Solved

ISeries User Profiles

Posted on 2014-03-04
5
945 Views
Last Modified: 2014-03-05
Cannot figure out what is up with my QSECOFR profile.  I can sign on to the system with the QSECOFR but when I try to go to DST or SST, it tells me that the user is disabled.  When I do a WRKUSRPRF the profile is displayed as enabled.  What am I missing?
0
Comment
Question by:Don1411
  • 2
  • 2
5 Comments
 
LVL 13

Expert Comment

by:_b_h
ID: 39904965
The QSECOFR user profile is separate from the QSECOFR DST profile.

The QSECOFR DST profile password can be changed by QSECOFR user profile using the Change DST password command:
CHGDSTPWD PASSWORD(*DEFAULT)  
Since you have access to DST, sign on to DST using uppercase QSECOFR as the password. You will be prompted to change the password.  This step can also be done from SST depending on your system settings; use DSPSECA to check.

It is generally a good idea to have a backup DST profile that is equivalent to QSECOFR so that it can be used to reset QSECOFR DST password.

Hope this helps!
Barry
0
 
LVL 27

Accepted Solution

by:
tliotta earned 500 total points
ID: 39905457
In general, neither the QSECOFR user profile nor the QSECOFR DST profile should ever be used except (1) during initial setup of system security and (2) when IBM instructions direct you to use one of those profiles.

In the case of (1), you should initially use the two QSECOFR profiles to create at least one additional user profile with *SECOFR user class special authorities and at least one additional DST profile with all DST security capabilities. After those are created, use them instead of QSECOFR. Once that's done, there should no longer be much concern about problems with QSECOFR passwords. The QSECOFR profiles would only be needed in normal operation to recover your other profiles if problems come up with them.

(By avoiding use of the two QSECOFR profiles, you minimize the risk of object damage to them. Object damage is rare nowadays, but it happens most often when objects are in use and being updated by the system. Updates may happen when other objects are being created/deleted and ownership or authority is being set in the *USRPRF object. Unexpected power losses, etc., can cause the damage. Recovering damaged QSECOFR *USRPRF objects can require costly help from IBM. The simplest rule-of-thumb is "Don't use them.")

In the context of this question, the existence and use of secondary security profiles for standard system operations and for SST/DST would effectively make the problem irrelevant. Creating such profiles should be the first thing done after signing on with QSECOFR and after accessing SST/DST. The two QSECOFR passwords should be made to be different and then stored in a safe location. After that, they should only be needed in emergencies. The replacement profiles would be the ones used for most things.

Tom
0
 

Author Comment

by:Don1411
ID: 39906460
Thanks for the assistance.  I think I have it cleared up now.
0
 
LVL 27

Expert Comment

by:tliotta
ID: 39908096
I think Barry's comment should have a significant award of points. It was first; it was correct. I was primarily simply providing background and general justification for avoiding "QSECOFR" rather than directly accessing QSECOFR.

If Barry chooses to follow up, this comment is here for reference.

Tom
0
 
LVL 13

Expert Comment

by:_b_h
ID: 39908187
Thanks for the consideration, Tom.
The answers are complete and correct, enough said.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

It’s a strangely common occurrence that when you send someone their login details for a system, they can’t get in. This article will help you understand why it happens, and what you can do about it.
Find out what Office 365 Transport Rules are, how they work and their limitations managing Office 365 signatures.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now