date:20120312

Re: VTAMLST - missing RACF features

2012-03-12 Thread R.S.

W dniu 2012-03-09 18:00, Juan Mautalen pisze:

Hi:

We currently have our VTAMLST libraries protected with UACC(READ). IBM suggests
UACC(NONE) for them (RACF Security Administrator Guide, apendix D- Security for
system datasets) . I want to make the change, but of course i know i must be
extremely carefull with this change. I need to detect all users needing read
access to VTAMLST. Human users are not my problem, my worry is about non-human
ones (users of system tasks, started tasks, etc.).

[...]

That brought to my mind missing (IMHO) features of RACF.
Now one can put the profile in WARNING mode, which effectively mean
UACC(ALTER), or one can set AUDIT and wait for the SMF records, which
can be ineffective and lengthy.

The following solutions could help in such case:

1. ACC-WARN
A warning set at given access level. Especially useful for such purposes
like change UACC(NONE) - UACC(READ).

One simply changes UACC and sets additional field with WARN-READ.
Effect: regular checking is performed, only for unauthorized READ
requests there is an access with warning message, higher accesses are
rejected.
To be checked after regular WARNING (which would make the above
ineffective).

2. Warning for selected users/groups
IMHO less sexy, but still fine.
An access list for users/groups - only for them the WARNING is honored.
In such case the candidates would be started tasks users.

My €0.02

--
Radoslaw Skorupka
Lodz, Poland

--
Treść tej wiadomości może zawierać informacje prawnie chronione Banku
przeznaczone wyłącznie do użytku służbowego adresata. Odbiorcą może być jedynie
jej adresat z wyłączeniem dostępu osób trzecich. Jeżeli nie jesteś adresatem
niniejszej wiadomości lub pracownikiem upoważnionym do jej przekazania
adresatowi, informujemy, że jej rozpowszechnianie, kopiowanie, rozprowadzanie
lub inne działanie o podobnym charakterze jest prawnie zabronione i może być
karalne. Jeżeli otrzymałeś tę wiadomość omyłkowo, prosimy niezwłocznie
zawiadomić nadawcę wysyłając odpowiedź oraz trwale usunąć tę wiadomość
włączając w to wszelkie jej kopie wydrukowane lub zapisane na dysku.

This e-mail may contain legally privileged information of the Bank and is intended solely for business use of the addressee. This e-mail may only be received by the addressee and may not be disclosed to any third parties. If you are not the intended addressee of this e-mail or the employee authorised to forward it to the addressee, be advised that any dissemination, copying, distribution or any other similar activity is legally prohibited and may be punishable. If you received this e-mail by mistake please advise the sender immediately by using the reply facility in your e-mail software and delete permanently this e-mail including any copies of it either printed or saved to hard drive.

BRE Bank SA, 00-950 Warszawa, ul. Senatorska 18, tel. +48 (22) 829 00 00, fax
+48 (22) 829 00 33, www.brebank.pl, e-mail: i...@brebank.pl
Sąd Rejonowy dla m. st. Warszawy XII Wydział Gospodarczy Krajowego Rejestru Sądowego, nr rejestru przedsiębiorców KRS 025237, NIP: 526-021-50-88.
Według stanu na dzień 01.01.2012 r. kapitał zakładowy BRE Banku SA (w całości wpłacony) wynosi 168.410.984 złotych.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: Backlevel IPCS issue at z/OS 1.13

2012-03-12 Thread Ron MacRae

Mark,
 Your CLIST is almost identical to my REXX exec.  Except I have to push 
the TSOLIB command onto the stack as it won't run under rexx, even with an 
address TSO in front, and I therefore also push ISPF as well.

I tried typing in your commands at the TSO ready prompt. Still no joy ISPF/IPCS 
just isn't 'seeing' the TSOLIB.

It works fine on LPARS running z/OS 1.11. 
It just doesn't work at z/OS 1.13 as BLSG gets loaded from ISPLLIB insted of 
the library set with TSOLIB.

Unless I can work out what's wrong I'll have to resort to messing with ISPLLIB 
etc.

Ron.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: CICS Maintenance - LPA change

2012-03-12 Thread Vernooij, CP - SPLXM

Peter,

If it does not work, because the application loads the module once and
uses this version from then on, refreshing the module and restarting the
application should work, correct?

Kees.

Peter Relson rel...@us.ibm.com wrote in message
news:of912f7c2d.fb4c9ddb-on852579bd.00769d61-852579bd.0076e...@us.ibm.c
om...
 If the owner of the service item did not tell you using dynamic LPA
would 
 work, you should have no expectation that it will, and you should not
do 
 it.
 
 This applies to every piece of service regardless of product. 
 
 Peter Relson
 z/OS Core Technology Design
 
 --
 For IBM-MAIN subscribe / signoff / archive access instructions,
 send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

For information, services and offers, please visit our web site: 
http://www.klm.com. This e-mail and any attachment may contain confidential and 
privileged material intended for the addressee only. If you are not the 
addressee, you are notified that no part of the e-mail or any attachment may be 
disclosed, copied or distributed, and that any other action related to this 
e-mail or attachment is strictly prohibited, and may be unlawful. If you have 
received this e-mail by error, please notify the sender immediately by return 
e-mail, and delete this message. 

Koninklijke Luchtvaart Maatschappij NV (KLM), its subsidiaries and/or its 
employees shall not be liable for the incorrect or incomplete transmission of 
this e-mail or any attachments, nor responsible for any delay in receipt. 
Koninklijke Luchtvaart Maatschappij N.V. (also known as KLM Royal Dutch 
Airlines) is registered in Amstelveen, The Netherlands, with registered number 
33014286



--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: Aprapros of Nothing

2012-03-12 Thread Binyamin Dissen

Sadly, there are some that are.

Use POPFILE or some other Bayesian filter.

On Sun, 11 Mar 2012 14:59:18 -0700 Ulrich Krueger u...@pacbell.net wrote:

:Just tell Outlook to _not_ mark emails from IBM-MAIN@bama.ua.edu as Spam.
:
:
:Regards,
:Ulrich Krueger
:
:
:-Original Message-
:From: IBM Mainframe Discussion List [mailto:IBM-MAIN@bama.ua.edu] On Behalf
:Of Andy Coburn
:Sent: Sunday, March 11, 2012 2:48 PM
:To: IBM-MAIN@bama.ua.edu
:Subject: Aprapros of Nothing
:
:Not due to anything I've overtly done, Microsoft Outlook 2003 has decided
:that any e-mail with the subject Re: Program FLIH backdoor - This is a
:criminal breach of security! is to be placed immediately in the Junk E-mail
:folder. And does so.
:
:Does Outlook know something I don't know?
:
:Andy  
:
:--
:For IBM-MAIN subscribe / signoff / archive access instructions,
:send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN
:
:--
:For IBM-MAIN subscribe / signoff / archive access instructions,
:send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

--
Binyamin Dissen bdis...@dissensoftware.com
http://www.dissensoftware.com

Director, Dissen Software, Bar  Grill - Israel


Should you use the mailblocks package and expect a response from me,
you should preauthorize the dissensoftware.com domain.

I very rarely bother responding to challenge/response systems,
especially those from irresponsible companies.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Are LPAR names unique or effectively unique?

2012-03-12 Thread Mr Austin



I've been asked to look into seat based licensing for z/OS and for this I 
need a unique z/OS image name for the license. I can see that an LPAR has an ID 
(a number) and a name. The LPAR ID appears to be unique, but is the name unique 
or effectively unique?  By 'effectively' I mean would a duplicate name be 
problematic.


Also, are LPAR names  and IDs normally paired/tied, or might they change? Would 
a license based on the LPAR ID rather than name be acceptable? 


Thanks

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: Are LPAR names unique or effectively unique?

2012-03-12 Thread Martin Packer

Nowadays machine serial number is in Type 70 in a unique way. So I'd use 
that, together with LPAR number and name. Not sure how you'll cope if an 
LPAR has to move to a different machine.

Cheers, Martin

Martin Packer,
Mainframe Performance Consultant, zChampion
Worldwide Banking Center of Excellence, IBM

+44-7802-245-584

email: martin_pac...@uk.ibm.com

Twitter / Facebook IDs: MartinPacker
Blog: 
https://www.ibm.com/developerworks/mydeveloperworks/blogs/MartinPacker



From:
Mr Austin austinm...@yahoo.com
To:
IBM-MAIN@bama.ua.edu, 
Date:
12/03/2012 10:39
Subject:
Are LPAR names unique or effectively unique?
Sent by:
IBM Mainframe Discussion List IBM-MAIN@bama.ua.edu





I've been asked to look into seat based licensing for z/OS and for this 
I need a unique z/OS image name for the license. I can see that an LPAR 
has an ID (a number) and a name. The LPAR ID appears to be unique, but is 
the name unique or effectively unique?  By 'effectively' I mean would a 
duplicate name be problematic.


Also, are LPAR names  and IDs normally paired/tied, or might they change? 
Would a license based on the LPAR ID rather than name be acceptable? 


Thanks

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN








Unless stated otherwise above:
IBM United Kingdom Limited - Registered in England and Wales with number 
741598. 
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU






--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

MIGRATING A ML0 VOLUME - CLARIFICATION

2012-03-12 Thread willie bunter

Good Day To All Readers
 
I issued the following command HSEND MIGRATE VOLUME(SMR101) DAYS(0)  thinking 
that it would migrate the dsns to ML1 or ML2.  However I noticed that the dsns 
were migrated to other ML0 volumes.  Was I wrong in thinking that?


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: MIGRATING A ML0 VOLUME - CLARIFICATION

2012-03-12 Thread Mike Schwab

A non zero days would migrate to ML1 according to normal rules.  Then
follow with a zero days command to clear the primary volume.

On Mon, Mar 12, 2012 at 7:24 AM, willie bunter williebun...@yahoo.com wrote:
 Good Day To All Readers

 I issued the following command HSEND MIGRATE VOLUME(SMR101) DAYS(0)  thinking 
 that it would migrate the dsns to ML1 or ML2.  However I noticed that the 
 dsns were migrated to other ML0 volumes.  Was I wrong in thinking that?

-- 
Mike A Schwab, Springfield IL USA
Where do Forest Rangers go to get away from it all?

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: MIGRATING A ML0 VOLUME - CLARIFICATION

2012-03-12 Thread willie bunter

I noticed that when I tried to migrate ML1 to ML2 - HSEND FREEVOL MVOL(MVS001) 
TARGETLEVEL(ML2)-
 it is not migrating the dsns to ML2 but to other ML1 volumes
 
Would anybody know why?



From: willie bunter williebun...@yahoo.com
To: IBM-MAIN@bama.ua.edu 
Sent: Monday, March 12, 2012 8:24:43 AM
Subject: MIGRATING A ML0 VOLUME - CLARIFICATION

Good Day To All Readers
 
I issued the following command HSEND MIGRATE VOLUME(SMR101) DAYS(0)  thinking 
that it would migrate the dsns to ML1 or ML2.  However I noticed that the dsns 
were migrated to other ML0 volumes.  Was I wrong in thinking that?


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: A stupid idea? Using twitter like service for z/SO, et al., event notification.

2012-03-12 Thread Dana Mitchell

On Fri, 9 Mar 2012 11:19:30 -0600, McKown, John john.mck...@healthmarkets.com 
wrote:
Anyway, I was thinking that a twitter like service to which they could 
connect their home PC or smartphone would make it easier for them to track the 
activity on the system without the need to bring up a VPN connection and logon 
to TSO. 

John,

I wrote a few tools like this at a previous job where we basically had no 
operations support.  One would select output files from nightly backups using 
IGGCSIFX and produce an RSS feed of all the backup jobs including their 
completion status and links to the output from each one (does anybody really 
use RSS anymore?).   I had another one that would use SDSF REXX to check output 
status of selected jobs and send an HTTP email with info and links to the 
output datasets.  HTH

Dana

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: Backlevel IPCS issue at z/OS 1.13

2012-03-12 Thread Walt Farrell

On Mon, 12 Mar 2012 04:15:59 -0500, Ron MacRae ronmac...@hotmail.co.uk wrote:

Mark,
 Your CLIST is almost identical to my REXX exec.  Except I have to 
 push the TSOLIB command onto the stack as it won't run under rexx, even with 
 an address TSO in front, and I therefore also push ISPF as well.

I tried typing in your commands at the TSO ready prompt. Still no joy 
ISPF/IPCS just isn't 'seeing' the TSOLIB.

It works fine on LPARS running z/OS 1.11.
It just doesn't work at z/OS 1.13 as BLSG gets loaded from ISPLLIB insted of 
the library set with TSOLIB.

Unless I can work out what's wrong I'll have to resort to messing with ISPLLIB 
etc.

I'm not sure I understand why your approach even works on 1.11, but it's a 
complex topic. As previously mentioned, if you have done a LIBDEF for ISPLLIB 
then in order to get that library concatenation used as a tasklib you have to 
use SELECT CMD, not SELECT PGM.

However, if my understanding is correct, if you had an ISPLLIB DD allocated 
before you started ISPF, that library concatenation would be a tasklib for 
anything invoked under ISPF, either via SELECT PGM or SELECT CMD.

So, if your correct IPCS library (proper SYS1.MIGLIB) is allocated as ISPLLIB 
before you start ISPF, or is allocated via LIBDEF and you use SELECT CMD, then 
everything should work. 

Your TSOLIB should be irrelevant if you have the wrong level of IPCS allocated 
as ISPLLIB before ISPF starts, and that should be true with either 1.11 or 
1.13. The ISPLLIB allocated when ISPF starts is a tasklib for ISPF and its 
subtasks, and the TSOLIB as a higher level tasklib would only come into play 
when modules are not found in the pre-allocated ISPLLIB.

-- 
Walt Farrell
IBM STSM, z/OS Security Design

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

Re: Backlevel IPCS issue at z/OS 1.13

2012-03-12 Thread Mark Zelden

On Mon, 12 Mar 2012 04:15:59 -0500, Ron MacRae ronmac...@hotmail.co.uk wrote:

Mark,
 Your CLIST is almost identical to my REXX exec.  Except I have to 
 push the TSOLIB command onto the stack as it won't run under rexx, even with 
 an address TSO in front, and I therefore also push ISPF as well.

I tried typing in your commands at the TSO ready prompt. Still no joy 
ISPF/IPCS just isn't 'seeing' the TSOLIB.

It works fine on LPARS running z/OS 1.11.
It just doesn't work at z/OS 1.13 as BLSG gets loaded from ISPLLIB insted of 
the library set with TSOLIB.

Unless I can work out what's wrong I'll have to resort to messing with ISPLLIB 
etc.


User error. :-)

I don't know what you are doing wrong.   You can use my CLIST as is and it 
should work.   
The key is the TSOLIB prior to invoking ISPF and using a modified BLSCLIBD that
has LIBRARY ID instead of DATASET in the libdef. I didn't post that 
CLIST
and left that as an exercise for the reader, but if it helps, I'll post that 
also.  Remember
BLSCALTL needs one line changed too (I called my IPCSALTL).   I won't post that
CLIST, but here is the line:   ALTLIB ACTIVATE APPLICATION(CLIST) 
DDNAME(SBLSCLI0) 

Here is my IPCSALTD CLIST.   You can see the changes marked MSZ.  I have
one other change that forces the DDIR dsn to be userid.DDIR as the 
normal BLSCDDIR will make it SYS1.DDIR if you run without a prefix. 

PROC 0 DSNAME()  /* MSZ */   
/*   
/* SPECIAL IPCS CLIST TO BE INVOKED FROM IPCSALT DRIVER CLIST TO 
/* RUN AN IPCS LEVEL DIFFERENT THAN THAT FROM THE RUNNING OS LEVE
/* IT USES LIBRARY/DDNAME IN THE LIBDEFS INSTEAD OF DATASET NAME.
/*   
/
/* MODIFIED BLSCLIBD CLIST BELOW - LIBDEFS FOR DATASET CHANGED 
/* TO LIBDEFS FOR LIBRARY WITH DDNAME INSTEAD  
/
CONTROL NOLIST ASIS  
/* CONTROL LIST CONLIST SYMLIST MSG  
/*---*/  
/* TABLE, MESSAGE, SKELETON, AND PANEL LIBRARIES */  
/*---*/  
ALTLIB ACTIVATE APPLICATION(CLIST) DDNAME(SBLSCLI0)  /* MSZ */   
IF LENGTH(DSNAME)=0 THEN SET DSNAME=SYSUID..DDIR  /* MSZ */   
LISTDSI IPCSDDIR FILE NORECALL /* DUMP DIRECTORY FILE@05A*/  
IF LASTCC4 THEN %BLSCDDIR VOLUME(LIBVSM)  +
 DSNAME(DSNAME)  /* MSZ */  
ISPEXEC LIBDEF ISPMLIB LIBRARY ID(SBLSMSG0) COND/* MSZ */
ISPEXEC LIBDEF ISPPLIB LIBRARY ID(SBLSPNL0) COND/* MSZ */
ISPEXEC LIBDEF ISPSLIB LIBRARY ID(SBLSKEL0) COND/* MSZ */
/*---*/  
/* INVOKE LIBDEF FOR ISPTLIB ONLY IF BLSGCMDS IS NOT */  
/* AVAILABLE.   5@02A*/  
/*---*/  
ISPEXEC TBOPEN BLSGCMDS LIBRARY(ISPTLIB) NOWRITE SHARE   
IF LASTCC¬=0 THEN DO
  ISPEXEC LIBDEF ISPTLIB LIBRARY ID(SBLSTBL0) COND   /* MSZ */   
  SET TLIBSET=YES
  END
ELSE ISPEXEC TBCLOSE BLSGCMDS LIBRARY(ISPTLIB)   
/*---*/  
/* START THE IPCS DIALOG AND SETUP THE IPCS CLIST AND REXX   */  
/* LIBRARY SYS1.SBLSCLI0 AS AN ALTLIB APPLICATION CLIST  */  
/* LIBRARY.  */  
/*---*/  
/* ISPEXEC SELECT PGM(BLSG) NEWAPPL(BLSG) PASSLIB PARM(+ 
/*   PGM(BLSGSCMD) PARM(EX 'SYS1.SBLSCLI0(BLSCALTL)')) /* @05C*/ 
ISPEXEC SELECT PGM(BLSG) NEWAPPL(BLSG) PASSLIB PARM(+
PGM(BLSGSCMD) PARM(EX 'ZELDEN.LIB.CNTL(IPCSALTL)')) /* @05C*/
/*---*/  
/* LOGIC FOR IPCS SECONDARY TUTORIAL PANELS.8@01A*/  
/*---*/  
SET MYCC=LASTCC
IF MYCC=8 THEN DO  
  ISPEXEC SETMSG MSG(BLSMB002) COND /*   @06C*/  
  IF LASTCC=4 THEN EXIT CODE(MYCC) /* @06C*/  
  WRITE DIALOG PROGRAM BLSG ENDED WITH RETURN CODE MYCC 
  EXIT CODE(MYCC)  /*   @04C*/  
  END
/*---*/   
/* CANCEL THE DEFINITION AFTER THE IPCS DIALOG IS TERMINATED */

Re: Program FLIH backdoor - This is a criminal breach of security!

2012-03-12 Thread Chris Craddock

On Sun, Mar 11, 2012 at 8:07 AM, John Gilmore johnwgilmore0...@gmail.comwrote:

 Since this sort of thing is expected of me, I will note that we find
 ourselves between Scylla and Charybdis here.

 Chris Craddock's formulation was open to the exception that Peter
 Relson took: there is fetch-protected storage the contents of which
 its owner is entirely free to make available to others.

 Peter's exception is logically impeccable.  It did, however, seem to
 me to be a very special one; and I observed that it was.  I still
 prefer the ROT that the contents of protected storage should not be
 made available to the unauthorized (in any but very special
 circumstances, when they are known procedurally to be innocuous.).

 To repeat myself now, Peter is nonetheless correct in the abstract.
 There is a long intellectual tradition which has it that the
 production of just one black swan is an unanswerable refutation of the
 proposition that all swans are white.


I can't quibble with Peter's exception. I was evidently not sufficiently
clear. I had assumed it was self-evident to everyone that a privileged
program is free to do what ever it wants with the contents of its own
storage - including both disclosing and/or modifying that data - regardless
of fetch protection. I was merely pointing out to a prior poster that a
privileged program is required to honor key controlled protection in
general and meeting that requirement is more rigorous than just not
mindlessly storing in areas provided by a caller (regardless of the
caller's key).

-- 
This email might be from the
artist formerly known as CC
(or not) You be the judge.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

IEFBR14

2012-03-12 Thread Scott Ford

All,

I just ran across something that didn't make sense or maybe I was under a 
misconception..

I created a DATASET , Qsam file , with iefbr14 , everything looked fine. A 
COBOL program goes to open the file and abends with a S001-4 , the resolution 
was to create the DATASET with a gener...never have seen this situation before 
...has anyone else seen this one before?

Sent from my iPad
Scott Ford
Senior Systems Engineer
www.identityforge.com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@bama.ua.edu with the message: INFO IBM-MAIN

48 matches

Mail list logo