Bradley,
I have used the USERS parm in the dsm.sys file to specifiy which unix
users can request ADSM services.   Even if some users find out the
client password, (assuming it is not generate) ADSM will not allow them
to access the server if there uid is not in the dsm.sys file.   BEWARE,
if you don't include the users parm in the dsm.sys file, ALL users can
request services.
I haven't had a problem with unauthorized users being able to get on.

Larry Abbinante
labbinante AT ual DOT com