How to restrict all users to access command line in as400?

<h2 style="text-align: left;"><span style="font-size: large;">How to restrict all users to access command line in as400?</span></h2><h3 style="text-align: left;"><span style="font-size: large;">Restricting All Users From Using the Command Line</span></h3><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Troubleshooting</b></span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Problem</b></span></p><p><span style="font-size: large;">This article includes information on restricting users from being able to type commands on the command line.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Resolving The Problem</b></span></p><p><span style="font-size: large;">To limit users from using the command line, do the following for each user profile:</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">1. Issue the <b>CHGUSRPRF</b> command (<F4>) to prompt the command, then select <F10> for additional parameters.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">2. Change the Limit Capabilities to <b>*YES</b>. This will prevent users from using the command line.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">Users will still be authorized to some commands; however, they will only be able to use those commands from a menu. Every command has an "Allow Limited User" parameter. By default, this is set to *NO. The following commands are an exception and are shipped with *YES. These commands are SIGNOFF, SNDMSG, DSPMSG, DSPJOB, DSPJOBLOG, STRPCO, and WRKMSG. To view what the 'Allow Limited User parameter is set to for a specific command, use the DSPCMD command and enter the command in question.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">Note: The limited capabilities apply only to the i5 OS command line. If limited capabilities for the user profile is set to *YES and Allow Limited User is set to *NO for the command, but the user is still able to run the command, they may be using a third-party command line. You should try CALL QCMD to get to the i5 OS command line and issue the command again.</span></p><p><span style="font-size: large;"><br /></span></p><h3 style="text-align: left;"><span style="font-size: large;">How to limit user profile to access command line?</span></h3><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Limit Capability</b> :- LMTCPB parameter tells the OS400 two things. First, it tells the OS400, if the user can make changes to ITLPGM, ITLMNU and current library values. Secondly, it says the OS400 if the user has access to command line.</span></p><p><span style="font-size: large;">When it is set to *NO, the user can make changes to ITLPGM, ITLMNU , current library and ATTN key values and also it can use the command line to run AS400 commands.</span></p><p><span style="font-size: large;"><br /></span></p><p></p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7iZoBzmaAjsCkR7pthR2IUQzoRByKyoN3rDSPxqRTgXbCNV5aIBmkXTdNLL_C9Av1Dv2GU2_JKVVORMlUoW0X3E9ebggBffkHinaYvTLsAEFWoay7RDcbFR42wbqGuoS1woVqYov3rN8/s959/How+to+restrict+all+users+to+access+command+line+in+as400..PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="285" data-original-width="959" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7iZoBzmaAjsCkR7pthR2IUQzoRByKyoN3rDSPxqRTgXbCNV5aIBmkXTdNLL_C9Av1Dv2GU2_JKVVORMlUoW0X3E9ebggBffkHinaYvTLsAEFWoay7RDcbFR42wbqGuoS1woVqYov3rN8/s16000/How+to+restrict+all+users+to+access+command+line+in+as400..PNG" /></a></div><br /><span style="font-size: large;"><br /></span><p></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">When it is set to *PARTIAL, the USER cannot make any changes to ITLPGM, ITLMNU, current library and ATTN key value but it has access to command line and can run AS400 commands.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">When it is set to *YES, the user has neither access to make any changes to ITLPGM, ITLMNU and current library nor it can access command line.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">These three parameters ITLPGM, ITLMNU and LMTCPB have ability to restrict users. For example, for the server users who do not require to access the green screen 5250 emulator, can have ITLPGM as *NONE, ITLMNU as *SIGNOFF and LMTCPB as *YES. They can still access AS400 from other server which are connected to AS400. However, if the same user tries to access the AS400 from 5250 emulator, it will immediately bring the user to signoff screen thus restricting access to AS400 and command line.</span></p>

How to restrict all users to access command line in as400?

How to restrict all users to access command line in as400? Restricting All Users From Using the Command Line Troubleshooting Problem This ar...

Read more »