VSM ALLOWUSERKEYCSA(NO)
only prevents obtaining user key CSA.
It does not prevent creating a user key CADS, or using CHANGKEY
to change the key of subpool 247 or 248 (DREF SQA) storage to
user key.
The health check and the new SMF 30 field report all three of those
types of security issues, and all three will be disallowed in the next
release after z/OS 2.3.
So I would think that you would want to keep the health check enabled.
Jim Mulder z/OS Diagnosis, Design, Development, Test IBM Corp.
Poughkeepsie NY
IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU> wrote on
04/05/2018 03:12:40 PM:
> From: "Dyck, Lionel B. (TRA)" <lionel.d...@va.gov>
> To: IBM-MAIN@LISTSERV.UA.EDU
> Date: 04/05/2018 03:30 PM
> Subject: Re: [EXTERNAL] Re: UA94606
> Sent by: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU>
>
> Thank you
>
> Since we have the DIAG set to NO is there a reason to keep the
> Health Check enabled?
>
>
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
