First, a good rule of thumb is to not broadcast the password for any of your userids in a public forum (i.e.... Here). Always replace the password with eight ³X²s and keep them secret. If you replaced the actual password with ³SMILE², then the use of eight ³X²s would keep paranoid people like me quiet... The same is true for the passwords on the minidisk....
Second, You have the terminal address where SERVICE is logged in; Do you know where this terminal is? Might there be someone sitting there, that could shed light on what the account is used for? Being fully privileged, no one should walk away from it leaving it logged in or unlocked in some way; this is a huge security risk for your system. This account seems to be linked with the accounts ³VAUTOLG1, VOP1 and VMAINT... Are these possibly accounts used to build a ³virtual², or second-level z/VM system? Could this be what the SERVICE machine is used for? If you¹re the systems programmer for the system, and you don¹t know what the account is used for, then one very sure way to find out would be to change the password and see who runs into your office. No amount of research can replace a good, well placed denial of service. -- Robert P. Nix Mayo Foundation .~. RO-OE-5-55 200 First Street SW /V\ 507-284-0844 Rochester, MN 55905 /( )\ ----- ^^-^^ "In theory, theory and practice are the same, but in practice, theory and practice are different." On 4/7/08 12:32 PM, "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> wrote: > > here is the USER DIRECT entry for SERVICE: > > * > USER SERVICE XXXXXXXX 16M 32M ABCDEFG > LOGONBY MAINT PRGRAMLY > MACHINE XA > AUTOLOG VAUTOLG1 VOP1 VMAINT > ACCOUNT VOLTSEP IBMCE > IPL CMS PARM AUTOCR > OPTION QUICKD > SHARE RELATIVE 1000 > CONSOLE 009 3215 > SPOOL 00C 2540 READER A > SPOOL 00D 2540 PUNCH A > SPOOL 00E 1403 A > LINK MAINT 190 190 RR > LINK MAINT 19E 19E RR > MDISK 191 3390 2183 005 220W01 MR XXXXXXXX XXXXXXXX XXXXXXXX > * > > i'll take a look at TRACK - thanks for the tip. > > would it be restarted after an IPL just because it was running when i > shutdown? > > prg > > Phillip Gramly > Systems Programmer > Communications Data Group > Champaign, IL > > The IBM z/VM Operating System <[email protected]> wrote on 04/07/2008 > 12:22:19 PM: > >> > >> > Phillip, >> > >> > Looking in the "USER DIRECT distributed with z/VM 5.3.0 there is no >> > userid called "SERVICE". What release of VM are you running? It >> > seems that some application installed at your site defined the userid >> "SERVICE". >> > >> > Can you check the directory entry for "SERVICE" to see what minidisks >> > it owns and the LINK to them to see what's on them (besides the >> > "PROFILE EXEC")? >> > >> > Checking to see what it is doing can also be done with the TRACK >> > command. You can download and install TRACK from: >> > http://vm.marist.edu/track/code.html >> > >> > Once you begin using TRACK you won't ever want to run a z/VM system >> > without it. It should be in every serious z/VM System Programmer's tool >> box. >
