User Rules

User authority rules are useful to control access to servers and functions for particular users. User security rules are evaluated only if a location rule specifies to use *USER security rules. (Exit Point Manager includes one default user rule for each server. See Default User Rules). Like Location rules, User rules can be used to define actions for access to a server, or for access to a specific function of a server (e.g. DELETEFILE).

NOTE: In order to add User Rules on an endpoint, the PNSEVTMON monitor job must be running. This job starts automatically during Exit Point Manager installation. If, for some reason, this job has been stopped, you can issue the PTNSLIB07/PNSSTRMON (or PTNSLIB/PNSSTRMON, depending on your product library) command to restart it.

To apply the same rule to multiple profiles, create a User Group, then choose the group when you create the User Rule. See Creating a User Group.

All default location rules include the same parameters and are set with the same default values. See Parameters and Default Values.

User Icon

On the Rules screen, user rules can be identified by the icon to the left of the user profile or group name.

  1. To add a user rule, from the Rules screen, choose Add.
  2. For Rule Type, choose User/User Group.
  3. Choose Lookup next to User/User Group to select a user profile or User Group. See Users selection window.
  4. Choose Lookup next to the Server > Function field to select the desired server and function. For Functions, choose *ALL if you would like the rule to apply to all server functions. See Server selection window.
  5. Choose Lookup next to the Authority field to choose an authority for the location rule. See Authorities selection window for a list of the available authorities.
  6. Use the drop-down lists below to turn on auditing, messaging, and capturing. See New/Edit Rule screen for more details.
  7. Click Save to add the new user rule.
  1. On the Navigation Pane, choose User Groups.
  2. Click Add. The New User Group screen appears.
  3. Name the User Group and add a Description.
  4. In the "Sequence" section, indicate the order in which this User Group will be evaluated by the exit point programs. For more details, see User Groups.
  5. In the "Members" section, specify the profiles you would like to include as members of the User Group. Click Add Member to open the Select User screen where you can select one or more users.
    NOTE: Adding OS User Groups to a Exit Point Manager Group is not recommended.
  6. Click Save to save the User Group. This User Group will now be available in the list of profiles while creating or editing user rules.
  1. On the Navigation Pane, choose User Groups.
  2. Select a User Group to open the Edit User Group screen.
  3. Under Members, choose Add Member.
  4. Check the users you would like to add.

    NOTE: Adding OS User Groups to a Exit Point Manager Group is not recommended.
  5. Click Save.
  1. On the Navigation Pane, choose User Groups.
  2. Select the User Group whose sequence you want to change. The Edit User Group screen appears.
  3. Click and drag the User Group to the desired order in the sequence.

  4. Click Save.
  1. First, create a new user rule that sets the SENDFILE function of the FTP server to reject for all users (*PUBLIC). To do so, from the Navigation Pane, click Rules, then choose Add.
  2. For Rule Type, choose User/User Group.
  3. Select the following values in New User Rule screen:

  • User = *PUBLIC. The rule will be in effect for all users.
  • Server > Function = SENDFILE. This is the function used by the FTP server to download files from IBM i.
  • Authority = *REJECT. Exit Point Manager will reject any FTP SENDFILE transactions.

    • New User Rule Options

  1. Click Save. Now, create a rule to allow POWERUSER to use the SENDFILE function.
  2. Choose Add and select the following values:

  • For Rule Type, choose User/User Group.
  • User = POWERUSER. The rule will be in effect for all users.
  • Server > Function = SENDFILE. This is the function used by the FTP server to download files from IBM i.
  • Authority = *OS400. Exit Point Manager will allow any FTP SENDFILE transaction for POWERUSER.

    • New User Rule options

  1. Click Save. Since this new rule is more specific than the other rules in effect, it is evaluated first, allowing POWERUSER to download files, but restricting all other users from the SENDFILE function.

Default User Rules

Exit Point Manager ships with default user authority rules for all supported IBM i servers. View these rules by referring to the *PUBLIC rules on the Rules screen.

Rules screen

Server IDs

Exit Point Manager supports the following servers and provides one default user rule for each server.

Servers and Functions
Exit Point Server Description
*CLI Call Level Interface
*DDM *Distributed Data Management Server
*DRDA Distributed Relational Database
*DQSRV Data Queue Server
*FILESRV File Server
*FTPCLIENT IBM i FTP Client
*FTPSERVER IBM i FTP Server
*NDB Native Database Request
*RMTSRV Remote Command and Distributed Program Call Server
*RTVOBJINF SQL Retrieve Object Information
*SQL Database Server Initialization
*SQLSRV SQL Server
*TELNET Telnet Device Initiation/Termination
*DATAQSRV Optimized Data Queue Server
*FTPREXEC FTP Execute Remote Command (REXEC)
*REXEC_SO Remote Execute Command Signon Server
*TFRFCL File Transfer Server
*TFTP Trivial FTP Server
*CNTRLSRV License Management Central Server
*FTPSIGNON FTP Logon Server
*LMSRV License Management Server
*MSGFCL Message Function Server
*RQSRV Remote SQL Server
*SIGNON Signon Server
*VPRT Virtual Print Server
QNPSERV Network Print Server

ShowCase Exit Points

Exit Point Manager provides access control and monitoring for exit points that are specific to the ShowCase software suite:

Exit Point Server Description
*VISTA
A Showcase corporation server.
(*VISTA)		 ShowCase *VISTA Clients
*VISTAPRO
A Showcase corporation server.
(*VISTAPRO)		 ShowCase *VISTAPRO Clients
DATADIST
A Showcase corporation server.
(DATADIST)		 ShowCase DATADIST Clients
VISTA_ADMI
A Showcase corporation server.
(VISTA_ADMI)		 ShowCase VISTA_ADMI Clients