Connect Direct - AUthentication using Proxy

[Gilson Cesar de Oliveira]

Dear list,



We are planning to enable Security in Connect Direct for
external partners and we can see, as far as I understood, three options:



1.  Enable Security exit and define all the external userids to
authenticate using this exit with interface to RACF;
2.  Create an internal userid which will be translated using the proxy
(AUTH file) and allowing some functions within the Connect Direct
(Authorization File).

For example, external userid JOHN, when starting a transmission to node
CD.NODE.L1 will be "INTUSER"  which will have authority in RACF to create a
dataset with HLQ=TST.FILE.CPY1



3.  Authentication with Certificate and Node. Using this option will
allow the user JOHN from node CD.NODE.L1 to be authenticated using the node
and the Common Name (CN) defined in the certificate without using userid and
password.



For all the options described above, we have some questions:



*   Do we need to enable the security exits (Stage 1 and Stage 2) for
option 2?
*   In option 3, do we need to enable anything else than the
configuration in Secure+ to enable Cliente Auth ?
*   For option 3, where the authentication is made using node and
certificate, does the user can transfer files or only submit process ??
*   For option 3, do we need to define an internal userid through the
proxy and allow this userid to create datasets when transmitting data to our
internal node ??



If someone have any experience with it and could help, I really appreciate
that.



Thanks in advance,



Gilson



--
O software antivírus AVG realizou uma checagem de vírus neste e-mail.
www.avg.com

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: [External] : Connect Direct for z/Os Upgrade

[Gilson Cesar de Oliveira]

Hi Richard,

Yes. The dataset where where the exits reside is APF.

Em seg., 28 de ago. de 2023 às 16:24, Richard McIntosh <
richard.mcint...@oracle.com> escreveu:

> Is the library authorized that the exits on it? Make sure it is the APF
> list.
> LONG TEXT => The user-written exit program was not found in an
> authorized
>  library.
>
> Richard
>
>
> -Original Message-
> From: IBM Mainframe Discussion List  On Behalf
> Of Gilson Cesar de Oliveira
> Sent: Monday, August 28, 2023 2:18 PM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: [External] : Connect Direct for z/Os Upgrade
>
> We are upgrading COnnect Direct for z/Os at version 4.8 to 5.1 (this is
> the first step to upgrade to version 6.2) and we are facing issues for some
> processes when using the new version of the loadlib of Connect Direct.
> SCIB006I SIGNON COMMAND (CONDENSED) => USERID /NODE =
>
> SCIC000I Connect:Direct - RC=0008 MSG=SCBA029I NODE= @
> 06:48:51 / 08/25/23
>SHORT TEXT => SCBA029I The user exit is not in an authorized library.
>
> LONG TEXT => The user-written exit program was not found in an
> authorized
>  library.
>
>
>  SYSTEM ACTION: Signon fails.
>
>
>  RESPONSE: Make sure the exit is in an authorized library
> and
>was assembled non-reentrant and non-reusable.
>
> SCIC013I Terminating before EOF due to error return code (HEX) =0018
>
> SCIB007I  COMMAND =>  SIGNOFF FORCED BY DMBATCH
>
> SCIC000I Connect:Direct - RC=0010 MSG=SCIA008I NODE= @
> 06:48:52 / 08/25/23
>SHORT TEXT => SCIA008I Syntax Error finding word SIGNON in SIGNON
> command.
> LONG TEXT => C:D was unable to find the word SIGNON in the first
>
>  command passed.  The SIGNON command MUST NOT have a
>
> label on it, and the word SIGNON MUST be surrounded by
> spaces.  Common reasons for this message are:
> 1) A LABEL starting in Column 1
> 2) The word SIGNON starting in Column 1
> 3) The word SIGNON not followed by a space.
>
> SYSTEM ACTION: Set Return code to 16, and Fail the signon
>
> We recompiled two exits DGAMGSAF and DGACXSIG and for some processes it's
> working as expected but for this example above we can see errors.
>
> Do you have any idea why this errors are occurring?
>
> As a workaround we created a new version of the proc used by these
> processes but pointing in the STEPLIB the dataset of the version V4.8
> instead of V5.1.
>
> Thanks for any help.
>
> Regards,
>
> Gilson
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions, send email
> to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Connect Direct for z/Os Upgrade

[Gilson Cesar de Oliveira]

Hi Kolusu,

Thanks for your reply.
Regarding the the dataset where I Have both modules (exits), it’s
authorized. The most strange is that for some processes work with no
issues. For other we have the errors.
We’d like to understand why it’s happening.
If you have any idea on why this is happening for some processes I will
really appreciate that.

Many thanks,

Gilson

Em seg., 28 de ago. de 2023 às 16:25, Sri h Kolusu 
escreveu:

> >> We recompiled two exits DGAMGSAF and DGACXSIG and for some processes
> it's working as expected but for this example above we can see errors.
>
> Gilson,
>
> You need to have the library that contains those 2 modules to be
> AUTHORIZED.
>
> Also, you may want to check if any of this applies.
>
>
> https://www.ibm.com/support/pages/message-user-exit-not-authorized-library-iui-%E2%80%93-sterling-connectdirect-zos
>
>
> Thanks,
> Kolusu
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Connect Direct for z/Os Upgrade

[Gilson Cesar de Oliveira]

We are upgrading COnnect Direct for z/Os at version 4.8 to 5.1 (this is the 
first step to upgrade to version 6.2) and we are facing issues for some 
processes when using the new version of the loadlib of Connect Direct.
SCIB006I SIGNON COMMAND (CONDENSED) => USERID /NODE =   

SCIC000I Connect:Direct - RC=0008 MSG=SCBA029I NODE= @ 
06:48:51 / 08/25/23  
   SHORT TEXT => SCBA029I The user exit is not in an authorized library.

LONG TEXT => The user-written exit program was not found in an authorized   

 library.   


  
 SYSTEM ACTION: Signon fails.   



 RESPONSE: Make sure the exit is in an authorized library and   

   was assembled non-reentrant and non-reusable.

SCIC013I Terminating before EOF due to error return code (HEX) =0018

SCIB007I  COMMAND =>  SIGNOFF FORCED BY DMBATCH 

SCIC000I Connect:Direct - RC=0010 MSG=SCIA008I NODE= @ 
06:48:52 / 08/25/23  
   SHORT TEXT => SCIA008I Syntax Error finding word SIGNON in SIGNON command.   

LONG TEXT => C:D was unable to find the word SIGNON in the first

 command passed.  The SIGNON command MUST NOT have a

label on it, and the word SIGNON MUST be surrounded by  
spaces.  Common reasons for this message are:   
1) A LABEL starting in Column 1 
2) The word SIGNON starting in Column 1 
3) The word SIGNON not followed by a space. 

SYSTEM ACTION: Set Return code to 16, and Fail the signon   

We recompiled two exits DGAMGSAF and DGACXSIG and for some processes it's 
working as expected but for this example above we can see errors.

Do you have any idea why this errors are occurring?

As a workaround we created a new version of the proc used by these processes 
but pointing in the STEPLIB the dataset of the version V4.8 instead of V5.1.

Thanks for any help.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

MARS - Details Manuals

[Gilson Cesar de Oliveira]

Hi everyone,

I´d like to know if someone from this group have details about this 
software (HELIX MARS).

We have a new customer using it but there is nobody who knows the 
details about it.
This customer is facing issues related to transfer data using MARS for 
huge file size.
They say that for small files the transfer occurs with no issue but for 
large ones they are receiving timeouts. They say that the file on the target is 
allocated but nothing is transmitted, the file is empty.

We don´t have more details but they are associating this issue with 
some limitation in the network.
They have files with size about 7 Terabytes.

If someone could give some light to solve the issue I appreciate that.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Infoprint - GUI Interface

[Gilson Cesar de Oliveira]

Hi everyone,

I´m starting to work with Infoprint and I´m facing the following:

I have to change the hostname (IP Address) of a printer and I´m
doing it through TSO interface. After I´ve changed the hostname field it
returns a msg saying that the change was updated.
When I enter in the GUI interface of Infoprint I see that the field
hostname remains with the old information which I have updated through the
TSO.

Do you know how to update/change the information on the GUI
interface ??

Or it will be upodated after a restart of the interface ??

Many thanks for any help.


Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IWS Agent for z/OS - SSL Configuration

[Gilson Cesar de Oliveira]

Hi Tim and Colin,

Many thanks for your prompt help.
I´ll work with the team who owns the IWS in order to implement these
configurations and test them before the roll-out.

If it works I´ll post the results here for the list.

Regards,

Gilson

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of
Timothy Sipples
Sent: sexta-feira, 22 de julho de 2022 01:59
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: IWS Agent for z/OS - SSL Configuration

I think Colin has pointed you in the right direction.

I wonder if (alternatively) you could configure IBM Z Workload Scheduler for
HTTP (unencrypted) traffic but then use z/OS AT-TLS to provide the TLS 1.2+
support with your desired cipher suites.

— — — — —
Timothy Sipples
Senior Architect
Digital Assets, Industry Solutions, and Cybersecurity IBM zSystems/LinuxONE,
Asia-Pacific sipp...@sg.ibm.com


--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: IWS Agent for z/OS - SSL Configuration

[Gilson Cesar de Oliveira]

Hi Timothy,

Many thanks for your help.
In the second URL there is an information about how to setup TLSV1.2
but we also need to restrict the ciphers to the ones our customer would like
to have enabled.
I´m still looking for on how to restrict the ciphers.
If you have further informations on how to do it, I really
appreciate that.

Regards,

Gilson

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of
Timothy Sipples
Sent: quinta-feira, 21 de julho de 2022 02:15
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: IWS Agent for z/OS - SSL Configuration

Gilson,

Does the information here help?

1.
https://www.ibm.com/docs/en/workload-automation/10.1.0?topic=ssae-enabling-f
ips-compliance-over-z-workload-scheduler-server-ssl-secured-connection
2.
https://www.ibm.com/docs/en/workload-automation/10.1.0?topic=server-configur
ing-tls-connect-z-workload-scheduler#configTLS

— — — — —
Timothy Sipples
Senior Architect
Digital Assets, Industry Solutions, and Cybersecurity IBM zSystems/LinuxONE,
Asia-Pacific sipp...@sg.ibm.com


--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

IWS Agent for z/OS - SSL Configuration

[Gilson Cesar de Oliveira]

Hi everyone,

We are facing some issues regarding IWS Agent for z/OS where we have
to configure HTTPOPTS but for this option there is no way to restrict the
encryption protocol for TLSv1.2 only.

All they have available to configure are the following:

>--+---+>
   | .-CAONLY-.|   
   '-SSLAUTHMODE--(--+-STRING-+--)-'   

>--+-+-->
   |   .-tws.|   
   '-SSLAUTHSTRING--(--+-SSL string-+--)-'   

>--++--->
   '-SSLKEYRING--(SSL key ring db filename)-'   

>--++--->
   '-SSLKEYRINGPSW--(SSL key ring psw filename)-'   

>--+---+>
   |.-SAF-.|   
   '-SSLKEYRINGTYPE--(--+-USS-+--)-'   

>--++--->
   | .-512-.|   
   '-SSLPORT--(--+-SSL port number-+--)-'

We have to fix all the issues related to the vulnerabilities but for this
service it looks like there is no solution available for it.

Does anyone that already have problems with it would suggest a way to do it
??

Pagent would be an alternative viable to implement ??

Thanks in advance for any help.

Gilson   

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

SuperSession with Passphrase

[Gilson Cesar de Oliveira]

Dear list,

 

We are implementing password phrase but not for all lpars at
the same time.

 

We are using SuperSession 3.1 but from the application menu
there will be applications running on lpars with no support for password
phrase (ex. TSO).

 

Does anyone of you have a plan to keep the access working
for applications with and without support for password phrase at the same
time when using SuperSession ??

 

The question is if we enable password phrase support for
SuperSession, what is gonna happen with applications not yet configured to
support passphrase. I suppose the application will ask to enter the right
password or any other unpredictable results may occur.

 

Thanks in advance for any help.

 

Regards,

 

Gilson


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

How to Remove Ciphers in SSH

[Gilson Cesar de Oliveira]

Hi list,

 

I´m facing an issue related to remove ciphers from SSH
configuration.

 

When you execute ssh -Q cipher I can see the list with the
ciphers and I´d like to remove some of them

 

From my understanding all I have to do is the following:

 

Include the Ciphers statement with the “-“ at the beginning
of the cipher name and it´ll to be removed from the default set.

 

Ciphers -3des-cbc,--aes128-cbc 

 

No errors when starting the SSHD but when I type ssh -Q
cipher I still viewing those which I´ve included to be removed.

 

We are at z/OS V2R4 and OPENSSH is at version 7.6 that comes
with the z/OS version.

 

If anyone could give some light I´ll really appreciate that.

 

Regards,

 

 

Gilson Cesar


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

OSNMPD Community

[Gilson Cesar de Oliveira]

Hi,

When you have a community defined as "public" you are exposed for
some kind of Security Issues and my question is related to it:

If you change the community name from public to anything else
different from this, who will be affected other than Networking monitoring
Servers that are querying your informations related to items (fields of
MIBs) from your network ?

If anyone could give me further informations about this it would
help us.

Thanks in advance.

Regards,

Gilson



--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: How to Disable OPTION on Http Server for z/Os using Apache

[Gilson Cesar de Oliveira]

Many Thanks John!!
Tomorrow morning I will change the configuration as described in the text
and we will hope everything is going to be ok!

Gilson

Em dom., 22 de mai. de 2022 às 19:35, John S. Giltner, Jr. 
escreveu:

> Should work, that is a generic way of disabling OPTIONS for Apache in any
> platform.
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

How to Disable OPTION on Http Server for z/Os using Apache

[Gilson Cesar de Oliveira]

Hi List,

I’ve been researching a way to disable OPTIONS for http server for z/OS in 
Apache.
I’ve found an article on this site but is related to i System  not for z system.
https://www.ibm.com/support/pages/disabling-options-method-apache-24-http-server

Does anyone of you know if this solution can be applied for Apache for z/OS ?
If not, is there a way to do it?

Thanks in advance for any help.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Is there a CL/SuperSession (CLSS) user's group?

[Gilson Cesar de Oliveira]

Mark:

Here in Brazil we have configured CLSS 3.1 to replace Netview Access.
It is working as expected but there are some difference if you compare 
with Netview Access.
I have to get most of the configuration steps in manuals.

If you need information on how to do it, please let me know.

Regards,

Gilson

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Richards, Robert B. (CTR)
Sent: quinta-feira, 21 de outubro de 2021 11:35
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: Is there a CL/SuperSession (CLSS) user's group?

No idea on the number of users, but they upgraded it to 3.1 to fix some issues. 
That is what we have installed.

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Mark Regan
Sent: Thursday, October 21, 2021 10:15 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: Is there a CL/SuperSession (CLSS) user's group?

Bob,

Thanks for the reply. I had looked for one but came up empty. It makes you 
wonder how many customers of CLSS there are. If I was so inclined, I could 
start one on groups.io, where NetView and System Automation are. I created one 
there for Lionel Dyck's XMITIP program, and it has been getting some use.

Regards,

Mark Regan, K8MTR

*CTO1 USNR-Retired, 1969-1991*
*Nationwide Insurance, Retired, 1986-2017*


On Thu, Oct 21, 2021 at 10:03 AM Richards, Robert B. (CTR) < 
01c91f408b9e-dmarc-requ...@listserv.ua.edu> wrote:

> Mark,
>
> I am unaware of any user group. Regardless, ask away. If we can 
> answer, we will. 
>
> Bob (CLSS user)
>
> -Original Message-
> From: IBM Mainframe Discussion List  On 
> Behalf Of Mark Regan
> Sent: Thursday, October 21, 2021 9:08 AM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Is there a CL/SuperSession (CLSS) user's group?
>
> Is there a CL/SuperSession (CLSS) user group? If not, are there any 
> users here on IBM-MAIN who can help a new customer with questions 
> about transitioning to it from another vendor's product?
> Regards,
>
> Mark Regan, K8MTR
>
> *CTO1 USNR-Retired, 1969-1991*
> *Nationwide Insurance, Retired, 1986-2017*
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions, send 
> email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions, send 
> email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Filemanger abend and dynamic allocation

[Gilson Cesar de Oliveira]

Em sex., 13 de ago. de 2021 às 10:31, Seymour J Metz 
escreveu:

> Where is the S0C9? Has the batch job completed? What is in the ALLOC and
> what are the TUs of the DYNALLOC?
>
>
> --
> Shmuel (Seymour J.) Metz
> http://mason.gmu.edu/~smetz3
>
> 
> From: IBM Mainframe Discussion List [IBM-MAIN@LISTSERV.UA.EDU] on behalf
> of Joseph Reichman [reichman...@gmail.com]
> Sent: Thursday, August 12, 2021 5:23 PM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Re: Filemanger abend and dynamic allocation
>
> I got a soc9 divide exception
> This abend is from my job joseph.reich...@irs.gov except I cannt post
> from that email
> You mentioned sysprint however I don’t remember allocating it in either
> case
> It seems that the file I want to browse just has to be pointed to my Rexx
> variable filein
> It also seems that file manager dynamically allocates filein that’s just
> by doing tso isrddn and seeing a sys…… DD allocated to the dsname as in the
> case where SVC 99 returns the ddname I think that’s key 1
>
> Also when the abend happens I do actually get into the file manager panel
> as it trying to read the input the all of the sudden abends pgm=filemngr
> it’s from memory but I do believe that’s it with a s0c9
>
>
>
> > On Aug 12, 2021, at 4:45 PM, Jeremy Nicoll <
> jn.ls.mfrm...@letterboxes.org> wrote:
> >
> > On Thu, 12 Aug 2021, at 20:28, Joseph Reichman wrote:
> >
> >> If the input is multiple files then I allocate the output via ADDRESS
> TSO “ALLOC
> >
> > Why?  I mean, by all means decide the name of the output file(s) before
> you
> > build the JCL, but let the JCL allocate it/them.
> >
> >
> >> File manger abends trying to display the output
> >
> > What abend code?
> >
> > Are the batch jobs finished at that point?
> >
> >
> > --
> > Jeremy Nicoll - my opinions are my own.
> >
> > --
> > For IBM-MAIN subscribe / signoff / archive access instructions,
> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
> --
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Migration Netview Access to CL/Supersession

[Gilson Cesar de Oliveira]

Dear list:

I'd like to know if someone have migrated the Session Manager from 
Netview Access to CL/Supersession.

We are starting to do it and I could not find if there is a process to 
migrate in order to keep the groups defined in RACF for Access to be used in 
CL/Supersession.

Details related to RACF definitions would be a good start.

Thanks in advance for any help.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

RES: OSA Express 7S 1000 base T as console

[Gilson Cesar de Oliveira]

Dear Curtis:

My concern is related to isolate consoles for different lpars. All
the console clients that will connect to 192.168.10.100 should not connect
to 10.152.200.100 and vice-versa.

Are you saying that I can define the ports in different subnets but
the default gateway should be the same ??
I have the configuration in HCD and there is a panel where I can
configure  the ports 0 and 1.

Am I wrong at this point ??

Regards,

Gilson


-Mensagem original-
De: IBM Mainframe Discussion List  Em nome de Pew,
Curtis G
Enviada em: terça-feira, 2 de fevereiro de 2021 17:06
Para: IBM-MAIN@LISTSERV.UA.EDU
Assunto: Re: OSA Express 7S 1000 base T as console

On Feb 2, 2021, at 12:32 PM, Gilson Cesar de Oliveira 
wrote:
> 
>   For instance I have an OSA where in port 0 I will define it for 
> network 192.168.10.100/16
>   And for port 1 I will define it for network 10.152.200.100/16.
>   I've heard something that we can use it but in the same network.
> 

You can do that, but only one of the ports will be accessible from other
subnets. The OSA-ICC definition only supports a single gateway. So, for
example, if you define the gateway with an address in the 192.168.10.100/16
subnet, any client that can route through that gateway, as well as other
hosts in that subnet, will be able to access the console through port 0, but
only hosts with addresses in the 10.152.200.100/16 subnet will be able to
access the console through port 1.

I hope my explanation makes sense.


--
Pew, Curtis G
curtis@austin.utexas.edu

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email
to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

OSA Express 7S 1000 base T as console

[Gilson Cesar de Oliveira]

Dear colleagues:

I'd like to know if is it possible to use OSA Express 1000 Base T
with the two ports (0 and 1) for console but in different sub-networks ?

For instance I have an OSA where in port 0 I will define it for
network 192.168.10.100/16
And for port 1 I will define it for network 10.152.200.100/16.
I've heard something that we can use it but in the same network.

Thanks in advance for any help.

Regards,

Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

RES: NDM 5.2 on z/OS 2.4

[Gilson Cesar de Oliveira]

We are running NDM 5.2 on z/Os V2.4 with no issues. It's about 45 days and no 
issues, abends, etc.

-Mensagem original-
De: IBM Mainframe Discussion List  Em nome de 
Burrell, Todd
Enviada em: quinta-feira, 30 de julho de 2020 14:07
Para: IBM-MAIN@LISTSERV.UA.EDU
Assunto: NDM 5.2 on z/OS 2.4

And sorry for the typos in the original message - I am talking about NDM (not 
NSM).   I've corrected this below.  

-Original Message-
From: IBM Mainframe Discussion List  On Behalf Of 
Todd Burrell
Sent: Thursday, July 30, 2020 11:45 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: NSM 5.2 on z/OS 2.4

We've been trying to get a good answer as to whether or not NDM 5.2 (and 6.0) 
are compatible with z/OS 2.4.  Is anyone running NDM 5.2 on z/OS 2.4?  We're 
working on getting 6.0 installed, but we'd like to know if anyone has seen any 
issues with 5.2 on z/OS 2.4? 

--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN We comply with 
applicable Federal civil rights laws and do not discriminate.

You may access the Non-Discrimination and Accessibility Notice here 
.

Language Assistance Available:

Español, Kreyol Ayisien, Tiếng Việt, Português, 中文, français, Tagalog, русский, 
italiano, Deutsche, 한국어, Polskie, Gujarati, ไทย, العربية, 日本語, فارسی 


Florida Blue is a trade name of Blue Cross and Blue Shield of Florida, Inc.  
Blue Cross and Blue Shield of Florida, Inc., and its subsidiary and affiliate 
companies are not responsible for errors or omissions in this e-mail message. 
Any personal comments made in this e-mail do not reflect the views of Blue 
Cross and Blue Shield of Florida, Inc.  The information contained in this 
document may be confidential and intended solely for the use of the individual 
or entity to whom it is addressed.  This document may contain material that is 
privileged or protected from disclosure under applicable law.  If you are not 
the intended recipient or the individual responsible for delivering to the 
intended recipient, please (1) be advised that any use, dissemination, 
forwarding, or copying of this document IS STRICTLY PROHIBITED; and (2) notify 
sender immediately by telephone and destroy the document. THANK YOU.


--
For IBM-MAIN subscribe / signoff / archive access instructions, send email to 
lists...@listserv.ua.edu with the message: INFO IBM-MAIN

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

How to configure LOADxx in DR

[Gilson Cesar de Oliveira]

Hello:

We have the following situation when trying to activate and IPL 3
lpars from site A into site B.

Both sites are distant about 450 Km and the storage  replication is made by
Global Metro Mirror.

The issue we have faced last weekend is related to match the IODF we have
received from the team which is responsible for the box in site B. We have
the SYS1.IODFE0 with all the definitions for the box in site B where they
have more lpars than just our 3 defined there.
In site A where my team is responsible for the SYS1.IODFxx we have
pointed in LOADxx with **.
When trying to IPL the same lpars in site B we are configuring in
LOADyy with IODF = E0.
There was something wrong with this configuration because in the
VOLUME where the SYS1.IODFE0 is located, it didn't match with the
configuration in HSA. 
Perhaps someone from the site B have validated  new IODF for other
lpars than the 3 we have defined and the IPL didn't came up returning an
error which wait state code is 0F indicating a mismatch in the volume or
with the dataset (it looks like it didn't found the dataset or the
configuration).

Does anyone here could give us tips on how to have the configuration
working for both sites without worrying about changes in terms of IO
configuration not related to our lpars ??

Thanks in advance for any help.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Restrict users to Purge Jobs in TSO

[Gilson Cesar de Oliveira]

Hello:

  Does anyone know how to restrict the option to purge sysouts in JES2 Spool 
through TSO (SDSF) but only the jobs which the user is the owner?

 We have profiles in OPERCMDS class like JES2.CANCEL.BAT and we would like to 
restrict the purge option only for sysouts generated by userA. UserB should not 
have the permission to purge jobs from UserA.


  Thanks in advance for any help.

  Regards,

  Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: DFSORT Header1 with Date

[Gilson Cesar de Oliveira]

Dear list:

  Follow the results using DFSORT:
ICE250I 0 VISIT http://www.ibm.com/storage/dfsort FOR DFSORT PAPERS, EXAMPLES 
AND MORE   
ICE000I 0 - CONTROL STATEMENTS FOR 5650-ZOS, Z/OS DFSORT V2R3  - 06:00 ON SUN 
SEP 22, 2019 - 
   OPTION COPY  
 
   OUTFIL FNAMES=SORTOUT,REMOVECC,INCLUDE=(1,1,CH,EQ,C'1'), 
 
   HEADER1=(C'H',DATENS(4MD),TIMENS,DATENS(4MD)-1), 
 
   $
 
ICE007A 1 SYNTAX ERROR  
 
   TRAILER1=(C'T',COUNT+2=(M11,LENGTH=10)), 
 
   $
 
ICE005A 0 BLANK NEEDED IN COLUMN 1 OR OPERATION NOT DEFINED CORRECTLY   
 
   OUTREC=(C'D',
 
 $  
 
ICE007A 1 SYNTAX ERROR  
 
   C'W',
 
$   
 


The problem is in HEADER1 where it doesn't recognise DATENS(4MD)-1 syntax.

The input file has the following:
RECFM=FB
LRECL=1500

The content is the following:
0021252019092300
14070414842360259994070004320324974844070004320324974800
140786381980020499940700043203286872920034070004320328687292
140790365278068099940700040043713848550064070004004371384855
140728887336531009940700043203262145410094070004320326214541
140785842023864349940700043203267612270024070004320326761227
140703667305626689940700043203224981010084070004320322498101
140728041106581529940700043203250917610034070004320325091761


The OUTPUT file (SORTOUT) has the following format:

RECFM=FB
LRECL=1271

The content in the SORTOUT is the following:

H2019092106001820190920
DW4070371144234620994070004320325220398008407000432032522039813
DW4078902827390507994070004320328121127005407000432032812112714
DW4072801894591151994070004320325054784000407000432032505478413
DW4070340219305668994070004320325749122004407000432032574912212
DW4078504750297550994070004320326695168009407000432032669516812
DW4078625679686015994070004320328530484005407000432032853048412
DW4070336669482787994070004320325770420004407000432032577042014

The syntax when using SYNCSORT runs fine.

When using DFSORT there is a syntax error and we are researching for an 
alternative using it.


Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

DFSORT Header1 with Date

[Gilson Cesar de Oliveira]

Hello:

   We have migrated our sort from SYNCSORT to DFSORT and we are facing issues 
related to syntax in the following situation:

in SYNCSORT:
 OPTION COPY
 OUTFIL FNAMES=SORTOUT,REMOVECC,INCLUDE=(1,1,CH,EQ,C'1'),   
 HEADER1=(C'H',DATENS(4MD),TIMENS,DATENS(4MD)-1),   
 TRAILER1=(C'T',COUNT+2=(M11,LENGTH=10)),   

The result is the following in the Header line of the SORTOUT:
H2019092219315220190921
We need the same result in DFSORT but with the syntax in HEADER1 it doesn't 
work.

The question is:

How to format the HEADER1 in order to have DATE + TIME + (DATE-1)

I really appreciate any help.

Regards,

Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

DFSORT with zIIP

[Gilson Cesar de Oliveira]

Dear list:

  I'd like to know if DFSORT makes use of zIIP as SYNCSORT does.

  Please do not consider DFSORT with DB/2 utilities where zIIP is used.

  If anyone could help I really appreciate that.


  Thanks !!

  Regards,


 Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

VCHID for Hipersocket

[Gilson Cesar de Oliveira]

We are upgrading our boxes from zEC12 to z13.

One of the interfaces we have been using is Hipersocket and for z/13, manuals 
say that for Hipersocket, the VCHID (Virtual Channel Id) should be at the range 
of 7E0-7FF.
We have used CHPID Mapping Tools and the IODF generated for this channel set 
the VCHID 7C0.

Does anyone know if it is correct or do we have to change the VCHID in HCD 
using the range recommended in the manual (7E0-7FF).

Please, if someone could help we appreciate that.

Regards,


Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

CFZCIM CPU consumption

[Gilson Cesar de Oliveira]

Dear list:

   We are facing some issues related to the address space CFZCIM on z/OS V2R3.

 For some reason we could not find, the CPU consumption reached thresholds for 
a period of time where the service was not in use.


 Does anyone here have any experience and similar issues related to CFZCIM ??

Its consumption is for zIIP and CP processors.

Thanks in advance for any help.


Regards,

Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

$HASP568 - Connect to a Unkown APPL

[Gilson Cesar de Oliveira]

Dear list:

  We have configured an NJE connection using the following statements in JES2 
PARM:

APPL(APPL01)   NODE=31 

CONNECT  NODEA=1,MEMBA=1,NODEB=31,MEMBB=1

N(31)   NAME=NODE01,PATHMGR=YES,CONNECT=(YES,30)

 In VTAMLST we have the following definitions:

 VBUILD  TYPE=CDRSC  
  NETWORK NETID=NETB
APPL01CDRSC   ==> Remote Node

My NETID is NETA
   VBUILD  TYPE=APPL 
LCLNJE11  APPLVPACING=5,AUTH=ACQ,   
   DLOGMOD=JESMODE,MODETAB=JES2MODE



I'm receiving the message $HASP568 with the following content:

$HASP568 NODE=NODE01 - AUTOMATIC CONNECT (APPL=NODE01)

and VTAM messages with sense code 087D0001 with the following contents:

IST663I  INIT OTHER REQUEST   FAILED  , SENSE=087D0001   
IST664I  REAL  OLU=NETA.LCLNJE11 ALIAS DLU=NETA.NODE01 

I'd like to know why the connection retry is using node name instead of APPL 
name as defined in JES2 parm ??

We are at z/OS V2R2.

Thanks in advance for any help.

Regards,

Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Self Signed Certificate - Import Root Chain

[Gilson Cesar de Oliveira]

Dear list:

  I'd like to hear from this group, which way we have to follow in order to add 
in RACF the root chain from external partners that have encrypted connections 
but using self signed certificate.

  I will describe the three ways we have imported the root chain:



1- Add the certificate with "Certificate Owner" = CERTAUTH  and the CONNECT 
with the option USAGE=CERTAUTH.

RACDCERT CERTAUTH ADD('DSN.ROOT') + 
 WITHLABEL('External Root') TRUST   
RACDCERT CONNECT(CERTAUTH LABEL('External Root') +  
 RING(RingName) USAGE(CERTAUTH)) ID(userid)



2-Add the certificate with "Certificate Owner" = userid and the CONNECT with 
the option USAGE=PERSONAL.

RACDCERT ID(userid) +   
 ADD('DSN.ROOT') + 
 WITHLABEL('External Root')  + 
 TRUST  
RACDCERT ID(userid) CONNECT(LABEL('External Root')+
 RING(RingName) USAGE(PERSONAL))  



3- Add the certificate with "Certificate Owner" = userid and the CONNECT with 
the option USAGE=CERTAUTH

RACDCERT ID(userid) +   
 ADD('DSN.ROOT') + 
 WITHLABEL('External Root')  + 
 TRUST  
RACDCERT ID(userid) CONNECT(LABEL('External Root')+
 RING(RingName) USAGE(CERTAUTH))  

All the options we have tested worked fine but I'd like to know if there is a 
standard way to add/import the   certificate.
If the certificate is from an external CA like Symantec, Digicert, Certisign, 
etc. the process is the same or do we have to follow another way to import the 
root chain certificate ?

 Thanks in advance for any help.

 Regards,

 Gilson Cesar


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

List Nodes in Connect:Direct with Secure Plus

[Gilson Cesar de Oliveira]

Dear list:

   I'm looking for a process to list the nodes we  have defined in 
Connect:Direct using Secure Plus in order to check the encryption mode for each 
node when applicable.

   I need the process in batch. Online I already know that is possible but the 
result is a lista of nodes and I have to enter in each one in order to see the 
details which will spend a lot of time.

  Thanks in advance for any help.


Regards,

Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

CMBs Shortage - How to solve an issue?

[Gilson Cesar de Oliveira]

Dear list:

  We are facing some alerts related to shortage of Console Message Buffers due 
to an automation that change and route sysouts from one site to another. This 
automation, when there are a lot of sysouts, generates a lot of HASP686 
messages.

 In order to fix the issue we have two ways:

 1- Increase the NUMBUF in CONDEF (today this number is 270);
 2- Suppress the message HASP686 from the console through the MPFLSTxx.

I'd like to hear from the experts wich one would be the best.

Thanks in advance for any help.

Regards,

Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

NJE - Configuration of WS at the start of connection

[Gilson Cesar de Oliveira]

Dear list:

I'd like to know if there is a way to configure a line (Lx.ST1) to select 
different sizes of sysouts (size in terms of lines) when starting a connection.
I know that after a connection have been stablished, you can change the options 
LIMIT and WS on order to have the following:
$TLx.ST1,LIMIT=(0,3)
$TLx.ST1,WS=(LIMIT)

Thanks for any help.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Re: Route in Jes2 for more than one node

[Gilson Cesar de Oliveira]

Paul:

  The answer is Yes but, and always there is a BUT, the user don't want to 
change anything in JCL, so the option is to route the sysouts using Jes2 
command and I could not see a way to do it ($Rall) for more than one node.

 If you have an exit where you can enable more than one node to be passed 
through the command, would solve the problem.

  Thanks,

Gilson



Enviado de myMail para iOS


quinta-feira, 24 de agosto de 2017 20:48 -0300 de 
000433f07816-dmarc-requ...@listserv.ua.edu  
<000433f07816-dmarc-requ...@listserv.ua.edu>:
>On 2017-08-24, at 17:30, Gilson Cesar de Oliveira wrote:
>> 
>> We have to route some sysouts in the JES2 spool for two different nodes. Is 
>> there a way to do it automatically?
>> 
>Will the JCL OUTPUT statement do that for you?
>
>--gil
>
>--
>For IBM-MAIN subscribe / signoff / archive access instructions,
>send email to  lists...@listserv.ua.edu with the message: INFO IBM-MAIN


--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Route in Jes2 for more than one node

[Gilson Cesar de Oliveira]

Dear list:
We have to route some sysouts in the JES2 spool for two different nodes. Is 
there a way to do it automatically?

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

AXR address space

[Gilson Cesar de Oliveira]

Dear list:

I'd like to know how to stop the AXR address space without using the CANCEL 
command??

I already tried with STOP but it didn't work.

Any clues??


Thanks in advance for any help.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

Notify Type in Apar

[Gilson Cesar de Oliveira]

>
>Dear list:
Does anyone know the meaning of Notify Type= Hyper DEL in apar??

I have received a notification today but I could not find the meaning of thid 
Notify Type.

Thanks for any help.

Regards,

Gilson

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN

NJE between two different NETIDs

[Gilson Cesar de Oliveira]

Dear list:

  We are planning to establish a NJE connection between two different NETIDs 
sites in SNA and reviewing the steps we faced in one point related to the 
definition of the NODE.

My initial understanding is that we have to configure (to add) in my JES2 
configuration the following statements:

APPL => it is possible to add APPL dynamically through the $ADD APPL command.
DESTID => it is possible to add DESTID dynamically through the $ADD DESTid 
command.
CONNECT => it is also possible to add CONNECT dynamically through the $ADD 
CONNECT command.

The APPL is also defined in VTAM as CDRSC and this definition is made 
dynamically with no restart of any service in z/OS.

In order to add a CONNECT, one of the statements needed is NODE (NODEB).
It is supposed to be defined previously but I could not find any way to define 
it dynamically.

Does anyone here have another way to establish this connection without to 
restart JES2 to add a new NODE ??

Thanks in advance for any help.

Regards,

Gilson Cesar

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN