Re: How to Get UserID in non-TSO REXX

[Seymour J Metz]

There are lots of poster children for poor security policies.  Assigning two 
different userids to the same UID, two different groups to the same GID or two 
users to the same userid doesn't begin to exhaust poor policy, and I'm not sure 
how many poor practices RACF can prevent without pushback from customers.


--
Shmuel (Seymour J.) Metz
http://mason.gmu.edu/~smetz3


From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf of 
Paul Gilmartin [000433f07816-dmarc-requ...@listserv.ua.edu]
Sent: Wednesday, February 16, 2022 4:48 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: How to Get UserID in non-TSO REXX

On Wed, 16 Feb 2022 21:25:23 +, Seymour J Metz wrote:

>It would definitely be more fun if two different users had the same UID.
>
RACF should prohibit that.

That's what group IDs are for.

That's what BPX.SUPERUSER  is for.

What if two different users had the same TSO ID?
(It's done; security admins [should] disparage it.)

You can write Assembler in any language.  Then you have
the delight of re-coding for each target platform.

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: [EXTERNAL] Re: How to Get UserID in non-TSO REXX

[Wayne Bickerdike]

works fine for the much neglected REXX/CICS too.

REXX/CICS also has online help:

14.3.50  USERID

___



++
|
  |
|
>>--USERID()>< |
|
  |
++


returns the CICS signon user ID if the user is signed onto CICS or the
CICS
region default user ID (if one was specified by the CICS systems
programmer).
User IDs are padded on the right with blanks so that the returned value is

always eight bytes long.



Here is an example:



USERID()->'ARTHUR' /* Maybe */



When I gave a presentation at Share in 2019, some people thought it was
*NEW*.


On Thu, Feb 17, 2022 at 10:38 AM Charles Mills  wrote:

> If you are subject to PCI DSS then you have PCI DSS audits (and no, I am
> not an expert on the details).
>
> Like any other audit standard -- maybe they catch you and maybe they don't.
>
> My *perception* is that the standard is aimed at a situation you may have
> seen: a retail store or similar that has some sort of management software
> and for reasons of laziness, ignorance or limited licensed seats every
> clerk is using the same login.
>
> RACF userids don't cost anything -- why would you not create one (or more)
> for each user? I suppose there are ISV products that are licensed by the
> named seat.
>
> Charles
>
>
> -Original Message-
> From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
> Behalf Of Pommier, Rex
> Sent: Wednesday, February 16, 2022 2:41 PM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Re: [EXTERNAL] Re: How to Get UserID in non-TSO REXX
>
> It probably is but PCI DSS is a standard.  How does one electronically
> enforce it?  My security team can have everybody sign a statement saying
> they won't share their ID/password with their buddy at the next desk but
> that won't physically stop them.
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>


-- 
Wayne V. Bickerdike

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: [EXTERNAL] Re: How to Get UserID in non-TSO REXX

[Charles Mills]

If you are subject to PCI DSS then you have PCI DSS audits (and no, I am not an 
expert on the details).

Like any other audit standard -- maybe they catch you and maybe they don't.

My *perception* is that the standard is aimed at a situation you may have seen: 
a retail store or similar that has some sort of management software and for 
reasons of laziness, ignorance or limited licensed seats every clerk is using 
the same login.

RACF userids don't cost anything -- why would you not create one (or more) for 
each user? I suppose there are ISV products that are licensed by the named seat.

Charles


-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of Pommier, Rex
Sent: Wednesday, February 16, 2022 2:41 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: [EXTERNAL] Re: How to Get UserID in non-TSO REXX

It probably is but PCI DSS is a standard.  How does one electronically enforce 
it?  My security team can have everybody sign a statement saying they won't 
share their ID/password with their buddy at the next desk but that won't 
physically stop them.  

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: [EXTERNAL] Re: How to Get UserID in non-TSO REXX

[Pommier, Rex]

It probably is but PCI DSS is a standard.  How does one electronically enforce 
it?  My security team can have everybody sign a statement saying they won't 
share their ID/password with their buddy at the next desk but that won't 
physically stop them.  

Rex

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Charles Mills
Sent: Wednesday, February 16, 2022 4:34 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: [EXTERNAL] Re: How to Get UserID in non-TSO REXX

Prohibited by PCI DSS, is it not?

Charles


-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of Bob Bridges
Sent: Wednesday, February 16, 2022 2:32 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: How to Get UserID in non-TSO REXX

Two ~humans~ can use the same ID.  But RACF cannot prohibit that, for RACF can 
never know it.

For most purposes the security folks should prohibit it, if they're allowed to. 
 But I suppose there may be cases where it's not the worst thing in the 
world...very ~rare~ cases.

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
The information contained in this message is confidential, protected from 
disclosure and may be legally privileged. If the reader of this message is not 
the intended recipient or an employee or agent responsible for delivering this 
message to the intended recipient, you are hereby notified that any disclosure, 
distribution, copying, or any action taken or action omitted in reliance on it, 
is strictly prohibited and may be unlawful. If you have received this 
communication in error, please notify us immediately by replying to this 
message and destroy the material in its entirety, whether in electronic or hard 
copy format. Thank you.


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Charles Mills]

Prohibited by PCI DSS, is it not?

Charles


-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of Bob Bridges
Sent: Wednesday, February 16, 2022 2:32 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: How to Get UserID in non-TSO REXX

Two ~humans~ can use the same ID.  But RACF cannot prohibit that, for RACF can 
never know it.

For most purposes the security folks should prohibit it, if they're allowed to. 
 But I suppose there may be cases where it's not the worst thing in the 
world...very ~rare~ cases.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Bob Bridges]

Two ~humans~ can use the same ID.  But RACF cannot prohibit that, for RACF can 
never know it.

For most purposes the security folks should prohibit it, if they're allowed to. 
 But I suppose there may be cases where it's not the worst thing in the 
world...very ~rare~ cases.

---
Bob Bridges, robhbrid...@gmail.com, cell 336 382-7313

/* If you wish information and improvement from the knowledge of others, and 
yet at the same time express yourself as firmly fix'd in your present opinions, 
modest, sensible men, who do not love disputation, will probably leave you 
undisturbed in the possession of your error.  -Benjamin Franklin, autobiography 
*/

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Paul Gilmartin
Sent: Wednesday, February 16, 2022 16:48

RACF should prohibit that.

That's what group IDs are for.
 
That's what BPX.SUPERUSER  is for.

What if two different users had the same TSO ID?
(It's done; security admins [should] disparage it.)

--- On Wed, 16 Feb 2022 21:25:23 +, Seymour J Metz wrote:
>It would definitely be more fun if two different users had the same UID.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Steve Smith]

Ooops.  OK, I have no excuse.  I just missed it.

Thank-you to all who provided answers.

sas

On Wed, Feb 16, 2022 at 4:48 PM Seymour J Metz  wrote:

> REXX is packaged with TSO/E even though there are non-TSO environments,
> and the USERID() function is listed in the section on built-in functions,
> not in TSO/E external functions. SYSVAR(SYSUID) is only for TSO.
>
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Seymour J Metz]

REXX is packaged with TSO/E even though there are non-TSO environments, and the 
USERID() function is listed in the section on built-in functions, not in TSO/E 
external functions. SYSVAR(SYSUID) is only for TSO.


From: IBM Mainframe Discussion List  on behalf of 
Steve Smith 
Sent: Wednesday, February 16, 2022 4:30 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: How to Get UserID in non-TSO REXX

Well, I do RTFM, but I haven't yet managed to read every chapter of every
manual.  I missed the USERID() function; probably because I need a non-TSO
function, so I didn't scrutinize the TSO list (and I may have assumed that
since it was provided by SYSVAR, looking for a different way to do it on
that list wasn't all that likely to be fruitful).

As it happens, the exec in question can use the getlogin command, as it
uses the SYSCALLS environment for other reasons.  But userid() is the best
answer to my question.

I'm willing to use CB-chasing in REXX, but only if there's no other
reasonable way.

sas


On Wed, Feb 16, 2022 at 4:02 PM Charles Mills  wrote:

> I plead guilty. I did not have the docs in front of me. I do not have
> memorized what is TSO-only and what is not. He implied there was no
> function available so I pitched in to help.
>
> Feel free to ignore my advice. 
>
> Charles
>
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Paul Gilmartin]

On Wed, 16 Feb 2022 21:25:23 +, Seymour J Metz wrote:

>It would definitely be more fun if two different users had the same UID.
>
RACF should prohibit that.

That's what group IDs are for.
 
That's what BPX.SUPERUSER  is for.

What if two different users had the same TSO ID?
(It's done; security admins [should] disparage it.)

You can write Assembler in any language.  Then you have
the delight of re-coding for each target platform.

-- 
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Steve Smith]

Well, I do RTFM, but I haven't yet managed to read every chapter of every
manual.  I missed the USERID() function; probably because I need a non-TSO
function, so I didn't scrutinize the TSO list (and I may have assumed that
since it was provided by SYSVAR, looking for a different way to do it on
that list wasn't all that likely to be fruitful).

As it happens, the exec in question can use the getlogin command, as it
uses the SYSCALLS environment for other reasons.  But userid() is the best
answer to my question.

I'm willing to use CB-chasing in REXX, but only if there's no other
reasonable way.

sas


On Wed, Feb 16, 2022 at 4:02 PM Charles Mills  wrote:

> I plead guilty. I did not have the docs in front of me. I do not have
> memorized what is TSO-only and what is not. He implied there was no
> function available so I pitched in to help.
>
> Feel free to ignore my advice. 
>
> Charles
>
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Seymour J Metz]

It would definitely be more fun if two different users had the same UID.


--
Shmuel (Seymour J.) Metz
http://mason.gmu.edu/~smetz3


From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf of 
Paul Gilmartin [000433f07816-dmarc-requ...@listserv.ua.edu]
Sent: Wednesday, February 16, 2022 3:51 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: How to Get UserID in non-TSO REXX

On Wed, 16 Feb 2022 12:42:13 -0800, Ed Jaffe wrote:

>On 2/16/2022 11:11 AM, Steve Smith wrote:
>> Is there any way to obtain the userid (user name) in REXX running in a
>> non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
>> System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
>> that I think I can't be the first one to need this.
>
>Did you try userid = USERID()
>?
>
Awww... you spoiled it!  Wouldn't this bee more fun?:
CALL SYSCALLS 'ON'
ADDRES SYSCALL
'getuid'
'getpwuid' RETVAL 'PW.'
USER = PW.PW_NAME

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Charles Mills]

I plead guilty. I did not have the docs in front of me. I do not have memorized 
what is TSO-only and what is not. He implied there was no function available so 
I pitched in to help.

Feel free to ignore my advice. 

Charles


-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of Paul Gilmartin
Sent: Wednesday, February 16, 2022 12:25 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: How to Get UserID in non-TSO REXX

On Wed, 16 Feb 2022 14:11:06 -0500, Steve Smith  wrote:

>Is there any way to obtain the userid (user name) in REXX running in a
>non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
>System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
>that I think I can't be the first one to need this.
>
Errr... <https://www.ibm.com/docs/en/zos/2.5.0?topic=functions-userid>
(GIYF)

Why do so many mainframe programmers try to do things the hardest
way, such as chaining through control blocks?

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Paul Gilmartin]

On Wed, 16 Feb 2022 12:42:13 -0800, Ed Jaffe wrote:

>On 2/16/2022 11:11 AM, Steve Smith wrote:
>> Is there any way to obtain the userid (user name) in REXX running in a
>> non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
>> System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
>> that I think I can't be the first one to need this.
>
>Did you try userid = USERID()
>?
>
Awww... you spoiled it!  Wouldn't this bee more fun?:
CALL SYSCALLS 'ON'
ADDRES SYSCALL
'getuid'
'getpwuid' RETVAL 'PW.'
USER = PW.PW_NAME

-- 
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Seymour J Metz]

Because they didn't RTFM. Which leaves the question of why they didn't read it.


--
Shmuel (Seymour J.) Metz
http://mason.gmu.edu/~smetz3


From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf of 
Paul Gilmartin [000433f07816-dmarc-requ...@listserv.ua.edu]
Sent: Wednesday, February 16, 2022 3:24 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: How to Get UserID in non-TSO REXX

On Wed, 16 Feb 2022 14:11:06 -0500, Steve Smith  wrote:

>Is there any way to obtain the userid (user name) in REXX running in a
>non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
>System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
>that I think I can't be the first one to need this.
>
Errr... <https://www.ibm.com/docs/en/zos/2.5.0?topic=functions-userid>
(GIYF)

Why do so many mainframe programmers try to do things the hardest
way, such as chaining through control blocks?

--
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Ed Jaffe]

On 2/16/2022 11:11 AM, Steve Smith wrote:

Is there any way to obtain the userid (user name) in REXX running in a
non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
that I think I can't be the first one to need this.


Did you try userid = USERID()

?

--
Phoenix Software International
Edward E. Jaffe
831 Parkview Drive North
El Segundo, CA 90245
https://www.phoenixsoftware.com/



This e-mail message, including any attachments, appended messages and the
information contained therein, is for the sole use of the intended
recipient(s). If you are not an intended recipient or have otherwise
received this email message in error, any use, dissemination, distribution,
review, storage or copying of this e-mail message and the information
contained therein is strictly prohibited. If you are not an intended
recipient, please contact the sender by reply e-mail and destroy all copies
of this email message and do not otherwise utilize or retain this email
message or any or all of the information contained therein. Although this
email message and any attachments or appended messages are believed to be
free of any virus or other defect that might affect any computer system into
which it is received and opened, it is the responsibility of the recipient
to ensure that it is virus free and no responsibility is accepted by the
sender for any loss or damage arising in any way from its opening or use.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Paul Gilmartin]

On Wed, 16 Feb 2022 14:11:06 -0500, Steve Smith  wrote:

>Is there any way to obtain the userid (user name) in REXX running in a
>non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
>System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
>that I think I can't be the first one to need this.
>
Errr... 
(GIYF)

Why do so many mainframe programmers try to do things the hardest
way, such as chaining through control blocks?

-- 
gil

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Mike Shaw]

This assembler sequence does it by capturing the 8-byte TSO/E userid from
the JSAB; you could use the REXX STORAGE function to do the same:

L R15,PSAAOLDGet A(my ASCB)
L R15,ASCBASSB-ASCB(,R15) Get A(my ASSB)
L R15,ASSBJSAB-ASSB(,R15) Get A(JSAB)
MVC   PRODQUAL,JSABUSID-JSAB(,R15) Save userid

Mike Shaw
MVS/QuickRef Support Group
Chicago-Soft, Ltd.


On Wed, Feb 16, 2022 at 2:11 PM Steve Smith  wrote:

> Is there any way to obtain the userid (user name) in REXX running in a
> non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
> System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
> that I think I can't be the first one to need this.
>
> --
> sas
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Charles Mills]

Well you can certainly run the chain to the ACEE. I can post the code if you 
need.

Keep in mind that not all running processes have an ACEE.

Also userid and user name are different things (but they're both in the ACEE). 

And the ACEE is common enough for this purpose across RACF, ACF2 and TSS.

Charles


-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf 
Of Steve Smith
Sent: Wednesday, February 16, 2022 11:11 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: How to Get UserID in non-TSO REXX

Is there any way to obtain the userid (user name) in REXX running in a
non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
that I think I can't be the first one to need this.

-- 
sas

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Get UserID in non-TSO REXX

[Itschak Mugzach]

If you run under system Rexx you can access the ACEE using storage function
calls as it is an authorised environment.

בתאריך יום ד׳, 16 בפבר׳ 2022 ב-21:11 מאת Steve Smith :

> Is there any way to obtain the userid (user name) in REXX running in a
> non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
> System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
> that I think I can't be the first one to need this.
>
> --
> sas
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
-- 

*| **Itschak Mugzach | Director | SecuriTeam Software **|** IronSphere
Platform* *|* *Information Security Continuous Monitoring for Z/OS, zLinux
and IBM I **|  *

*|* *Email**: i_mugz...@securiteam.co.il **|* *Mob**: +972 522 986404 **|*
*Skype**: ItschakMugzach **|* *Web**: www.Securiteam.co.il  **|*

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

How to Get UserID in non-TSO REXX

[Steve Smith]

Is there any way to obtain the userid (user name) in REXX running in a
non-TSO environment?  I know that sysvar does not work in USS, IRXJCL, or
System REXX TSO=NO.  Whereas mvsvar does (go figure).  It's so fundamental
that I think I can't be the first one to need this.

-- 
sas

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN