Feature Article

The Command Line Restriction - Limited Capabilities

By Dan Riehl - SecureMyi.com

In speaking to many security analysts over the years, it is obvious that there is a BIG Disconnect on what the "Limited Capabilities" attribute of the user profile actually does. In this article, I hope to dispel these potentially dangerous misconceptions.

In this March 11, 2015 issue of the SecureMyi Security Newsletter, the featured YouTube Video presents a video discussion of this important topic.

What IS Limited Capabilities?

System users can gain access to the IBM i shell command line through various IBM-supplied screens, including most IBM menus, the Work with Spooled Files (WRKSPLF) command display, the Work with User Jobs (WRKUSRJOB) command display, and numerous other commands and facilities.

Allowing users to access a command line can be very dangerous; for example, you don't want users running commands like DLTF CUSTOMER, which would delete your Customer file. A user who has command line access can run any CL command that he or she is authorized to run at the command line interface.

IBM allows you to control the ability of a user to run CL commands at a command line by specifying the LMTCPB(Limit Capabilities) attribute of the user profile. To create a user that has limited command line capabilities, you use the CRTUSRPRF(Create User Profile) command as shown here:

CRTUSRPRF... LMTCPB(*YES)

The common misconception regarding users with limited capabilities( i.e. LMTCPB(*YES) ) is that we think that these users cannot run any ad-hoc CL command, such as

WRKSPLF   or   DLTF CUSTOMER

But, in reality, a user with limited capabilities CAN run CL commands using several methods which we will discuss in this article.

Did you know that IBM ships certain CL commands with a special command attribute that specifies that Limited Capability users are allowed to run the command at a shell command line.

These commands include:

• Sign Off (SIGNOFF)
• Send Message (SNDMSG)
• Display Messages (DSPMSG)
• Display Job (DSPJOB)
• Display Job Log (DSPJOBLOG)
• Work with Messages (WRKMSG)

The Command Attribute ALWLMTUSR

You can examine the command definition of a CL command using the command DSPCMD(Display Command). To examine the command DSPMSG(Display Message), you could use the following command.

DSPCMD DSPMSG

Read More