On 5/2/2006 6:08 PM, [EMAIL PROTECTED] wrote:
Remember that once you activate console security, any hang/ENQ that
involves RACF means that you cannot issue console commands and your
master console will be hung in X SYSTEM. A number of years ago, I
worked at a shop that had console security activated. After the 4th or
5th plexwide IPL, I convinced management to get rid of console
security.
There are no ENQs issued by RACF during processing of commands from
logged-on operator consoles, so that should not be the explanation of
your problem.
There can be ENQs if you have operators issuing MVS commands from SDSF.
However, when issued from an actual operator console that is logged
on, the authorization checking for the MVS commands occurs in the
CONSOLE address space where the user's ACEE already exists, and uses
RACLISTed OPERCMDS profiles, and thus there is no RACF I/O nor any RACF
ENQs.
Walt Farrell, CISSP
z/OS Security Design, IBM
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
