Spool Control Guide
Additional Resources
Steps to security
Locking out users from Spool Files
- remove *JOBCTL from their user profile
- remove *SPLCTL from their user profile
Locking out users from using a Printer
Scenarios
The HR department prints reports with salary information. Only the users in
HR should be able to see these reports and manage how and when they're printed.
Create the outq with these attributes:
-
CRTOUTQ OUTQ(HR_LIB/HR_OUTQ)
DSPDTA(*YES) OPRCTL(*NO) +
AUTCHK(*OWNER) AUT(*EXCLUDE)
Have the HR group own the outq so the users can manage the spooled files as
well as start the writer to print the documents:
-
CHGOBJOWN OBJ(HR_LIB/HR_OUTQ)
OBJTYP(*OUTQ) NEWOWN(HR_GROUP)
Scenario 2:
Accounting prints confidential reports, but the operators must manage the
spooled files and route them to the writer loaded with the appropriate form.
Create the outq with these attributes:
-
CRTOUTQ OUTQ(ACCT_LIB/ACCT_OUTQ) DSPDTA(*OWNER) OPRCTL(*YES) + AUTCHK(*OWNER)
AUT(*EXCLUDE)
Grant authority to accounting so the users can use the outq:
-
GRTOBJAUT OBJ(ACCT_LIB/ACCT_OUTQ) OBJTYP(*OUTQ) USER(ACCT_GRP) + AUT(*CHANGE)
Overview
Who has authority
Who can start and stop writers
as well as who can see and manage spooled files depends on several factors:
Whether the
profile has *JOBCTL (job control) or *SPLCTL (spool control) special
authorities.
The authority the profile has to the outq.
The outqs Display Data (DSPDTA), Authority Check (AUTCHK) and Operator
Control (OPRCTL) attributes.
Spool Control Outline
|
Setup
|
Reasoning
|
| Minimal
Security |
- wrksysval qsecurity
set to Level 20
- *SPLCTL to all users
- *ALLOBJ to all users
- *JOBCTL to all users
|
- I don't care if any one sees
any spool file there doesn't need to be anything hidden on the
system
- I don't care if any user can
see or manage any other users spool files
|
| Medium Security |
- wrksysval qsecurity
set to Level 20
- *JOBCTL to limited users
- *SPLCTL to limitied users
|
- I don't want my users seeing
or working with other peoples spool files.
|
| High Security |
- wrksysval qsecurity
set to Level 30
- *JOBCTL to limited users
- *SPLCTL to limitied users
|
- I don't want my users seeing
or working with other peoples spool files.
|
| 
