Planning command security

When your system arrives, the ability to use commands is set up to meet the security needs of most installations. Some commands can be run only by a security officer. Others require a special authority, such as *SAVSYS. Most commands can be used by anyone on the system. You can change the authority to commands to meet your security requirements.

For example, you might want to prevent most users on your system from working with communications. You can set the public authority to *EXCLUDE for all commands that work with communications objects, such the CHGCTLxxx, CHGLINxxx, and CHGDEVxxx commands.

If you need to control which commands can be run by users, you can use object authority to the commands themselves. Every command on the system has object type *CMD and can be authorized to the public or only to specific users. To run a command, the user needs *USE authority to that command. Commands shipped with public authority *EXCLUDE lists all the commands that are shipped with the public authority set to *EXCLUDE.

If you use the System/38 library, you need to restrict security-relevant commands in that library also. Or, you might restrict access to the entire library. If you use one or more national language versions of the IBM® i licensed program on your system, you need to restrict commands in the additional QSYSxxx libraries on your system as well.

Another useful security measure is to change the default values for some commands. The Change Command Default (CHGCMDDFT) command allows you to do this.