL/HIGHPRI)   TEXT('I am so cool')

The RMTCMD.exe on your PC does not pay any attention to the LMTCPB attribute of the user running the command. The user can run any command to which they are authorized. And, since RMTCMD is an integral part of IBM i Access, you cannot just remove it from all your PCs. It's best to write or buy an exit program for the remote command server that would control this type of activity.

My recommendation to you is to change the object authority of the CHGPRF command to make it *PUBLIC AUT(*EXCLUDE). To make that change, you can use either the EDTOBJAUT(Edit Object Authority) command or the GRTOBJAUT(Grant Object Authority) command.