This time of year, children of all ages are looking for those treasures that have been hidden and will eventually appear as a beautifully wrapped present. But until then, the hunt is on! So I thought it might be fun to "unveil" some of the hidden treasures of i5/OS security. Like some gifts, not all will fit your specific needs or requirements, but hopefully, you'll find something that will be just your size.
NetServer connections
One of the latest i5/OS gifts that I discovered is the ability to see who is connected to the NetServer server and which file share they used to make the connection. I have found this very helpful in determining the feasibility of removing a file share - especially file shares to root. To see this, open iSeries Navigator-> Network -> Servers and click on TCP/IP. When the list of servers appears on the right, right click on iSeries NetServer and choose Open.
User profile options
The Display User Profile command has more options than just displaying the attribute of the user profile. You can display the members (if the profile is a group), the objects to which the profile's been given a private authority, commands to which it's been given a private authority and more. I especially like the command authority option when I'm helping a client remove their programmers from the QPGMR group profile. I run DSPUSRPRF QPGMR *CMDAUT and show the client all of the commands their programmers are currently authorized to run. This accomplishes two things - 1) confirmation that programmer have too much authority when they are a member of QPGMR and 2) a list of the commands to which they need to authorize the programmers' new group.
Copy Audit Journal Entry (CPYAUDJRNE)
This is, undoubtedly, my favorite enhancement of V5R4. This command creates a copy of the model outfile for the specific audit journal entry type I'm interested in (for example, a copy of QASYAFJ5 which maps out the authority failure audit journal entry.) Then it runs the Display Journal (DSPJRN) command and sends the results to an outfile. Why is CPYAUDJRNE my favorite command? Because CPYAUDJRNE takes two steps (making a copy of the model outfile and running DSPJRN) and only makes me do one step. It also simplifies the complexities of DSPJRN by only providing the parameters pertinent to displaying audit journal entries. The output of this command is an outfile containing the specified type of audit journal entries which I can then query or merge with another file. In other words, it saves me time.
Display Journal (DSPJRN)
Another V5R4 enhancement related to the audit journal is the additional information regarding the audit entry that is displayed when running the Display Journal (DSPJRN) command. To see the additional information, press F10 to see the entry data. The information has been expanded to see the IP address, VPN information, etc. This is especially helpful information when you know the exact error that occurs (such as someone disabling a profile by repeatedly trying to sign on with the wrong password) but you need more information to debug the issue. In the example given, having the IP address available allows me to do a reverse DNS lookup and determine which workstation the incorrect sign on attempts are originating from. (Note: I use DSPJRN rather than CPYAUDJRNE when I know the exact date and time of the error and need more details about the error. I use CPYAUDJRNE when I need to find an error or when multiple changes have occurred and I need to see multiple entries.)
Policy Minder Gifts
SkyView's Policy Minder product - like i5/OS - has plenty of gifts as well. Here are just a few of them:
Send compliance information to a file
When I first start to use Policy Minder at a client, to get the best "picture" of their application security schemes, I define library authority templates for each application and run a compliance check. Then I use the Output Compliance Information(OUTCPL) command to send the compliance information to a stream file. (I can also send it to an outfile and query the results.) I often send all information - both compliant and non-compliant so that I can see the whole security scheme of the application.
Finding dynamic SQL
Run the ANZSQLINF command to find programs containing dynamic SQL. This is especially helpful if you are re-working an application security scheme and you want users' authority to access application files to come from adopted authority. When a program contains dynamic SQL, the program's Dynamic user profile parameter must to be specified. The report generated from ANZSQLINF lists the programs containing dynamic SQL and their current settings for the User profile, Use adopted authority and Dynamic user profile program attributes.
Find the template
Forget which templates a particular object is in or concerned that you have forgotten to include an object in a template? Simply run the Display Library Authority Policy (DSPLIBAPOL), Display Directory Authority Policy (DSPDIRAPOL) or the Display User Profile Policy (DSPUSRPOL) command with the name of the object in question and the template(s) will be listed.
Run FixIt in test mode
If you don't quite feel comfortable about running the FixIt function, you can run it in test mode. Simply run the FIXIT command specifying TEST(*YES). All objects that would have been changed are logged in the Policy Minder Message Log (option 20 from the Main Menu) preceded with '>>>' as an indication that the function was run in test mode.
