IBM i Global

IBM i 

A space for professionals working with IBM’s integrated OS for Power systems to exchange ideas, ask questions, and share expertise on topics like RPG and COBOL development, application modernization, open source integration, system administration, and business continuity.


#Power


#IBMi
#Power
#Operatingsystems
#Servers
 View Only

  • 1.  User created file in QGPL.

    Posted 05/13/26 02:04 PM
    Well, it happened.  A user with the following:
     
    Special authority  . . . . . . . . . . . . :   *NONE
    Initial program  . . . . . . . . . . . . . :  (redacted)  Custom program 
    Initial menu . . . . . . . . . . . . . . . :   *SIGNOFF
      Library  . . . . . . . . . . . . . . . . :           
    Limit capabilities . . . . . . . . . . . . :   *YES    
     
    created a table in QGPL with the same name as a table in another library.  Normally not an issue as the library list has QGPL at the end.  But one user (luckily in IT) has his reversed and it was blowing up stuff.
     
    This new table was completely unrelated to the existing table.  In fact, it had strange column names which led me to believe it was derived from some gyrations of the system catalog.  Like SYSTABLES, etc.  Had our knickers in a twist to get rid of it quick so we didn't waste a bunch of time with it before deleting it.
     
    The job it was created from?  QZDASOINIT.
     
    Tell me that some new IT intern cannot quickly grasp the system catalog with zero interaction with existing staff (different plants - different countries).  All IBM i type development is done here.  IT down there (1.5 people) is primarily tech support staff.



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------


  • 2.  RE: User created file in QGPL.

    Posted 05/18/26 03:20 AM

    A couple of things to check. 

    Should the user have their "current library" set to something other than *CRTDFT (which ends up being QGPL) - have they been set up incorrectly?

    Based on the parameters shown, you should look at the custom program and see what options are coded - can they query/create files from there. It's probably not worth seeing if they can access a command line as they have limited capabilities set to *YES so a command line would not allow much.

    Do they have Navigator SQL (or something similar) installed, depending on how tied down your security is (or rather is not), there is a possibility of them creating a file via Navigator SQL.



    ------------------------------
    Tony Davis
    ------------------------------



  • 3.  RE: User created file in QGPL.

    Posted 05/18/26 08:23 AM

    Tony,

    Your first comment was the best.  Should this user have QGPL as their current library?  I'll have to check if the ERP package has a problem with changing that.

    Your comment about checking to see if the custom program allows them to query/create files may be valid but is unrelated, since it was done via the QZDASOINIT job.  This is clearly client/server related.

    Yes they have iACS installed.  But trying security by obscurity by not installing certain parts of iACS would be meaningless.  They did this using odbc and a python app.



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------

    Original Message


  • 4.  RE: User created file in QGPL.

    Posted 05/18/26 08:34 AM

    My goal is not to become known as "Mordac - Preventer of Information Services" (Dilbert reference).

    And although I accepted their well compensated offer to leave on December 11, I don't want them counting the days until I do so.

    I feel for the guy who did this.  His job title is "Student" so I'm guessing intern.  He's done such work for a different company.  It is not my goal to crush the soul of a N2i person.  I offered to figure out a way to get him access, but with some safer guidelines and controls.  Amazingly enough both my boss and the intern's boss (both on the job less than a year) are going to try a project we were already working on.  Not quite live data but more of a data warehouse on a separate LPAR.  Not 'real time', which I think may be eventually desired by the project he's trying.  But we'll start with that.  My initial idea was more towards a safer access to live data. But if the data warehouse will work, ok.



    ------------------------------
    Robert Berendt IBMChampion
    Business Systems Analyst, Lead
    Dekko
    Fort Wayne
    ------------------------------



Related Content