After you secure printer output, you should secure your workstations. You authorize workstations just like you authorize other objects on the system. Use the EDTOBJAUT command to give users authority to workstations.
Your system users have PCs on their desks as their workstations. They use tools that run on the PC, and they use the PC to connect to the server. Most methods of connecting a PC to IBM® Systems provide more function than workstation emulation. The PC may look like a display to the system and provide the user with interactive signon sessions. In addition, the PC may look to IBM Systems like other computers and provide functions such as file transfer and remote procedure call.
Secure workstation data access
Some PC client software uses shared folders to store information on the server. To access system database files, the PC user has a limited, well-defined set of interfaces. With the file transfer capability that is part of most client/server software, the PC user can copy files between the server and the PC. With database access capability; such as a DDM file, remote SQL, or an ODBC driver; the PC user can access data on the server.
In this environment, you can create programs to intercept and evaluate PC-user requests to access server resources. When the requests use a DDM file, you specify the exit program in the distributed data management access (DDMACC) network attribute. For some methods of PC file transfer, you specify the exit program in the client request access (PCSACC) network attribute. Or, you can specify PCSACC (*REGFAC) to use the registration function. When the requests use other server functions to access data, you can use the WRKREGINF command to register exit programs for those server functions.
Exit programs, however, can be difficult to design, and they are rarely foolproof. Exit programs are not a replacement for object authority, which is designed to protect your objects from unauthorized access from any source.
For all systems that have PCs attached, but particularly for systems that have client software that uses the integrated file system, a good object authority scheme is critical. Because security is integrated into the i5/OS™ product, any request to access data must go through the authority checking process. Authority checking applies to requests from any source and to data access that uses any method.
Object authority with workstation access
When you set up authority for objects, you need to evaluate what that authority provides for the PC user. For example, when a user has *USE authority to a file, the user can view or print data in the file. The user cannot change information in the file or delete the file. For the PC user, viewing is equivalent to reading, which provides sufficient authority for the user to make a copy of a file on the PC. This may not be what you intend.
For some critical files, you may need to set the public authority to *EXCLUDE to prevent downloading. You can then provide another method to view the file on the server, such as using a menu and programs that adopt authority. Another option to prevent downloading is to use an exit program that runs whenever a PC user starts a server function, other than interactive signon.
You can specify an exit program in the PCSACC network attribute by using the Change Network Attribute (CHGNETA) command. Or, you can register exit programs by using the Work with Registration Information (WRKREGINF) command. The method that you use depends on how PCs are accessing data on your system and which client program the PCs use. The exit program (QIBM_QPWFS_FILE_SERV) applies to iSeries Access and Net Server access to integrated file system. It does not prevent access from a PC with other mechanisms, such as FTP or ODBC.
PC software typically provides upload capability also, so that a user can copy data from the PC to a server database file. If you have not set up your authority scheme correctly, a PC user might overlay all of the data in a file with data from a PC. You need to assign *CHANGE authority carefully. Review Appendix D in the iSeries Security Reference to understand what authority is required for file operations.
Users must have *CHANGE authority to sign on at a workstation. If the QLMTSECOFR system value is no (0), the security officer or anyone with *ALLOBJ authority can sign on at any workstation. If the QLMTSECOFR system value is yes (1), use these guidelines to set authority to workstations:
| Users allowed to sign on at workstation | Public authority | QSECOFR authority | Individual user authority |
|---|---|---|---|
| All users | *CHANGE | *CHANGE | Not required |
| Only selected users | *EXCLUDE | No authority | *CHANGE |
| Selected users and users with authority to all objects | *EXCLUDE | *CHANGE | *CHANGE |
| All users except users with authority to all objects | *CHANGE | No authority | Not required |
Before you restrict access to the system operator message queue, use the EDTOBJAUT command to secure workstations, based on the information in your Output Queue and Workstation Security form.