Administrative Special Authorities

ВисокаНиво 1Ручни прегледibm-i

Опис

Special authority is used to specify the types of actions a user can perform on system resources. A system administrator can be given one or more special authorities directly or through a group. System administrators should be granted administrative special authorities commensurate with their job roles.

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

PRTUSRPRF SELECT(*SPCAUT) SPCAUT(*ALL) Type WRKSPLF and locate your spool file with the name QPSECUSR and User Data PRTUSRPRF. View the spool file output to ensure that all administrators listed with Special Authorities have the least privileges commensurate with their administrative job roles. Note that administrative Special Authorities are cumulative from User Profile and Group Profiles. IBM supplied user profiles will appear in the report and should be excluded from the audit. A list of IBM supplied user profiles can be obtained from the references below.

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Special authority is a type of authority a user can have to perform system functions, including all object authority, save system authority, job control authority, security administrator authority, spool control authority, service authority, and system configuration authority. To establish the recommended configuration, lower all administrators to the special authorities commensurate with their job roles. CHGUSRPRF USRPRF(<xxxxxx>) SPCAUT(<xxxxxx>) Change all non-administrative *USER class users and groups to SPCAUT = *NONE: CHGUSRPRF USRPRF(<xxxxxx>) SPCAUT(*NONE)

Својства

Оперативни системи: Било који
Ознаке: ibm-ihardening
Референца: CIS IBM i V7R5M0 Benchmark v2.1.0 - 4.4 Administrative Special Authorities