Granting authorities...

[ptutt]

Hi all,



I have a number of operators responsible for day to day operations on our TSM server. Currently they all have system privilege. I would like to review these accounts and if possible reduce the privileges granted to them. They were issued with system privilege as a number of activites appeared to fail with lower authorities. The main activities the operators perform are:



1. Checking backup completion status.

2. Moving DR Media in/out of the library.

3. Stopping/starting reclamation tasks.



Can anybody suggest what the minimum authority required would be to perform these actions?

 

[mateinone]

ptutt



Have you considered creating an operations menu?



This was they will have access to options and that will run with system privelages?

That way you can choose any system tasks you want them to have without the risk of them getting on and running detrimental commands, from deleting data to running long selects across multiple tables as they familiarise themselves with TSM?



If you go down that path an want some guidance let me know

 

[ptutt]

Sounds interesting, not considered this.



At what level would this operate at?.

Would it prevent them from logging into a console session if they have the client installed?

 

[mateinone]

not if they had op privellages...

if they have no privelages then they would not be able to log directly into TSM



With a menu, they would not be using their account to log in, as it would only be specific commands audit should deem it acceptable.