Securing your workstations
After you secure printer output, you should secure your workstations. You authorize workstations just like you authorize other objects on the system. Use the EDTOBJAUT command to give users authority to workstations.
Your system users have PCs on their desks as their workstations. They use tools that run on the PC, and they use the PC to connect to the server. Most methods of connecting a PC to IBM i systems provide more function than workstation emulation. The PC may look like a display to the system and provide the user with interactive signon sessions. In addition, the PC may look to IBM i systems like other computers and provide functions such as file transfer and remote procedure call.
- Functions that are available to PC users who are connected to your system
- IBM i system resources that PC users can access
Secure workstation data access
Some PC client software uses shared folders to store information on the server. To access system database files, the PC user has a limited, well-defined set of interfaces. With the file transfer capability that is part of most client/server software, the PC user can copy files between the server and the PC. With database access capability; such as a DDM file, remote SQL, or an ODBC driver, the PC user can access data on the server.
In this environment, you can create programs to intercept and evaluate PC-user requests to access server resources. When the requests use a DDM file, you specify the exit program in the distributed data management access (DDMACC) network attribute. For some methods of PC file transfer, you specify the exit program in the client request access (PCSACC) network attribute. Or, you can specify PCSACC (*REGFAC) to use the registration function. When the requests use other server functions to access data, you can use the WRKREGINF command to register exit programs for those server functions.
Exit programs, however, can be difficult to design, and they are rarely foolproof. Exit programs are not a replacement for object authority, which is designed to protect your objects from unauthorized access from any source.
For all systems that have PCs attached, but particularly for systems that have client software that uses the integrated file system, a good object authority scheme is critical. Because security is integrated into the IBM i product, any request to access data must go through the authority checking process. Authority checking applies to requests from any source and to data access that uses any method.