Dick

This used to mean that you hadn't authorized your TSO user to run protocol
ICMP which is required by PING. TCP/IP for VM and its descendants such as
Communications Server IP use what they call "raw" sockets in order to run
protocols other than TCP and UDP.

10 to 12 years ago, I used to teach to the following:

- Extracted from the visual:

<quote>

; Authorized Procedures and UserIDs

INFORM
   MASTER
ENDINFORM

OBEY
   ICMPMON
   MASTER
   NCPROUTE
   ROUTED
   SNMPD
   SNMPQE
ENDOBEY

</quote>

- And from the notes:

<quote>

Authorized Procedures and UserIDs
---------------------------------

The INFORM statement list (delimited by ENDINFORM) specifies a list of
operators to be sent messages for serious run-time error conditions. The
author has never suffered any such conditions and so cannot say exactly how
such messages appear to a logged-on TSO user.

The OBEY statement list (delimited by ENDOBEY) specifies a list of operators
who are able to issue OBEYFILE commands. The OBEYFILE command refers to a
data set which contains a (re-)specification of statements in the "profile"
data set and so may be used to define new links and stop and start links.
For details of exactly how, for example, list statements are handled the
Customization and Administration Guide manual should be consulted.

The OBEY list also authorizes the use of NETSTAT commands with the DROP
option.

Lastly, the OBEY list authorizes a user, identified either as the TSO userid
or the started task procedure name, to issue the socket() call specifying
"raw" sockets, SOCK_RAW, as opposed to stream or datagram, SOCK_STREAM or
SOCK_DGRAM respectively. This facility is required to be able to access, for
example, ICMP packets and, hence, the started task procedure name for ICMP
monitor program[1] is included here.[2]

</quote>

[1] This was a program of mine which I used on my test systems - used by
students' hands-on - which placed a hexadecimal record in the log of all
ICMP packets received. It was one of the fun programs I wrote to be sure I
had taught myself C and sockets successfully.

[2] Oddly enough the only TSO userid specified in this example was MASTER
which is the userid I used on my test systems. I'm sure the full "OBEY" list
had all the userids I provided for student use.

Checking "OBEY" today, I see that there is no longer an OBEY/ENDOBEY list in
the PROFILE. Perhaps it is all covered by the OUTBOUND_RAW statement in
section 2.16.23, "IDSAttackCondition" - whatever that's all about. Am I
getting old that I regard this as over-elaboration of something simple? I
guess the developers need something to do but it all seems to be in a,
possibly vain, attempt to create full employment for long-suffering system
programmers.

Incidentally, as you may have discovered, the explanation of what to do with
message "Unable to open RAW socket: EDC5139I Operation not permitted." is
totally useless.

Chris Mason

----- Original Message ----- 
From: "Dick Renneke" <[EMAIL PROTECTED]>
Newsgroups: bit.listserv.ibm-main
To: <[email protected]>
Sent: Friday, 27 October, 2006 8:50 PM
Subject: Re: Receive Order Error


> With the SYSTCPD DD statement, we got this response -
>
> READY
>  PING INETSD01.BOULDER.IBM.COM
> CS V1R7: Pinging host INETSD01.BOULDER.IBM.COM (207.25.253.62)
> READY
> END
> Unable to open RAW socket: EDC5139I Operation not permitted.

----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Reply via email to