Monitoring subsystem descriptions

This topic provides suggestions for reviewing the subsystem descriptions that currently exist on your system.

When you start a subsystem on a server, the system creates an environment for work to enter the system and run. A subsystem description defines what that environment looks like. Subsystem descriptions, therefore, can provide an opportunity for devious users. A mischief-maker might use a subsystem description to start a program automatically or to make it possible to sign on without a user profile.

When you run the Revoke Public Authority (RVKPUBAUT) command, the system sets public authority to subsystem description commands to *EXCLUDE. This prevents users who are not specifically authorized (and who do not have *ALLOBJ special authority) from changing or creating subsystem descriptions.

You can use the Work with Subsystem Descriptions (WRKSBSD) command to create a list of all the subsystem descriptions. When you select 5 (Display) from the list, a menu displays for the system description that you selected. It shows a list of the parts of a subsystem environment.

You select options to see details about the parts. Use the Change Subsystem Description (CHGSBSD) command to change the first two items on the menu. To change other items, use the appropriate add, remove, or change command for the entry type. For example, to change a workstation entry, use the Change Workstation Entry (CHGWSE) command.

For additional information about working with subsystem descriptions, including lists of the shipped values for IBM-supplied subsystem descriptions, refer to the topic: Work Management.

• Reviewing autostart job entries
  Look at your autostart job entries and the associated job descriptions. Ensure that you understand the function of any program that runs automatically when a subsystem starts.

• Reviewing workstation names and types
  Look at your workstation entries and the associated job descriptions. Ensure that no one has added or updated any entries to run programs that you are not aware of.

• Reviewing job queue entries
  You should periodically review the job queue entries in your subsystem descriptions to ensure that batch jobs are running where you expect them to run.

• Reviewing routing entries
  Look at the routing entries and ensure that no one has added or updated any entries to run programs that you are not aware of.

• Reviewing communications entries and remote location names
  Ensure that the communications entries are secure.

• Reviewing prestart job entries
  You should make sure that prestart job entries perform only authorized, intended functions.

• Reviewing job descriptions
  You should periodically review job descriptions to make sure that they do not run unintended programs. Use object authority to prevent changes to job descriptions.

Parent topic: