On Mon, 9 Sep 2019 at 21:15, Bob Bridges <robhbrid...@gmail.com> wrote: > > Ok, but the only way to submit a job via SYSOUT=(A,INTRDR) is to have TSO in > the first place, right? What I'm asking is how users might submit batch who > ~don't~ have TSO.
TSO isn't magic. Any running z/OS process (loosely speaking - not necessarily a UNIX process) can Dynalloc an Intrdr and write a jobstream to it. If a malicious user can convince anything that's running, or that s/he can cause to run, to Dynalloc and submit, then the job's done (and so are you). Some examples that have Dynalloc/submit capability already coded or trivially scripted are, as mentioned, FTP, a UNIX shell (via telnet or ssh). Do you know what's listening on every TCP port on your system, and what it does? What web servers are running, and what logon controls they have? And so on. As I type I see that Rick Williams has responded similarly. Going outside z/OS, do you have NJE over TCP/IP configured? What about ancient SNA not-quite-discontinued-yet connections to some other system? Remote RJE style print stations, running on an IBM i or an AIX box, maybe with a (virtual) card reader that can submit from a file on that box? And so on. Tony H. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
