208 lines
13 KiB
HTML
208 lines
13 KiB
HTML
|
<?xml version="1.0" encoding="UTF-8"?>
|
|||
|
|
<!DOCTYPE html
|
|||
|
|
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|||
|
|
<html lang="en-us" xml:lang="en-us">
|
|||
|
|
<head>
|
|||
|
|
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
|||
|
|
<meta name="security" content="public" />
|
|||
|
|
<meta name="Robots" content="index,follow" />
|
|||
|
|
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
|||
|
|
<meta name="DC.Type" content="concept" />
|
|||
|
|
<meta name="DC.Title" content="Plan printer and printer output queue security" />
|
|||
|
|
<meta name="abstract" content="This topic describes the key points in planning security for the printer and printer output queue, the importance of the planning tasks, and recommendations for completing the tasks." />
|
|||
|
|
<meta name="description" content="This topic describes the key points in planning security for the printer and printer output queue, the importance of the planning tasks, and recommendations for completing the tasks." />
|
|||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvplanrscsec.htm" />
|
|||
|
|
<meta name="DC.Relation" scheme="URI" content="rzamvprintersecworksheet.htm" />
|
|||
|
|
<meta name="copyright" content="(C) Copyright IBM Corporation 2006" />
|
|||
|
|
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2006" />
|
|||
|
|
<meta name="DC.Format" content="XHTML" />
|
|||
|
|
<meta name="DC.Identifier" content="planprintsec" />
|
|||
|
|
<meta name="DC.Language" content="en-us" />
|
|||
|
|
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
|||
|
|
<!-- US Government Users Restricted Rights -->
|
|||
|
|
<!-- Use, duplication or disclosure restricted by -->
|
|||
|
|
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
|||
|
|
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
|||
|
|
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
|||
|
|
<title>Plan printer and printer output queue security</title>
|
|||
|
|
</head>
|
|||
|
|
<body id="planprintsec"><a name="planprintsec"><!-- --></a>
|
|||
|
|
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
|||
|
|
<h1 class="topictitle1">Plan printer and printer output queue security</h1>
|
|||
|
|
<div><p>This topic describes the key points in planning security for the
|
|||
|
|
printer and printer output queue, the importance of the planning tasks, and
|
|||
|
|
recommendations for completing the tasks.</p>
|
|||
|
|
<p>Review the printer portion of your Physical Security Plan. Fill
|
|||
|
|
in the output queue section of the Printer Output and Workstation Security
|
|||
|
|
form as you work through this topic. You also need a plan to protect confidential
|
|||
|
|
information while it is printing or waiting to print. Check your Physical
|
|||
|
|
Security Plan for printers that your company uses for confidential output.
|
|||
|
|
After you plan printer output queue security, you can plan security for workstations.</p>
|
|||
|
|
<div class="p">The basic printing process involves the following key points:<ul><li>A copy of the report to be printed is held in a spooled file or printer
|
|||
|
|
output.</li>
|
|||
|
|
<li>The spooled file is stored in an object called an output queue until a
|
|||
|
|
printer is available.</li>
|
|||
|
|
<li>Spooling makes it easier to schedule printer jobs and to share printers.</li>
|
|||
|
|
<li>Spooling helps you protect confidential output.</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<div class="p">You can create one or more special output queues to hold confidential output
|
|||
|
|
and restrict who can view and manage those output queues. <ul><li>To secure the special output queue, you can use these commands:<ul><li>Work with Output Queue Description (WRKOUTQD)</li>
|
|||
|
|
<li>Create Output Queue (CRTOUTQ)</li>
|
|||
|
|
<li>Change Output Queue (CHGOUTQ)</li>
|
|||
|
|
</ul>
|
|||
|
|
</li>
|
|||
|
|
<li>On these commands, you can specify values for these key parameters:<ul><li>DSPDTA</li>
|
|||
|
|
<li>AUTCHK</li>
|
|||
|
|
<li>OPRCTL</li>
|
|||
|
|
</ul>
|
|||
|
|
</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<p>When you run a program that prints a report, the report usually does not
|
|||
|
|
go directly to a printer. The program creates a copy of the report, called
|
|||
|
|
a spooled file or printer output. The system stores the spooled file in an
|
|||
|
|
object called an output queue until a printer is available. When the output
|
|||
|
|
queue contains printer output, you can view the report at your workstation.
|
|||
|
|
You can also hold it or direct it to a specific printer. </p>
|
|||
|
|
<p>Spooling makes it easier to schedule printing jobs and to share printers.
|
|||
|
|
Spooling also helps you protect confidential output. You can create one or
|
|||
|
|
more special output queues to hold confidential output and restrict who can
|
|||
|
|
view and manage those output queues. You can also control when confidential
|
|||
|
|
output is sent from the queue to a printer. Complete the Printer Output and
|
|||
|
|
Workstation Security form as you work through this topic. </p>
|
|||
|
|
<div class="p">When you create a special output queue, you can specify several parameters
|
|||
|
|
that relate to security:<ul><li><strong>Display Data (DSPDTA) Parameter:</strong> The DSPDTA parameter of an output
|
|||
|
|
queue determines whether a user can view, send, or copy a spooled file that
|
|||
|
|
another user owns.</li>
|
|||
|
|
<li><strong>Authority to Check (AUTCHK) Parameter:</strong> The AUTCHK parameter specifies
|
|||
|
|
what type of authorities to the output queue allow the user to control all
|
|||
|
|
the files on the queue. Users with some special authority may also be able
|
|||
|
|
to control the files:<ul><li><strong>*OWNER:</strong> The requester must have ownership authority to the output
|
|||
|
|
queue in order to pass the output queue authorization test. The requester
|
|||
|
|
can have ownership authority by being the owner of the output queue, or sharing
|
|||
|
|
a group profile with the queue owner, or running a program that adopts the
|
|||
|
|
owner's authority.</li>
|
|||
|
|
<li><strong>*DTAAUT:</strong> Any user with add, read, and delete authority to the output
|
|||
|
|
queue can control all spooled files on the queue.</li>
|
|||
|
|
</ul>
|
|||
|
|
</li>
|
|||
|
|
<li><strong>Operator Control (OPRCTL) Parameter:</strong> The OPRCTL parameter of an
|
|||
|
|
output queue determines whether users with *JOBCTL special authority or *SYSOPR
|
|||
|
|
user class are allowed to control the output queue, provided that the profile
|
|||
|
|
was created with *SYSOPR user class, and that the special authorities parameter
|
|||
|
|
was set to *USRCLS and has not been changed.</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<div class="p">The output queue parameters, the user’s authority to the output
|
|||
|
|
queue, and the user’s special authority work together to determine the functions
|
|||
|
|
a user can perform on spooled files in an output queue. You can perform the
|
|||
|
|
following printing functions with spooled files:<ul><li>Add spooled files to the queue.</li>
|
|||
|
|
<li>View a list of spooled files (WRKOUTQ command).</li>
|
|||
|
|
<li>Display, copy, or send spooled files (DSPSPLF, CPYSPLF, SNDNETSPLF, and
|
|||
|
|
SNDTCPSPLF commands).</li>
|
|||
|
|
<li>Change, delete, hold, or release spooled files (CHGSPLFA, DLTSPLF, HLDSPLF,
|
|||
|
|
and RLSSPLF commands).</li>
|
|||
|
|
<li>Change, clear, hold, and release output queue (CHGOUTQ, CLROUTO, HLDOUTQ,
|
|||
|
|
and RLSOUTQ commands).</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<div class="p">For more information on the printing commands, see the following
|
|||
|
|
tables in <span class="q">"Appendix D"</span> of <cite>iSeries™ Security Reference</cite>:<ul class="simple"><li><span class="q">"Output Queue Commands"</span></li>
|
|||
|
|
<li><span class="q">"Spooled File Commands"</span></li>
|
|||
|
|
<li><span class="q">"Writer Commands"</span></li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
<div class="section" id="planprintsec__planprintsecpool"><a name="planprintsec__planprintsecpool"><!-- --></a><h4 class="sectiontitle">Securing spooled files</h4><p>A
|
|||
|
|
spooled file is a special type of object on the system. You cannot directly
|
|||
|
|
grant and revoke authority to view and manipulate a spooled file. The authority
|
|||
|
|
to a spooled file is controlled by several parameters on the output queue
|
|||
|
|
that holds the spooled file. </p>
|
|||
|
|
<p>When you create a spooled file, you are
|
|||
|
|
the owner of that file. You can always view and manipulate any spooled files
|
|||
|
|
you own, regardless of how the authority for the output queue is defined.
|
|||
|
|
You must have *READ authority to add new entries to an output queue. If your
|
|||
|
|
authority to an output queue is removed, you can still access any entries
|
|||
|
|
you own on that queue using the Work with Spooled Files (WRKSPLF) command. </p>
|
|||
|
|
<p>Most
|
|||
|
|
information that is printed on your system is stored as a spooled file on
|
|||
|
|
an output queue while it is waiting to print. Unless you control the security
|
|||
|
|
of output queues on your system, unauthorized users can display, print, and
|
|||
|
|
even copy confidential information that is waiting to print. </p>
|
|||
|
|
<p>One method
|
|||
|
|
for protecting confidential output is to create a special output queue. Send
|
|||
|
|
confidential output to the output queue and control who can view and manipulate
|
|||
|
|
the spooled files on the output queue. To determine where output goes, the
|
|||
|
|
system looks at the printer file, job attributes, user profile, workstation
|
|||
|
|
device description, and the print device (QPRTDEV) system value. See <a href="../rzalu/rzalurouting.htm">Controlling printing
|
|||
|
|
to output queue or printer</a> for more information.</p>
|
|||
|
|
<p>If defaults
|
|||
|
|
are used, the default output queue of the printer device specified in the
|
|||
|
|
system value QPRTDEV printer is used. </p>
|
|||
|
|
<p>The security parameters for an
|
|||
|
|
output queue are specified using the Create Output Queue (CRTOUTQ) command
|
|||
|
|
or the Change Output Queue (CHGOUTQ) command. You can display the security
|
|||
|
|
parameters for an output queue using the Work with Output Queue Description
|
|||
|
|
(WRKOUTQD) command. </p>
|
|||
|
|
<div class="attention"><span class="attentiontitle">Attention:</span> A user with *SPLCTL special
|
|||
|
|
authority can perform all functions on all entries, regardless of how the
|
|||
|
|
output queue is defined. Some parameters on the output queue allow a user
|
|||
|
|
with *JOBCTL special authority to view the contents of entries on the output
|
|||
|
|
queue. A user with *SPLCTL cannot manipulate, display, or use spooled files
|
|||
|
|
on an iASP unless the user has authority to the iASP group. A user needs *EXECUTE
|
|||
|
|
authority to the primary iASP device description. </div>
|
|||
|
|
<div class="p">For
|
|||
|
|
more information on the following subjects, see <span class="q">"Printing"</span> in Chapter
|
|||
|
|
6 of the <cite>iSeries Security
|
|||
|
|
Reference</cite>:<ul class="simple"><li><span class="q">"Display Data (DSPDTA) parameter of output queue"</span></li>
|
|||
|
|
<li><span class="q">"Authority to Check (AUTCHK) parameter of output queue"</span></li>
|
|||
|
|
<li><span class="q">"Operator Control (OPRCTL) parameter of output queue"</span></li>
|
|||
|
|
<li><span class="q">"Output queue and parameter authorities required for printing"</span></li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="section" id="planprintsec__planprintoutputqueue"><a name="planprintsec__planprintoutputqueue"><!-- --></a><h4 class="sectiontitle">Examples: output queue</h4><div class="p">Following
|
|||
|
|
are several examples of setting security parameters for output queues to meet
|
|||
|
|
different requirements:<ul><li>Create a general purpose output queue. All users are allowed to display
|
|||
|
|
all spooled files. The system operators are allowed to manage the queue and
|
|||
|
|
change spooled files: <kbd class="userinput">CRTOUTQ OUTQ(QGPL/GPOUTQ) DSPDTA(*YES) OPRCTL(*YES)
|
|||
|
|
AUTCHK(*OWNER) AUT(*USE)</kbd> </li>
|
|||
|
|
<li>Create an output queue for an application. Only members of the group profile
|
|||
|
|
GRPA are allowed to use the output queue. All authorized users of the output
|
|||
|
|
queue are allowed to display all spooled files. System operators are not allowed
|
|||
|
|
to work with the output queue: <kbd class="userinput">CRTOUTQ OUTQ(ARLIB/AROUTQ) DSPDTA(*NO)
|
|||
|
|
OPRCTL(*NO) AUTCHK(*OWNER) AUT(*EXCLUDE)</kbd><kbd class="userinput">CHGOBJOWN OBJ(ARLIB/AROUTQ)
|
|||
|
|
OBJTYP(*OUTQ) USER(GRPA) AUT(*CHANGE)</kbd></li>
|
|||
|
|
<li>Create a confidential output queue for the security officers to use when
|
|||
|
|
printing information about user profiles and authorities. The output queue
|
|||
|
|
is created and owned by the QSECOFR profile: <kbd class="userinput">CRTOUTQ OUTQ(QGPL/SECOUTQ)
|
|||
|
|
DSPDTA(*OWNER) AUTCHK(*DTAAUT) OPRCTL(*NO) AUT(*EXCLUDE)</kbd>Even if
|
|||
|
|
the security officers on a system have *ALLOBJ special authority, they are
|
|||
|
|
not able to display, copy, send, or move other user's files on the SECOUTQ
|
|||
|
|
output queue.</li>
|
|||
|
|
<li>Create an output queue that is shared by users printing confidential files
|
|||
|
|
and documents. Users can work with only their own spooled files. System operators
|
|||
|
|
can work with the spooled files, but they cannot display, copy, send, or move
|
|||
|
|
other user's spooled files. <kbd class="userinput">CRTOUTQ OUTQ(QGPL/CFOUTQ) DSPDTA(*OWNER)
|
|||
|
|
AUTCHK(*OWNER) OPRCTL(*YES) AUT(*USE)</kbd></li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div class="section"><p>For more information, see <a href="rzamvsecprintqueue.htm#secprintqueue">Secure
|
|||
|
|
your printer output queue</a>.</p>
|
|||
|
|
<p>Worksheet needed: Printer output queue
|
|||
|
|
security worksheet</p>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
<div>
|
|||
|
|
<ul class="ullinks">
|
|||
|
|
<li class="ulchildlink"><strong><a href="rzamvprintersecworksheet.htm">Printer output queue security worksheet</a></strong><br />
|
|||
|
|
Complete this worksheet as part of your printer output queue security.</li>
|
|||
|
|
</ul>
|
|||
|
|
|
|||
|
|
<div class="familylinks">
|
|||
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzamvplanrscsec.htm" title="This topic describes each of the components of resource security and how they all work together to protect information on your system. It also explains how to use CL commands and displays to set up resource security on your system.">Plan resource security</a></div>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
</body>
|
|||
|
|
</html>
|