On 12/9/10 3:27 AM, "Alan Altmark" <alan_altm...@us.ibm.com> wrote:
>In order to achieve the savings you imply, then z/VM must move to the >z/OS >model in which, except for a few specific functions, an ESM is required >for proper operation. NO native CP security controls beyone those >required to restore ESM control vis a vis SYS1.UADS in order to login to >TSO. Any function dependent on the ESM will be configured to DENY access >without the ESM. That is exactly what I'm arguing for. IF VM is going to play with the big boys in the enterprise market, it's a necessity to do this, and long overdue. >You would HAVE to buy an ESM, whether from IBM or CA. Or have IBM include a basic awful one (eg, RACF) in the price of VM and be done with it. Including a basic one that can be replaced with Something Else would make everybody (IMHO) happy. The internal cost of including RACF can't be that large. >And THAT will be acceptable only when folks wrap their heads around the >fact that z/VM systems WITHOUT an ESM will fail a modern security audit. >The primary example is the presence of unencrypted passwords in USER >DIRECT. Amen, brother. I think, however, the pressure will be on IBM to deliver/upgrade the base VM to a state that *can be* acceptable. Another area would be enabling SSL login by default (the setup process for SSLSERV is just a royal PITA). Setting the defaults for FTP to always negotiate SSL. Removing default read/write/multi pw from all system minidisks. Putting a decent backup tool in place. Removing the need for tape drives for spool management. Fixing printing in the default build to not require channel-attached printers. Etc, etc, etc,... There's a whole lot of things that would be a Very Good Idea to Do -- in fact, I'd say that would be a great task for user groups over the next year: write IBM a detailed report of What Needs To Be Done to VM Packaging to Make It Modern and World-Class. I think that would be *extremely* useful as 6.2 ramps up to delivery.
