On 11/8/2006 3:08 PM, Debbie Mitchell wrote:
I encountered a problem that I'm trying to understand where to even look for
the answer. A user connected to our mainframe (z/OS 1.4) through Attachmate
and then logged onto TSO. From the Ready prompt, he initiated a file
transfer from his PC to a mainframe dataset (using the Attachmate Tools
menu). The file transfer was complete but the dataset created had no
associated RACF dataset profile. No error messages appeared on the SYSLOG.
Probably the dsname began with the user's user ID, and probably you have
a GLOBAL DATASET entry for '&RACUID.**'/ALTER which would have allowed
creation of the data set.
Until a dataset profile was created for this dataset, we were unable to do
anything with it, including running our nightly backups.
Your nightly backups should not have been affected. They should get
authority via some other mechanism. With DFSMSdss, for example, your
jobs should specify the ADMINISTRATOR keyword on the control statements,
and get authority via various STGADMIN.something profiles in the
FACILITY class.
Other products have similar controls, I believe, to avoid your
backup/restore jobs needing to have explicit authority to all data sets.
Walt Farrell, CISSP
z/OS Security Design, IBM
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
