Re: Encrypted dataset - any eye catcher?
Radoslaw, Apologies for my derelict statements below. Obviously I was suffering brain-fade. My first encounters with protected key processing are shown in this redbook. https://www.redbooks.ibm.com/abstracts/sg247848.html?Open There are examples there of using protected keys with the CSNBSYE service. My statement of the storage of the protected key itself was of course completely wrong. A good explanation of the mechanisms is shown in this redbook. https://www.redbooks.ibm.com/abstracts/sg248410.html in section 3.5.6. Regards, Lennie Lennie Dymoke-Bradshaw https://rsclweb.com ‘Dance like no one is watching. Encrypt like everyone is.’ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Lennie Dymoke-Bradshaw Sent: 10 June 2022 16:56 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Encrypted dataset - any eye catcher? I stand corrected. Lennie -Original Message- From: IBM Mainframe Discussion List On Behalf Of Eric D Rossman Sent: 10 June 2022 13:13 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Encrypted dataset - any eye catcher? The service used is CSNBKRR2 with rule PROTKEY (and rule BYPAUTH [older z/OSes] or DSENC [newer z/OSes]). It is in fetch-protected storage for use by PCC(PCC-Compute-XTS-Parameter-Using-Encrypted-AES-256) and KM(KM-XTS-Encrypted-AES-256). Eric Rossman, CISSP ICSF Cryptographic Security Development z/OS Enabling Technologies edros...@us.ibm.com -Original Message- From: IBM Mainframe Discussion List On Behalf Of Lennie Dymoke-Bradshaw Sent: Friday, June 10, 2022 8:05 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: [EXTERNAL] Re: Encrypted dataset - any eye catcher? Radoslaw, There is an ICSF call used during data set encryption which extracts the secure key from the CKDS and stores it in an encrypted form in "non-addressable" memory for use by the CPACF instructions (e.g. KMC) which process data using protected keys. That ICSF service (I think it is CSNBSYE with KEYIDENT in the rule-array ) uses the Crypto Express device. Lennie Dymoke-Bradshaw https://rsclweb.com ‘Dance like no one is watching. Encrypt like everyone is.’ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Radoslaw Skorupka Sent: 10 June 2022 12:08 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Encrypted dataset - any eye catcher? This is up to the user. IBM *strongly recommends* the key should be kept as secure. However for non-production environments it is possible to use Pervasive Encryption without CryptoExpress cards. It's fine that you don't have to buy yet another CEXC. BTW: Pervasive Encryption is never serviced by CryptoExpress cards and secure keys. Due to performance reasons it is serviced by CPACF and protected key. CryptoExpress CCA Coprocessor is needed only to keep the dataset key safe (encrypted using MK) in CKDS. Note: Protected key is neither secure key nor clear key. Technically it is not clear, but the way of protection the key is not certified by authorities and standards. -- Radoslaw Skorupka Lodz, Poland W dniu 09.06.2022 o 13:35, Lennie Dymoke-Bradshaw pisze: > I was under the impression that there is no technical requirement for the key > to be a secure key. So data encryption can be used with clear keys in the > CKDS when a Crypto Express is not available. > > Lennie Dymoke-Bradshaw > https://rsclweb.com > FaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=wEsRU4BkZTx52MkXPw-33mJ5knyu8ArPRIY8sH7 > icVs&m=cood93YS6XOkb7_jP41C1bDD0h0Y2c4Z7mDhgJy_1EAWvtIyvBZsIHNCEM1CNe4 > F&s=yMz-Hw18wFEl8Qx3vWaOjSNAj9qRcLG5b5iO3ElLSM0&e= > ‘Dance like no one is watching. Encrypt like everyone is.’ > > -Original Message- > From: IBM Mainframe Discussion List On > Behalf Of Mark Jacobs > Sent: 09 June 2022 01:48 > To: IBM-MAIN@LISTSERV.UA.EDU > Subject: Re: Encrypted dataset - any eye catcher? > > I found this in a 2017 IBM Security presentation. So it looks like it's > XTS-AES. > > Key label: 64-byte label of an existing key in the ICSF CKDS used for > access method encryption/decryption. Encryption type: AES-256 bit data > key (XTS, protected key). Note: AES-256 key must be generated as a > secure key (i.e. protected by crypto express AES Master Key) > > Mark Jacobs > > Sent from ProtonMail, Swiss-based encrypted email. > > GPG Public Key - > INVALID URI REMOVED > _pks_lookup-3Fop-3Dget-26search-3Dmarkjacobs-40protonmail.com&d=DwIFaQ > &c=jf_iaSHvJObTbx-siA1ZOg&r=wEsRU4BkZTx52MkXPw-33mJ5knyu8ArPRIY8sH7icV > s&m=cood93YS6XOkb7_jP41C1bDD0h0Y2c4Z7mDhgJy_1EAWvtIyvBZsIHNCEM1CNe4F&s > =-9NFjWxxeIVE7RkH2IVy24xn04vDWeq36ToscpBQAsg&e= > > > --- Original Message --- > On Wednesday, June 8th, 2022 at 8:38 PM, Phil Smith III > wrote: > > >> Radoslaw's question makes me ask a pure curiosity question: what AES >> mode is used by z/OS data set encryption? I Googled but all I found >> was "256-bit AES", which doesn't answer the question. >> >> >> -- For
Re: Restore DS8884 firmware without ibm support contract
In addition to the excellent points made by Timothy, you will have to do additional checks. It seems that this DS8K might have been used to sell off individual components as 'spares'. Does it still have the embedded HMC? What type of FICON adaptors does it have (SX or LX). From previous discussions your z114 has SX. The DS8K end also needs to be SX. Regards Parwez Hamid From: IBM Mainframe Discussion List on behalf of Enzo D'Amato Sent: 12 June 2022 22:58 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Restore DS8884 firmware without ibm support contract Hello. I am a high school student who has recently purchased a z114 mainframe (I have posted about the project before here). I have been working to find CKD storage for my machine, so that I can do a proper z/OS installation. I have an opportunity to acquire a DS8884 storage unit that I know has the licences required for mainframe attach. Unfortunately, the person who owns it it knows very little about the unit, and all of the drives have been removed. The owner claims that they have all of the CDs to do a full restore to factory settings, but they have not sent over pictures of the CDs. Is it really possible to fully restore one of these units with just disks? Additionally, if the disks aren't available, can the unit be restored without them? I am aware that getting the unit back up and running may take some work, but I am welling to put in the effort, as CKD storage is extremely difficult to find, but I don't want to embark on an impossible project. I would appreciate any information that you may have that could help me ensure that I can get the machine up and running before I commit to shipping it. Thank you, Enzo Damato? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: tape management from BMC
The tso/ispf one. I have not seen the zosmf one yet. Jack On Mon, Jun 13, 2022, 05:21 Timothy Sipples wrote: > Jack Zukt wrote: > >Between those three, I would say that rmm has an unfriendly user > interface, > >but I suppose that is just the IBM way. I really liked Control-M ease of > >use. CA1 was, and I am sure it still is, a great product, and the > >transition to Control-My was easy to do. The transition to rmm was more > >painful due to the user interface not being very intuitive. > > Which user interface? There are at least 3 of them, and one of them is > quite new. z/OS DFSMSrmm started offering a z/OS Management Facility > plug-in fairly recently, and it’s seen some improvements already. Here’s a > tour (circa July, 2020): > > https://www.ibm.com/support/pages/system/files/inline-files/edgdoc.pdf > > — — — — — > Timothy Sipples > Senior Architect > Digital Assets, Industry Solutions, and Cybersecurity > IBM zSystems/LinuxONE, Asia-Pacific > sipp...@sg.ibm.com > > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: dfsort -TASK I/O TABLE EXCEEDS TIOT LIMIT OF 0064K
What size volumes are you using? EAV might help you reduce the number of extents. -- Shmuel (Seymour J.) Metz http://mason.gmu.edu/~smetz3 From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf of Ron Thomas [ron5...@gmail.com] Sent: Saturday, June 11, 2022 12:14 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: dfsort -TASK I/O TABLE EXCEEDS TIOT LIMIT OF 0064K Hello - We are splitting a very large files in to 750 files dynamically based on key , which means if the key changes the file is moved to the respective ones we are getting the message STEPBB - TASK I/O TABLE EXCEEDS TIOT LIMIT OF 0064K STEPBB - STEP WAS NOT EXECUTED. and hence the step is not getting executed . File LRECL = 500 Key is from position 19,4. Here is the control card used SORT FIELDS=COPY OUTREC IFTHEN=(WHEN=GROUP,KEYBEGIN=(19,4),PUSH=(501:ID=3)) OUTFIL FNAMES=OUT001,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,001) OUTFIL FNAMES=OUT002,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,002) OUTFIL FNAMES=OUT003,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,003) OUTFIL FNAMES=OUT004,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,004) OUTFIL FNAMES=OUT005,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,005) OUTFIL FNAMES=OUT006,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,006) OUTFIL FNAMES=OUT007,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,007) OUTFIL FNAMES=OUT008,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,008) --- -- OUTFIL FNAMES=OUT749,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,749) OUTFIL FNAMES=OUT750,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,750) so could some let me know how to get this fixed ? of is there any other way we can build this one ? Regards Ron T -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: dfsort -TASK I/O TABLE EXCEEDS TIOT LIMIT OF 0064K
Hi, If by any chance your ACS routine is defining the dataset as multivolume, the additional entries in catalog, even if not used, will occupy a TIOT slot. Best Regards Ituriel do Nascimento Neto z/OS System Programmer Em segunda-feira, 13 de junho de 2022 09:32:12 BRT, Seymour J Metz escreveu: What size volumes are you using? EAV might help you reduce the number of extents. -- Shmuel (Seymour J.) Metz http://mason.gmu.edu/~smetz3 From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf of Ron Thomas [ron5...@gmail.com] Sent: Saturday, June 11, 2022 12:14 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: dfsort -TASK I/O TABLE EXCEEDS TIOT LIMIT OF 0064K Hello - We are splitting a very large files in to 750 files dynamically based on key , which means if the key changes the file is moved to the respective ones we are getting the message STEPBB - TASK I/O TABLE EXCEEDS TIOT LIMIT OF 0064K STEPBB - STEP WAS NOT EXECUTED. and hence the step is not getting executed . File LRECL = 500 Key is from position 19,4. Here is the control card used SORT FIELDS=COPY OUTREC IFTHEN=(WHEN=GROUP,KEYBEGIN=(19,4),PUSH=(501:ID=3)) OUTFIL FNAMES=OUT001,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,001) OUTFIL FNAMES=OUT002,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,002) OUTFIL FNAMES=OUT003,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,003) OUTFIL FNAMES=OUT004,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,004) OUTFIL FNAMES=OUT005,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,005) OUTFIL FNAMES=OUT006,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,006) OUTFIL FNAMES=OUT007,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,007) OUTFIL FNAMES=OUT008,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,008) --- -- OUTFIL FNAMES=OUT749,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,749) OUTFIL FNAMES=OUT750,BUILD=(1,500),INCLUDE=(501,3,ZD,EQ,750) so could some let me know how to get this fixed ? of is there any other way we can build this one ? Regards Ron T -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: tape management from BMC
In the past, the company i worked for used to have ControlT. Amazing product, with a very nice user interface Best Regards Ituriel do Nascimento Neto z/OS System Programmer Em segunda-feira, 13 de junho de 2022 08:54:57 BRT, Jack Zukt escreveu: The tso/ispf one. I have not seen the zosmf one yet. Jack On Mon, Jun 13, 2022, 05:21 Timothy Sipples wrote: > Jack Zukt wrote: > >Between those three, I would say that rmm has an unfriendly user > interface, > >but I suppose that is just the IBM way. I really liked Control-M ease of > >use. CA1 was, and I am sure it still is, a great product, and the > >transition to Control-My was easy to do. The transition to rmm was more > >painful due to the user interface not being very intuitive. > > Which user interface? There are at least 3 of them, and one of them is > quite new. z/OS DFSMSrmm started offering a z/OS Management Facility > plug-in fairly recently, and it’s seen some improvements already. Here’s a > tour (circa July, 2020): > > https://www.ibm.com/support/pages/system/files/inline-files/edgdoc.pdf > > — — — — — > Timothy Sipples > Senior Architect > Digital Assets, Industry Solutions, and Cybersecurity > IBM zSystems/LinuxONE, Asia-Pacific > sipp...@sg.ibm.com > > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Restore DS8884 firmware without ibm support contract
The unit still does have the two mini pc HMCs. I am not too concerned about the optics, as this can be fixed quite easily (either by putting a new card in the mainframe, or just hooking it up to a cheap ficon switch). I know that none of the components have been pulled, other than the drives, which were removed for data security reasons. The drives have been pulled from everything (disk shelves, power controllers, and possibly the HMCs). I will see if I can power it on/get someone to power it on. If it comes with the microcode CDs, can I restore these without the chaperone? Thank you, Enzo Damato From: IBM Mainframe Discussion List on behalf of P H Sent: Monday, June 13, 2022 5:34 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Restore DS8884 firmware without ibm support contract In addition to the excellent points made by Timothy, you will have to do additional checks. It seems that this DS8K might have been used to sell off individual components as 'spares'. Does it still have the embedded HMC? What type of FICON adaptors does it have (SX or LX). From previous discussions your z114 has SX. The DS8K end also needs to be SX. Regards Parwez Hamid From: IBM Mainframe Discussion List on behalf of Enzo D'Amato Sent: 12 June 2022 22:58 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Restore DS8884 firmware without ibm support contract Hello. I am a high school student who has recently purchased a z114 mainframe (I have posted about the project before here). I have been working to find CKD storage for my machine, so that I can do a proper z/OS installation. I have an opportunity to acquire a DS8884 storage unit that I know has the licences required for mainframe attach. Unfortunately, the person who owns it it knows very little about the unit, and all of the drives have been removed. The owner claims that they have all of the CDs to do a full restore to factory settings, but they have not sent over pictures of the CDs. Is it really possible to fully restore one of these units with just disks? Additionally, if the disks aren't available, can the unit be restored without them? I am aware that getting the unit back up and running may take some work, but I am welling to put in the effort, as CKD storage is extremely difficult to find, but I don't want to embark on an impossible project. I would appreciate any information that you may have that could help me ensure that I can get the machine up and running before I commit to shipping it. Thank you, Enzo Damato? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: ISPF WSA and ISPF Plugin for z/OSMF
On Mon, Jun 13, 2022 at 1:09 AM Seymour J Metz wrote: > Can you start to a new window as an alternative to a new tab? That was my > common use case for WSA. > No, not as far as I can tell. Tabs or splits only. > > Also, what is performance like? > It's OK, not as fast as TN3270. But I am accessing a machine on the opposite side of the globe from me. As for resource consumption, I haven't done any measurements, but z/OSMF is in general pretty piggish with CPU & memory. > > -- > Shmuel (Seymour J.) Metz > http://mason.gmu.edu/~smetz3 > > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Is there a service similar to TCTL so that a task can give control to another task?
Is there a service similar to TCTL so that a task can give control to another task? I guess I could schedule an SRB to do it but it would seem that there should be an easier way. -- Binyamin Dissen http://www.dissensoftware.com Director, Dissen Software, Bar & Grill - Israel -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
Back in the MVS days I might use ATTACH EP= (or EPLOC=) to set up the task. Or is the task ready running? Roops On Mon, 13 Jun 2022, 17:21 Binyamin Dissen, wrote: > Is there a service similar to TCTL so that a task can give control to > another > task? > > I guess I could schedule an SRB to do it but it would seem that there > should > be an easier way. > > -- > Binyamin Dissen > http://www.dissensoftware.com > > Director, Dissen Software, Bar & Grill - Israel > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: SDSF - ISPF questions (wishes?)
Ok.. did anyone consider using FTP to separate the files? You can do the 1,2,3,4,etc for the sysout and then rename each one? Which could be done in a uss script (yes.. I said it.) HTH, Rob On Thu, May 5, 2022 at 3:56 PM Rob Scott wrote: > Forgot to point out that the SDSF Rexx documentation is now in the SDSF > User Guide manual rather than the Operation and Customization Guide. > > Rob Scott > > From: IBM Mainframe Discussion List on behalf > of Paul Gilmartin <000433f07816-dmarc-requ...@listserv.ua.edu> > Sent: Thursday, May 5, 2022 6:13:12 PM > To: IBM-MAIN@LISTSERV.UA.EDU > Subject: Re: SDSF - ISPF questions (wishes?) > > EXTERNAL EMAIL > > > > > > On Thu, 5 May 2022 16:06:25 +, Rob Scott wrote: > >. ... > >ISFQUERY() provides the ability to detect if the current task is already > connected to SDSF and it can inherit the current session environment data. > > > I'm confused and very naive. Long ago I wrote a SDSF > API Rexx exec to extract spool files, based on (its comments): >See (strangely enough): > >Document Number SA22-7670-11 > >#12.0 "z/OS V1R10.0 SDSF Operation and Customization" > 12.0 Using SDSF with the REXX programming language > > Alas, that chapter appears not to exist in the current doc. > > It's agnostic: operating alike from UNIX shell, IRXJCL, > or as an Edit macro from the command line of an SDSF > display. In the last case it finds the job ID by parsing > ZSCREEN (Pedro Vera's suggestion -- is there a better > way?) > > It uses ISFCALLS(ON) but no ISFCALLS(OFF) (should > I expect something bad on that account?) > > Lots of ADDRESS SDSF; no ISFQUERY() nor > CONNECT. Am I missing out on much? Is this running > "under SDSF" or otherwise? > > -- > gil > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > > > > Rocket Software, Inc. and subsidiaries ? 77 Fourth Avenue, Waltham MA > 02451 ? Main Office Toll Free Number: +1 855.577.4323 > Contact Customer Support: > https://my.rocketsoftware.com/RocketCommunity/RCEmailSupport > Unsubscribe from Marketing Messages/Manage Your Subscription Preferences - > http://www.rocketsoftware.com/manage-your-email-preferences > Privacy Policy - > http://www.rocketsoftware.com/company/legal/privacy-policy > > > This communication and any attachments may contain confidential > information of Rocket Software, Inc. All unauthorized use, disclosure or > distribution is prohibited. If you are not the intended recipient, please > notify Rocket Software immediately and destroy all copies of this > communication. Thank you. > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
z/OSMF Rollout
We're looking to rollout a z/OSMF 2.4 configuration from our test environment to our user-acceptance environment. Hoping to not have to start from scratch. Just wondering if anyone had any rules-of-thumb, procedures, or advice in general for rolling it into an n'th environment while changing only what is required for the new environment. Does it make sense to try to employ the Software Deployment component? Any advice greatly appreciated! Thanks in Advance, Brian. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
I don't know if one can count on the ATTACHed task getting control before the ATTACH completes. I am trying to directly pass control to a ready enabled task (from the task that did a POST). On Mon, 13 Jun 2022 19:05:50 +0100 Rupert Reynolds wrote: :>Back in the MVS days I might use ATTACH EP= (or EPLOC=) to set up the task. :>Or is the task ready running? :>Roops :>On Mon, 13 Jun 2022, 17:21 Binyamin Dissen, :>wrote: :>> Is there a service similar to TCTL so that a task can give control to :>> another :>> task? :>> I guess I could schedule an SRB to do it but it would seem that there :>> should :>> be an easier way. -- Binyamin Dissen http://www.dissensoftware.com Director, Dissen Software, Bar & Grill - Israel -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
mainframe CPU swap
Hello Good morning to all Due to a business reason we are swapping our mainframer sites where the current DR machine will be converted to production and Production machine will be a DR site. I understand these exercise are mostly done by the IBM CE from support element. Is there anything to be watched out from z/OS perspective and what are the other gotchas ? Appreciate if you could share your thoughts on this and would like to hear if someone has done his similar in your Shop Jake -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
On Mon, 13 Jun 2022 at 14:59, Binyamin Dissen wrote: > > I don't know if one can count on the ATTACHed task getting control before the > ATTACH completes. I'm sure you can't. Even if it, in theory, has control, how it gets dispatched is surely not part of the specification. > I am trying to directly pass control to a ready enabled task (from the task > that did a POST). Isn't that CALLDISP? Tony H. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
On 6/13/2022 9:21 AM, Binyamin Dissen wrote: Is there a service similar to TCTL so that a task can give control to another task? We wrote our own. If you issue this internal macro (let's call it SUBTASK), the next instruction after the macro is running in a subtask. If you issue SUBTASK again, the next instruction is back in the original task. We have a similar macro to pass control to an enclave SRB and back. In our case, it's intended to be used like a subroutine call -- the macro calls must appear in pairs -- so it's not quite as general-purpose as TCTL, but I'm sure than can be done too... . . main-task code . SUBTASK TCB=tcbaddr . . subtask code . SUBTASK , . . resume main-task code . -- Phoenix Software International Edward E. Jaffe 831 Parkview Drive North El Segundo, CA 90245 https://www.phoenixsoftware.com/ This e-mail message, including any attachments, appended messages and the information contained therein, is for the sole use of the intended recipient(s). If you are not an intended recipient or have otherwise received this email message in error, any use, dissemination, distribution, review, storage or copying of this e-mail message and the information contained therein is strictly prohibited. If you are not an intended recipient, please contact the sender by reply e-mail and destroy all copies of this email message and do not otherwise utilize or retain this email message or any or all of the information contained therein. Although this email message and any attachments or appended messages are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by the sender for any loss or damage arising in any way from its opening or use. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Encrypted dataset - any eye catcher?
Lennie, No problem, nobody's perfect, even Jack Lemmon. ;-) I always appreciated your input. Please, continue. Regards -- Radoslaw Skorupka Lodz, Poland W dniu 13.06.2022 o 10:35, Lennie Dymoke-Bradshaw pisze: Radoslaw, Apologies for my derelict statements below. Obviously I was suffering brain-fade. My first encounters with protected key processing are shown in this redbook. https://www.redbooks.ibm.com/abstracts/sg247848.html?Open There are examples there of using protected keys with the CSNBSYE service. My statement of the storage of the protected key itself was of course completely wrong. A good explanation of the mechanisms is shown in this redbook. https://www.redbooks.ibm.com/abstracts/sg248410.html in section 3.5.6. Regards, Lennie Lennie Dymoke-Bradshaw https://rsclweb.com ‘Dance like no one is watching. Encrypt like everyone is.’ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Lennie Dymoke-Bradshaw Sent: 10 June 2022 16:56 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Encrypted dataset - any eye catcher? I stand corrected. Lennie -Original Message- From: IBM Mainframe Discussion List On Behalf Of Eric D Rossman Sent: 10 June 2022 13:13 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Encrypted dataset - any eye catcher? The service used is CSNBKRR2 with rule PROTKEY (and rule BYPAUTH [older z/OSes] or DSENC [newer z/OSes]). It is in fetch-protected storage for use by PCC(PCC-Compute-XTS-Parameter-Using-Encrypted-AES-256) and KM(KM-XTS-Encrypted-AES-256). Eric Rossman, CISSP ICSF Cryptographic Security Development z/OS Enabling Technologies edros...@us.ibm.com -Original Message- From: IBM Mainframe Discussion List On Behalf Of Lennie Dymoke-Bradshaw Sent: Friday, June 10, 2022 8:05 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: [EXTERNAL] Re: Encrypted dataset - any eye catcher? Radoslaw, There is an ICSF call used during data set encryption which extracts the secure key from the CKDS and stores it in an encrypted form in "non-addressable" memory for use by the CPACF instructions (e.g. KMC) which process data using protected keys. That ICSF service (I think it is CSNBSYE with KEYIDENT in the rule-array ) uses the Crypto Express device. Lennie Dymoke-Bradshaw https://rsclweb.com ‘Dance like no one is watching. Encrypt like everyone is.’ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Radoslaw Skorupka Sent: 10 June 2022 12:08 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Encrypted dataset - any eye catcher? This is up to the user. IBM *strongly recommends* the key should be kept as secure. However for non-production environments it is possible to use Pervasive Encryption without CryptoExpress cards. It's fine that you don't have to buy yet another CEXC. BTW: Pervasive Encryption is never serviced by CryptoExpress cards and secure keys. Due to performance reasons it is serviced by CPACF and protected key. CryptoExpress CCA Coprocessor is needed only to keep the dataset key safe (encrypted using MK) in CKDS. Note: Protected key is neither secure key nor clear key. Technically it is not clear, but the way of protection the key is not certified by authorities and standards. -- Radoslaw Skorupka Lodz, Poland W dniu 09.06.2022 o 13:35, Lennie Dymoke-Bradshaw pisze: I was under the impression that there is no technical requirement for the key to be a secure key. So data encryption can be used with clear keys in the CKDS when a Crypto Express is not available. Lennie Dymoke-Bradshaw https://rsclweb.com FaQ&c=jf_iaSHvJObTbx-siA1ZOg&r=wEsRU4BkZTx52MkXPw-33mJ5knyu8ArPRIY8sH7 icVs&m=cood93YS6XOkb7_jP41C1bDD0h0Y2c4Z7mDhgJy_1EAWvtIyvBZsIHNCEM1CNe4 F&s=yMz-Hw18wFEl8Qx3vWaOjSNAj9qRcLG5b5iO3ElLSM0&e= ‘Dance like no one is watching. Encrypt like everyone is.’ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Mark Jacobs Sent: 09 June 2022 01:48 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Encrypted dataset - any eye catcher? I found this in a 2017 IBM Security presentation. So it looks like it's XTS-AES. Key label: 64-byte label of an existing key in the ICSF CKDS used for access method encryption/decryption. Encryption type: AES-256 bit data key (XTS, protected key). Note: AES-256 key must be generated as a secure key (i.e. protected by crypto express AES Master Key) Mark Jacobs Sent from ProtonMail, Swiss-based encrypted email. GPG Public Key - INVALID URI REMOVED _pks_lookup-3Fop-3Dget-26search-3Dmarkjacobs-40protonmail.com&d=DwIFaQ &c=jf_iaSHvJObTbx-siA1ZOg&r=wEsRU4BkZTx52MkXPw-33mJ5knyu8ArPRIY8sH7icV s&m=cood93YS6XOkb7_jP41C1bDD0h0Y2c4Z7mDhgJy_1EAWvtIyvBZsIHNCEM1CNe4F&s =-9NFjWxxeIVE7RkH2IVy24xn04vDWeq36ToscpBQAsg&e= --- Original Message --- On Wednesday, June 8th, 2022 at 8:38 PM, Phil Smith III wrote: Radoslaw's question makes me ask a pure curiosity question: what AES mode is used by z/OS data set encryption? I Googled but all I found was "256-bit AES
DB2 and RACF entities
The following scenario: DB2 v12 using pre-RACF (GRANT/REVOKE) security. Of course userids and groupids are taken from RACF. There are several groups which are candidates to delete as they look as not needed. However some of them have DB2 GRANTs, so those groups should not be deleted. So far, so good. Unfortunately some group was deleted, despite it was used by DB2. I don't know details, but AFAIK probably it was something related to SET SQL ID or so. Q: is there any method to find out *all* RACF users and groups used for any authorisation in DB2? -- Radoslaw Skorupka Lodz, Poland -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: mainframe CPU swap
Once you decide you can't fail back to old production, be sure to establish the new PPRC direction. If you IPL on the new dasd before setting up the PPRC you'll have to copy the new primaries back. If you swap before IPL at the new production site then you don't have to copy the new primaries to secondaries. On Mon, Jun 13, 2022 at 2:24 PM Jake Anderson wrote: > > Hello > > Good morning to all > > Due to a business reason we are swapping our mainframer sites where the > current DR machine will be converted to production and Production machine > will be a DR site. I understand these exercise are mostly done by the IBM > CE from support element. Is there anything to be watched out from z/OS > perspective and what are the other gotchas ? > > Appreciate if you could share your thoughts on this and would like to hear > if someone has done his similar in your Shop > > Jake > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- Mike A Schwab, Springfield IL USA Where do Forest Rangers go to get away from it all? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
You can't count on anything like that. Each task competes. But if the task is already set up, my question is more like "What's stopping it from running already?" I don't think I'm getting how you want these tasks to work together. I'll carry on regardless:- If the other task already has all it needs to run, it'll run when resources allow. If not, to wake it up just give it the thing it's waiting for (pop the ECB it waits on, or whatever). There were a few hairy situations in MVS, where one service (was it POST or WAIT? Hazy memory) would effectively exit through the scheduler, but I wouldn't generally recommend that! Frequently, the best thing is to exit, or wait for the other task (as appropriate) because the sooner one task quits or tells the OS it's waiting, the sooner the next TCB gets a chance to run. As I said, I'm not seeing the bigger picture. Roops On Mon, 13 Jun 2022, 19:58 Binyamin Dissen, wrote: > I don't know if one can count on the ATTACHed task getting control before > the > ATTACH completes. > > I am trying to directly pass control to a ready enabled task (from the task > that did a POST). > > On Mon, 13 Jun 2022 19:05:50 +0100 Rupert Reynolds > wrote: > > :>Back in the MVS days I might use ATTACH EP= (or EPLOC=) to set up the > task. > > :>Or is the task ready running? > > :>Roops > > :>On Mon, 13 Jun 2022, 17:21 Binyamin Dissen, > :>wrote: > > :>> Is there a service similar to TCTL so that a task can give control to > :>> another > :>> task? > > :>> I guess I could schedule an SRB to do it but it would seem that there > :>> should > :>> be an easier way. > > -- > Binyamin Dissen > http://www.dissensoftware.com > > Director, Dissen Software, Bar & Grill - Israel > > -- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN > -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Rexx generic compare
The TSS manual (v15) says it starts by looking for, simply, the longest resource name: /* Quote begins */ To determine the longest resource name, each character in the resource name counts as one character whether it is a normal character or a masking character. If the floating mask “-“ is used in a PERMIT, only count the characters prior to the mask. The following table contains examples of how to count characters: For ResourceNumber of Characters Counted SMITH.TEST.JCL 14, all characters are counted JONES.*.JCL 11, all characters are counted BROWN.-.JCL 6, only 'BROWN.' is counted /* Quote ends */ In TSS, masking characters are '+', '*' and '-'. The plus sign is one character. I've heard conflicting things about the other two; at one time I understood that the '*' could stand for any zero to eight characters INCLUDING A PERIOD, so that GEN*FIT would match GENFIT, GEN.FIT, GEN.XYZ.FIT or GENXX.XYZ.XFIT. But it also says here it's supposed to be about a single index. One of these days I've got to test this and see what the real story is. The hyphen, it says here, is a "floating" mask; they appear to mean it can represent any number of characters. If you have multiple permissions which by the above criteria are the same length, then it looks at other features of the permissions to determine a match. For instance, if one of them says ACCESS(NONE), that one controls regardless of other matters. Failing that, it looks at (for example) FACILITY, TIME, TERMINAL and so on. --- Bob Bridges, robhbrid...@gmail.com, cell 336 382-7313 /* By Faith we believe always what we have already seen imperfectly and by flashes, and hope hereafter to see always and perfectly. -C S Lewis in "Is Theism Important?", from "God in the Dock" */ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Itschak Mugzach Sent: Monday, June 13, 2022 02:14 Well, let's make it the TSS rule. --- On Thu, Jun 9, 2022 at 3:39 PM Bob Bridges wrote: > Yes, but matching BY WHAT RULE(S)? Which mask is the best match > depends on what set of rules you're using - and unless I've > misunderstood you, you seem to be saying that you have no particular set of > rules in mind. > Therefore you cannot determine which mask is the better fit. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: DB2 and RACF entities
RACF doesn't know, so once you've deleted the GRANT from DB2 I don’t know of a way to find out what you lost (unless you can get it from a backup). But there are tables in DB2 that list all GRANTs, so you can export those to, say, Excel and do some sorting and other munging to get a sensible list. It's been a while, but I did that as part of a project to convert DB2 security to RACF. When I say "it's been a while", what I mean is that I don't remember what that table or those tables were called. But I was able to find them back then, so I'm sure it's documented in DB2 somewhere. --- Bob Bridges, robhbrid...@gmail.com, cell 336 382-7313 /* If I try to be like him, who will be like me? -Yiddish proverb */ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Radoslaw Skorupka Sent: Monday, June 13, 2022 16:09 The following scenario: DB2 v12 using pre-RACF (GRANT/REVOKE) security. Of course userids and groupids are taken from RACF. There are several groups which are candidates to delete as they look as not needed. However some of them have DB2 GRANTs, so those groups should not be deleted. So far, so good. Unfortunately some group was deleted, despite it was used by DB2. I don't know details, but AFAIK probably it was something related to SET SQL ID or so. Q: is there any method to find out *all* RACF users and groups used for any authorisation in DB2? -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
ITEM NAME(CLUSTER) NUMBER(1), PGM=IXCL1DSU
I should be able to find this on my own, but so far I've failed. What sysplex functionally gets unlocked once the sysplex couple dataset is formatted with cluster support? Mark Jacobs Sent from [ProtonMail](https://protonmail.com), Swiss-based encrypted email. GPG Public Key - https://api.protonmail.ch/pks/lookup?op=get&search=markjac...@protonmail.com -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
Isn't that similar to the JES3 IATXCSF macro? Lennie Dymoke-Bradshaw https://rsclweb.com ‘Dance like no one is watching. Encrypt like everyone is.’ -Original Message- From: IBM Mainframe Discussion List On Behalf Of Ed Jaffe Sent: 13 June 2022 20:54 To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Is there a service similar to TCTL so that a task can give control to another task? On 6/13/2022 9:21 AM, Binyamin Dissen wrote: > Is there a service similar to TCTL so that a task can give control to > another task? We wrote our own. If you issue this internal macro (let's call it SUBTASK), the next instruction after the macro is running in a subtask. If you issue SUBTASK again, the next instruction is back in the original task. We have a similar macro to pass control to an enclave SRB and back. In our case, it's intended to be used like a subroutine call -- the macro calls must appear in pairs -- so it's not quite as general-purpose as TCTL, but I'm sure than can be done too... . . main-task code . SUBTASK TCB=tcbaddr . . subtask code . SUBTASK , . . resume main-task code . -- Phoenix Software International Edward E. Jaffe 831 Parkview Drive North El Segundo, CA 90245 https://www.phoenixsoftware.com/ This e-mail message, including any attachments, appended messages and the information contained therein, is for the sole use of the intended recipient(s). If you are not an intended recipient or have otherwise received this email message in error, any use, dissemination, distribution, review, storage or copying of this e-mail message and the information contained therein is strictly prohibited. If you are not an intended recipient, please contact the sender by reply e-mail and destroy all copies of this email message and do not otherwise utilize or retain this email message or any or all of the information contained therein. Although this email message and any attachments or appended messages are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by the sender for any loss or damage arising in any way from its opening or use. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
My guess is that the instantiation is a POST to the subtask related ECB and a WAIT on the other main task ECB (perhaps related to the subtask) and the undo is the reverse. Correct? At any rate, I wanted to allow task! a quantum of processing time before allowing task2 to continue. After that I do not care if they run in parallel. Yes, I know that TCTL ends the SRB processing so not exactly identical, but . On Mon, 13 Jun 2022 12:54:26 -0700 Ed Jaffe wrote: :>On 6/13/2022 9:21 AM, Binyamin Dissen wrote: :>> Is there a service similar to TCTL so that a task can give control to another :>> task? :> :>We wrote our own. If you issue this internal macro (let's call it :>SUBTASK), the next instruction after the macro is running in a subtask. :>If you issue SUBTASK again, the next instruction is back in the original :>task. We have a similar macro to pass control to an enclave SRB and back. :> :>In our case, it's intended to be used like a subroutine call -- the :>macro calls must appear in pairs -- so it's not quite as general-purpose :>as TCTL, but I'm sure than can be done too... . :> . main-task code . :> SUBTASK TCB=tcbaddr . :> . subtask code . :> SUBTASK , . :> . resume main-task code . -- Binyamin Dissen http://www.dissensoftware.com Director, Dissen Software, Bar & Grill - Israel -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
Re: Is there a service similar to TCTL so that a task can give control to another task?
On 6/13/2022 4:28 PM, Lennie Dymoke-Bradshaw wrote: Isn't that similar to the JES3 IATXCSF macro? Indeed it is (and the J3PXCSF macro too)! 😉 -- Phoenix Software International Edward E. Jaffe 831 Parkview Drive North El Segundo, CA 90245 https://www.phoenixsoftware.com/ This e-mail message, including any attachments, appended messages and the information contained therein, is for the sole use of the intended recipient(s). If you are not an intended recipient or have otherwise received this email message in error, any use, dissemination, distribution, review, storage or copying of this e-mail message and the information contained therein is strictly prohibited. If you are not an intended recipient, please contact the sender by reply e-mail and destroy all copies of this email message and do not otherwise utilize or retain this email message or any or all of the information contained therein. Although this email message and any attachments or appended messages are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by the sender for any loss or damage arising in any way from its opening or use. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
