Re: C/C++ Calling OBTAIN / IGC0002G

2009-05-13 Thread Walt Farrell
On Wed, 13 May 2009 10:09:40 -0500, Cristi Terpea wrote: >I don't want to compile also the asm routine on the target machine. It would >be great to have one executable (is it possible to link statically the asm >object with the C object?). >I also searched this area, but couldn't find an easy way

Re: C/C++ Calling OBTAIN / IGC0002G

2009-05-13 Thread Walt Farrell
problem is that you've lost the original value of r01 (from that malloc(16) call), which is what you need to pass to the OBTAIN SVC. Why don't you simply call an assembler subroutine and have it do an OBTAIN? Building

Re: RACF profile matched using FASTAUTH

2009-05-13 Thread Walt Farrell
profile the in-storage data came from. You can at most determine the member name (which might be in the member class, or in some grouping class profile), not the actual profile name. And, as noted above, if merging occurred there really isn't "a" profile. Why do you need this? [By

Re: RACF Newbie question

2009-05-12 Thread Walt Farrell
On Mon, 11 May 2009 18:58:00 -0500, Paul Gilmartin wrote: >[quoting someone, perhaps Mark Zelden]: >>I guess the fact that it isn't documented could be called "MVS System >>Programming 101" on program fetch / system search order. Pretty >>much anything reentrant or non-executable like a table c

Re: Validating Addrees

2009-05-11 Thread Walt Farrell
in their programming. Thus our queries about *why* you want to know this. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua

Re: How to display Stars for Password in ISPF

2009-05-11 Thread Walt Farrell
w. We would probably need to change the error messages that we let applications retrieve from RACROUTE, too, in case they display them to the user. So it's non-trivial, but could be done in one central spot. Of course, you'd need is a larger help desk support staff to handle the incr

Re: ADRDSSU protection

2009-05-11 Thread Walt Farrell
ipt, PERL script, PYTHON script, etc. to do it). -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the messag

Re: ADRDSSU protection

2009-05-08 Thread Walt Farrell
SPZAP. UPDATE to an APF library effectively gives you access to all data on the system, and lets you impersonate any user you want to, whenever you want it. At that point, why mess with AMASPZAP? -- Walt Farrell, CISSP IBM STSM,

Re: RACF Newbie question

2009-05-08 Thread Walt Farrell
r copies of the module in your linklist, or in LPA, or MLPA, etc. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.

Re: RACF Newbie question

2009-05-08 Thread Walt Farrell
r copies of the module in your linklist, or in LPA, or MLPA, etc. -- Walt Farrell, CISSP -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-M

Re: insane thought - SMF reformatter?

2009-04-21 Thread Walt Farrell
On Tue, 21 Apr 2009 08:55:18 -0500, Walt Farrell wrote: >Hi, Radoslaw -- I just thought I'd point out that due to a complexity of the >English language you probably meant "not very valuable" rather than >"invaluable". > My sincere apologies to Radoslaw fo

Re: insane thought - SMF reformatter?

2009-04-21 Thread Walt Farrell
Hi, Radoslaw -- I just thought I'd point out that due to a complexity of the English language you probably meant "not very valuable" rather than "invaluable". You said "For example I can reformat RACF records using IRRADU00 tool, but the out is still invaluable for the person who doesn't know RAC

Re: DCB/DCBE In Common Storage

2009-04-20 Thread Walt Farrell
ive. I agree that with more info about what he wants to do we might make suggestions about alternatives he hasn't considered. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive a

Re: New RRSF Users

2009-04-09 Thread Walt Farrell
gt;Any commands to display or utility to determine. How to troubleshoot >problems? You will probably get the best answers for RACF-related questions on RACF-L, rather than IBM-MAIN. If you're not familiar with RACF-L, please see http://www-03.ibm.com/servers/eserver/zseries/zos/racf/links/r

Re: "New" TOD (Was:Howard Turetzky has a NEW EMAIL ADDRESS)

2009-04-09 Thread Walt Farrell
27;t understand that comment, Barry. The expiration date on a tape has the form cyyddd and seems, to me, unrelated to TOD clock format. Can you help me understand how they're related? -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -

Re: RACF RRSF SET

2009-04-06 Thread Walt Farrell
UTODIRECT >SET NOAUTOPWD > >I want to set what options have already been set. SET LIST (with the appropriate subsystem command character first, of course). See the RACF Command Language Reference for information on RACF commands. -- Walt Farrell, CISSP

Re: secure file transfer FROM z/OS

2009-04-01 Thread Walt Farrell
z/OS Ported Tools OpenSSH has several weaknesses wrt security - where's >kerberos? where's PAM? Also good questions. I can only assume it's merely a matter of priorities and resources available for development. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design ---

Re: secure file transfer FROM z/OS

2009-04-01 Thread Walt Farrell
ogy a bit simpler. Of course, one might argue that that makes using SSH private/public key implementation weaker, in some ways, than using passwords. It's certainly a major factor in why we don't allow SSH authentication via private/public key in our z

Re: secure file transfer FROM z/OS

2009-04-01 Thread Walt Farrell
ssword, In this case "anonymous" can be stored in a protected dataset and then >included in my input statements? > >Perhaps we should be looking at FTPS and X5.09 certificates instead of >passwords. In your example, "anonymous" is the user ID. The password is "c

Re: "A foolish consistancy" or "3390 cyl/track architecture"

2009-04-01 Thread Walt Farrell
On Tue, 31 Mar 2009 12:50:16 -0500, Eric Bielefeld wrote: >Thanks for clearing up how the current drives actually work. It just seems >like IBM could get away from the track and cylinder stuff, which >artificially restricts the amount of storage you use. If you use short >blocksizes, or long one

Re: Need single character unique identifier for each system in a sysplex. 0-F is fine.

2009-03-30 Thread Walt Farrell
On Mon, 30 Mar 2009 14:40:56 -0400, Dan D wrote: >PS. Why aren't people sending to the list so that everyone gets to >contribute/critisize? I've seen the original message and 13 replies before yours via the web site, so it looks to me like people are sending it to the list. Perhaps you're having

Re: Need single character unique identifier for each system in a sysplex. 0-F is fine.

2009-03-30 Thread Walt Farrell
contain any >of 256 values (x'00' - x'FF'). If you want to stick to printable, the >letters and numbers give you 36 different values. Sean's the one who limited it to "single digit unique identifier" in his original message. I agree, of course, that if

Re: Need single character unique identifier for each system in a sysplex. 0-F is fine.

2009-03-30 Thread Walt Farrell
ve a single-digit identifier that will work in all possible configurations :-) -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@

Re: "A foolish consistancy" or "3390 cyl/track architecture"

2009-03-27 Thread Walt Farrell
S V1.10: VSAM previewed for z/OS V1.11: extended format sequential, too. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.u

Re: "Cost" of RACF vs. small file I/O

2009-03-27 Thread Walt Farrell
but that's a mechanism that could work, depending on exactly how your application runs (which we don't know yet). -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archiv

Re: "Cost" of RACF vs. small file I/O

2009-03-26 Thread Walt Farrell
rovides access control if he needs that, too. Many applications can access an LDAP directory, and they can even run on machines elsewhere in your network. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For I

Re: "Cost" of RACF vs. small file I/O

2009-03-26 Thread Walt Farrell
menting a database, or needing a database with access control, or what. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.ed

Re: z/OS 1.7 upgrade to 1.10

2009-03-24 Thread Walt Farrell
3.ibm.com/systems/z/os/zos/support/zos_cmf.html -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GE

Re: How to protect with RACF an XCF group ?

2009-03-19 Thread Walt Farrell
s protected by the requirement that a program needs to run in supervisor state or with a PKM allowing system key in order to use that service. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signof

Re: RACF PASSWORD ENVELOPE

2009-03-12 Thread Walt Farrell
pened? In any case, I suggest that the RACF-L mailing list is perhaps more appropriate for that question, as you'll get at least a wider audience of IBMers knowledgeable on that topic over there, and probably the same or a larger set of knowledgeable non-IBMers, too. -- Walt Farrell

Re: IBM-MAIN Threads Posted To Twitter

2009-03-12 Thread Walt Farrell
On Thu, 12 Mar 2009 08:10:28 +, Martin Packer wrote: >Is it possible to get IBM-MAIN to post in each email a link to the start >of the thread? If so that would make it easy in a number of contexts to >follow the thread: >... >I'm guessing not. I suspect this is standard software and I don't

Re: RACF EXIT ICHPWX11 doesn't work properly

2009-03-10 Thread Walt Farrell
ttp://www-03.ibm.com/servers/eserver/zseries/zos/racf/links/racf-l.html -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu

Re: RACF password & id checking

2009-03-06 Thread Walt Farrell
On Sat, 7 Mar 2009 00:12:16 +0800, Tommy Tsui wrote: >I saw the REXX code and it's quite simple. Just turn it on...I will try it .. >thanks all of your help Do remember that it works only on z/OS R10 and later, though. -- Walt Farrell, CISSP IBM STSM, z/OS Secu

Re: RACF password & id checking

2009-03-06 Thread Walt Farrell
set some switches to enable the functions we've already written. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.ed

Re: Can TOD (STCKE) be compressed into 12 bytes

2009-03-06 Thread Walt Farrell
On Fri, 6 Mar 2009 07:43:26 -0600, Don Williams wrote: >IBM has already implied that the TOD register is intended to be a programming >interface by stating in the POP manual: > >“13. Uniqueness of TOD-clock values can be extended to apply to processors >in separate configurations by including a c

Re: Should TIME LINKAGE=SYSTEM support a PLIST above the bar?

2009-03-06 Thread Walt Farrell
On Fri, 6 Mar 2009 07:06:08 -0600, Steven Partlow wrote: >On Thu, 5 Mar 2009 10:31:55 -0600, Walt Farrell wrote: >... >>According to the book, only a limited set of MVS assembler programming >>services support invocation in 64-bit addressing mode, and only a more >>lim

Re: RACF password & id checking

2009-03-06 Thread Walt Farrell
o record it, but that knowledge is wide spread enough that it's really the same concern whether you deal with REXX or assembler exits. So, no, you should not be scared of it. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -

Re: RACF password & id checking

2009-03-06 Thread Walt Farrell
s page (http://www-03.ibm.com/servers/eserver/zseries/zos/racf/goodies.html ) that should simplify that. See REXXPWEXIT. It works on z/OS R10 and later, and provides an ICHPWX01 exit that invokes a REXX exec via System REXX, and a sample REXX exec that you can tailor easily. -- Walt Farrell, CISSP

Re: Should TIME LINKAGE=SYSTEM support a PLIST above the bar?

2009-03-05 Thread Walt Farrell
On Thu, 5 Mar 2009 16:00:35 +0200, Binyamin Dissen wrote: >I am getting a PIC-4/S0c4 in IEANUC01.IEATTIME+04FE with the PSW in 31 bit >mode. Backtracking in the dump I see it doing an EREG 1,1 when it should be >doing an EREGG if it supports 64bit. According to the book, only a limited set of MV

Re: MPFLST Exit

2009-03-02 Thread Walt Farrell
e the L-form of the macro), but can only suggest that you show us your code and that you examine the UTOKEN you build before you pass it in on the MGCRE. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subsc

Re: Problem with RACF dataset profiles

2009-02-23 Thread Walt Farrell
same idea applies. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archive

Re: Passw protection out RACF rules with z/OS resources for userid.

2009-02-19 Thread Walt Farrell
ly exactly what you want. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Sea

Re: REUSEASID=YES

2009-02-19 Thread Walt Farrell
.com/cgi-bin/bookmgr_OS390/Shelves/EZ2ZO10K?searchRequest=reusasid&SEARCH=Search+text&Type=FUZZY&SearchTopic=TOPIC&searchText=TEXT&searchIndex=INDEX&rank=RANK or http://preview.tinyurl.com/azx484 -- Walt Farrell, CISSP IBM STSM, z/OS Security Design

Re: How "Official" are Supplied Sample Exits? (was Assembler Question)

2009-02-18 Thread Walt Farrell
erates. I can't comment on other system macros, though, as I haven't looked at them in this regard. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access

Re: How "Official" are Supplied Sample Exits? (was Assembler Question)

2009-02-17 Thread Walt Farrell
ndreds of thousands, and you'll never notice any difference that might exist. You may have a different opinion, of course, but I believe there are a lot more things you could worry about than that one if you want to improve application or system performance. -- Walt Farrell, CISSP IBM STSM,

Re: JCL job execution order

2009-02-12 Thread Walt Farrell
On Wed, 11 Feb 2009 14:31:43 -0500, Veilleux, Jon L wrote: >I kind of missed some of the posts for this, but if you really want them >to run one by one, you could give them their own job class and only >define one initiator for that class. Covered in earlier messages, Jon. That would ensure the

Re: JCL job execution order

2009-02-11 Thread Walt Farrell
On Wed, 11 Feb 2009 11:13:07 -0700, David Logan wrote: > You can prevent >temporary dataset name conflicts by ensuring that the last step that uses a >temporary uses DISP=(OLD,DELETE) > You're right that the user can certainly prevent the conflicts by making sure his JCL always has a DISP=(OLD,D

Re: JCL job execution order

2009-02-11 Thread Walt Farrell
On Wed, 11 Feb 2009 09:39:48 -0500, Dave Salt wrote: >The only messy part might be ensuring the step names are unique throughout the job, but other than that I think this might be the best solution? And that temporary dsnames don't conflict (e.g., DSN=&TEMP with DISP=(NEW,PASS)), and that you don

Re: Extracting in-stream dataset (i.e. SYSIN) from SMF

2009-02-09 Thread Walt Farrell
On Mon, 9 Feb 2009 16:27:51 +0100, Ferran Perxas wrote: >In some cases, the developers dynamically build JCL and they submit those >via intrdr from CICS (super "fat-batch-running" transactions), my client >wants to keep this up and working, but i want to know which programs are run >in my product

Re: Extracting in-stream dataset (i.e. SYSIN) from SMF

2009-02-09 Thread Walt Farrell
the input data sets via something like keeping HSM backups of all such input data sets. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to l

Re: DD DEST=(MS Windows machine)

2009-02-06 Thread Walt Farrell
On Thu, 5 Feb 2009 07:50:57 -0800, Don Russell wrote: >I'm toying with different ideas of how to send data to an MS Windows >server from MVS (1.9) > >Right now I have "step one" produce a sequential, plain text file on >DASD, and step 2 uses FTP to send it to the PC, translating ebcdic to >ascii

Re: APAR OA25205 - SMF 42 for member add/del/rename

2009-02-06 Thread Walt Farrell
hout using STOW. Thus anyone with UPDATE to a PDS could add/delete/rename members of that PDS without any type 42 record being created. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe

Re: Interesting APAR OA27291 an undocumented change to GETMAIN Behavior in z/OS 1.10

2009-02-06 Thread Walt Farrell
r GETMAIN or STORAGE OBTAIN, then you have no guarantee that a new page was assigned, and thus no guarantee of zeroed storage. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archiv

Re: insanity? process SMF with Java on non-z?

2009-02-04 Thread Walt Farrell
On Wed, 4 Feb 2009 12:30:23 -0600, John McKown wrote: >We are losing our SAS license. Cost containment. We are looking at getting >our main SAS user a Window desktop license so that he can continue to use >MXG. Apparently this is fairly popular. > >But I was curious if anybody has ever used anyth

Re: TLS Cipher Suites

2009-02-04 Thread Walt Farrell
ver you need to look at their documentation (pointers previously provided here on IBM-MAIN, I believe). -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email

Re: Def alias error in z/OS (SOLVED)

2009-01-29 Thread Walt Farrell
On Thu, 29 Jan 2009 11:44:25 -0600, Chase, John wrote: >> - STGADMIN.IGG.DEFDEL.UALIAS - >> >> >> Once defined, then Alter access was assigned to my group and DEF and >DEL commands was executed >> succesfully. > >Interesting that TSO checks for that authority, but IDCAMS running in >batch apparen

Re: zOS PDF Documentation

2009-01-29 Thread Walt Farrell
On Thu, 29 Jan 2009 09:30:22 -0500, Matt Dazzo wrote: >I found this site that has the z1.9 collection in PDF format, but they are all separate down loads. Is there a site where they all be down loaded with a single click? Thanks Matt > >http://publib.boulder.ibm.com/infocenter/zos/v1r9/index.js

Re: TLS Cipher suites

2009-01-28 Thread Walt Farrell
d at some Websphere Application Server (WAS) doc, which does not include the anonymous ciphers in the list of supported suites. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archi

Re: TLS Cipher suites

2009-01-28 Thread Walt Farrell
. As I understand it our Java implementation does not make use of System SSL, and as a result may (I'm not sure) allow anonymous cipher usage with SSL. But for non-Java cases (FTP with SSL, HTTPS, etc.) you should be OK

Re: Def alias error in z/OS

2009-01-28 Thread Walt Farrell
On Wed, 28 Jan 2009 13:05:03 -0600, Carlos Cordero wrote: >I think I was not explicit in my question, sorry, the point is how else commands DEFINE DEF could be executed successfully if are not defined in IKJTSOxx? or what else validate as other criteria regarding the catalog? Before tracing the tr

Re: Def alias error in z/OS

2009-01-28 Thread Walt Farrell
consider doing some system tracing. And perhaps you need to be seeking formal assistance via the IBM Support Center. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access i

Re: Def alias error in z/OS

2009-01-27 Thread Walt Farrell
work. If it does, then I can not explain why command line works on some of your systems and fails on others, but you will at least know a solution to make it work. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design --

Re: any negative experience with using RACROUTE services in SRB mode?

2009-01-27 Thread Walt Farrell
mented as working in SRB mode should work, though possibly with restrictions (as also documented). -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send

Re: Netview Access Services (NVAS) and Mixed-case Passwords

2009-01-26 Thread Walt Farrell
MS and CICS, I believe) they had to abide by TSO's processing, and upper-case the passwords before presenting them to RACF. And it went on from there. It would have been much simpler all around had RACF not required that processing of the applications calling it, but i

Re: MVS 4 minute 'outage' (final update)

2009-01-23 Thread Walt Farrell
tizen," >has a responsibility to ensure that it doesn't create a set of circumstances >where the system's well being could be compromised. Thanks for that clarification, Art. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design

Re: Def alias error in RACF

2009-01-23 Thread Walt Farrell
AUTHCMD. Unfortunately, he seems to have looked for RDEFINE, not DEFINE. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bam

Re: Def alias error in RACF

2009-01-23 Thread Walt Farrell
in it, since those are the commands that failed. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message:

Re: MVS 4 minute 'outage' (final update)

2009-01-22 Thread Walt Farrell
gh about the problem to know whether it's really something wrong in DB2 or elsewhere, so while it looks like a problem I can't say what needs to be fixed. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For

Re: SHARE copyright

2009-01-15 Thread Walt Farrell
This seems rather obvious, so perhaps you've already tried it or rejected it for some reason, but the SHARE web page at http://www.share.org has a "Contact Us" link, and one of the links on that page will help you contact SHARE HQ. I imagine someone there can contact the appropriate person, or put

Re: Some kind of hint!!!

2009-01-14 Thread Walt Farrell
On Wed, 14 Jan 2009 13:26:20 -0600, John McKown wrote: >The code, as shown, will work on either a Big-endian or Small-endian >machine. That's because I process the information byte-by-byte. It does >assume that the source machine, which was stated to be z/OS, is Big-endian. Thanks; I hadn't figu

Re: Some kind of hint!!!

2009-01-14 Thread Walt Farrell
On Wed, 14 Jan 2009 12:39:05 -0600, John McKown wrote: >On Wed, 14 Jan 2009 15:07:10 -0200, Carlos Bodra wrote: > >>...snipped... >I am not aware of any package which will do that, if this is what you mean. >COMP-3 fields are "packed decimal". It is rather easy to convert these into >an integer.

Re: VTAM security issue

2009-01-14 Thread Walt Farrell
an LU2 connection, is dependent on the security implemented at B and in its applications. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email

Re: Accessing 64-bit storage with IPCS working with ACTIVE

2009-01-12 Thread Walt Farrell
t was added in z/OS V1R9. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@bama.ua.edu with the message: GET IBM-MAIN INFO Search the archiv

Re: Submitting jobs to a z/os guest from vm

2009-01-10 Thread Walt Farrell
On Fri, 9 Jan 2009 16:35:39 -0600, Paul Gilmartin wrote: >On Fri, 9 Jan 2009 12:49:44 -0600, Walt Farrell wrote: >> >>With RSCS and appropriate RACF and JES setup RACF can supply the proper ID >>automatically, with no passwords required. >> >FSVO "proper"

Re: Submitting jobs to a z/os guest from vm

2009-01-09 Thread Walt Farrell
and appropriate RACF and JES setup RACF can supply the proper ID automatically, with no passwords required. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive access instruct

Re: Auditors (was: Survey says...)

2009-01-07 Thread Walt Farrell
On Wed, 7 Jan 2009 14:24:47 +, Ted MacNEIL wrote: >>There can be different levels of "policy". For example, when the national bank examiners (aka, "auditors") visited us they conducted audits according to the policies established by the national body that chartered/insured our >bank. > >It's

Re: Auditors (was: Survey says...)

2009-01-07 Thread Walt Farrell
or in what that externally applied policy required. The same applies today with policies set by Visa, Mastercard, etc. -- Walt Farrell (speaking as a former banker, not in my usual role as an IBMer) -- For IBM-MAIN subscribe

Re: Struct f_cnvrt in fcntl.h?

2009-01-05 Thread Walt Farrell
On Mon, 5 Jan 2009 08:38:39 -0600, Paul Gilmartin wrote: >(Related to a thread on MVS-OE, but perhaps a reader here >knows more) > >In: > >Title: z/OS V1R10.0 XL C/C++ Run-Time Library Reference >Document Number: SA22-7821-10 > > Linkname: fcntl() -- Control Open File Descriptors >

Re: Syncsort Oddity

2008-12-31 Thread Walt Farrell
On Wed, 31 Dec 2008 19:16:43 +, Ted MacNEIL wrote: >>When using VB, some code will write a short block if the space remaining in the current block is less than the DCB LRECL, even though the actual length of the next record is unknown. >>This results in a lot of short blocks, particularly whe

Re: ISPF and long lines (was: CLIST/REXX Philosophy)

2008-12-17 Thread Walt Farrell
On Wed, 17 Dec 2008 22:34:49 +, Ted MacNEIL wrote: >I've found so many people do not use new function, because there is little done to communicate change beyond the SYSPROG. > >I've also found that even when you do communicate to the user community, few actually read/exploit it. Any user can

Re: ISPF and long lines (was: CLIST/REXX Philosophy)

2008-12-17 Thread Walt Farrell
On Wed, 17 Dec 2008 21:42:08 +, Ted MacNEIL wrote: >1. ISPF EDIT appears to be 'stabilised'. I don't think so, Ted. Each of the last 3 z/OS releases has contained enhancements to ISPF Edit. In z/OS R10: o The ISPF editor now allows multiple destinations to be specified for the MOVE a

Re: CLIST/REXX Philosophy

2008-12-17 Thread Walt Farrell
;ll get a longer line. That processing could be changed, if anyone really needed to enforce lines shorter than some value. However, the exec that it creates is a sequential data set, and not one that you would put into a concatenation, so you'd only need a shorter length for ease of editing

Re: Health Checker questions

2008-12-11 Thread Walt Farrell
On Thu, 11 Dec 2008 16:54:41 +0100, R.S. <[EMAIL PROTECTED]> wrote: >I have some other questions about HC, but I fear to ask. You should never fear to ask, though of course you may not get an answer or may not like the answer you get. -- Walt -

Re: Health Checker questions

2008-12-11 Thread Walt Farrell
u need to do. HZSAIEOF does processing that IEFBR14 does not perform. You might or might not notice the difference in all cases, but there is one, and so you should do as the documentation directs in order to avoid potential problems. -- Walt Farrell, CISSP IBM STSM, z/OS Sec

Re: EKM, JAVA and Tape Encryption

2008-12-08 Thread Walt Farrell
On Mon, 8 Dec 2008 11:23:59 -0500, Lizette Koehler <[EMAIL PROTECTED]> wrote: >I am trying to setup my EMK Profile for JAVA. I keep getting errors on teh Audit. statements. Mostly FSUM7351 not Found. >Java is mounted (J1.5), EKM paths are mounted. Not sure what is missing. As always, seeing t

CICSPlex SM Tool REXX Function Package (was: No Subject)

2008-12-05 Thread Walt Farrell
e table you would assemble it and linkedit it into the appropriate library. Note that for use in a UNIX shell environment you'll probably need to set the STEPLIB environment variable if you're using the STEPLIB approach. If you were using batch or TSO/E you'd need a STEPLIB or JOB

Re: Clist question

2008-12-04 Thread Walt Farrell
F command output, and REXX is much better at non-positional parsing of data. Even then you can have problems, because we do not consider the command output to be a programming interface, and it can change unexpectedly, but it's safer to use REXX. -- Walt Farrell, CISSP IBM STSM, z/OS S

Re: strange ICHRDSNT problem

2008-12-04 Thread Walt Farrell
On Thu, 4 Dec 2008 08:36:45 -0600, Arthur Gutowski <[EMAIL PROTECTED]> wrote: >On Wed, 3 Dec 2008 13:35:26 -0600, Walt Farrell <[EMAIL PROTECTED]> >wrote: > >>And by the way, we've made that processing more robust in z/OS R10 to try >>to avoid some of the p

Re: strange ICHRDSNT problem

2008-12-03 Thread Walt Farrell
quot;been successful". And by the way, we've made that processing more robust in z/OS R10 to try to avoid some of the problems we've seen from such incorrect parameters. But that won't help much until all the systems sharing a RACF database are at z/OS

Re: strange ICHRDSNT problem

2008-12-03 Thread Walt Farrell
PL, and if they're wrong you can end up destroying your RACF database (or some other system's RACF database). But perhaps you meant something else? -- Walt Farrell, CISSP IBM STSM, z/OS Security Design --

Re: EAL5 Certification for z10 Enterprise Class Server

2008-11-26 Thread Walt Farrell
On Wed, 26 Nov 2008 15:19:10 -0500, Anne & Lynn Wheeler <[EMAIL PROTECTED]> wrote: >The following message is a courtesy copy of an article >that has been posted to bit.listserv.ibm-main as well. > > >[EMAIL PROTECTED] (Walt Farrell) writes: >> But personally, I

Re: EAL5 Certification for z10 Enterprise Class Server

2008-11-26 Thread Walt Farrell
On Wed, 26 Nov 2008 10:54:14 -0500, Gabriel Tully <[EMAIL PROTECTED]> wrote: >On Wed, Nov 26, 2008 at 9:51 AM, Jim Marshall <[EMAIL PROTECTED]> wrote: >> Interesting for those a fancy for security. >> >> The IBM System z10 Enterprise Class (z10 EC) now joins previous IBM >> mainframes as the world

Re: S328 and EXTRACT

2008-11-25 Thread Walt Farrell
calling EXTRACT >FIELDS=COMM,MF=(E,EXTRACT) to get the communication area returned. Sounds to me like you did not properly initialze your data area named EXTRACT, which must contain a properly constructed MF=L form of the EXTRACT macro. -- Walt Farrell, CISSP IBM STSM, z/

Re: Merging systems into a sysplex. RACF problem

2008-11-25 Thread Walt Farrell
ed. And it can leave you with problems if you misconfigure a sysplex-aware application to share work across multiple instances of itself and they someday end up running with different security databases. Nothing in the system can save you from such misconfiguration, and so it means you have a l

Re: Merging systems into a sysplex. RACF problem

2008-11-24 Thread Walt Farrell
On Mon, 24 Nov 2008 06:56:34 -0600, Jorge Garcia <[EMAIL PROTECTED]> wrote: > I should put 1001 in the bit for disable the sysplex comunication. Is it >right?. Either X'80' or X'81' would work, as documented. -- Walt Farrell, CISSP

Re: TSO Logon Screen problem - Nomail Nonotices

2008-11-24 Thread Walt Farrell
at case, logoff on another system could update TUPT on another system, if you've enabled that processing in RRSF. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design -- For IBM-MAIN subscribe / signoff / archive acces

Re: Merging systems into a sysplex. RACF problem

2008-11-24 Thread Walt Farrell
cumented, all systems in RACF Sysplex Communication must use the identical set of databases and range table. I would recommend either leaving the sysplexes separated, or making the effort to merge the databases. -- Walt Farrell, C

Re: Merging systems into a sysplex. RACF problem

2008-11-24 Thread Walt Farrell
in the sysplex. I hope this new system and the old systems in that sysplex use different database names, by the way. If they don't, this is the ideal time to rename the new databases to avoid possible problems. -- Walt Farrell, CISSP IBM STSM, z/OS Security Design --

Re: z/OS upgrade

2008-11-21 Thread Walt Farrell
On Fri, 21 Nov 2008 12:46:14 -0500, Veilleux, Jon L <[EMAIL PROTECTED]> wrote: >Wayne, I ran a test on both z/OS 1.9 and z/OS 1.10 using the following code and on 1.9 the area was initialized to zeroes and on 1.10 it wasn't: > > L R6,=F'1000' > GETMAIN R,LV=(6) > LTR

Re: searching all members of a pds using wildcards

2008-11-19 Thread Walt Farrell
On Wed, 19 Nov 2008 09:07:57 +, Jim McAlpine <[EMAIL PROTECTED]> wrote: >On Tue, Nov 18, 2008 at 3:42 PM, Jim McAlpine <[EMAIL PROTECTED]>wrote: > >> Is there any way to achieve the above ie to search for 'abc*xyx' where * >> can be any length in all members of a pds. >> >> Jim McAlpine >> > >

<    1   2   3   4   5   6   7   8   9   >