> One argument management offers in mitigation is that most of these CICS
> users don't have TSO, so they
> haven't the ability to submit batch jobs.
Job's can easily be submitted from CICS or IMS thru your job scheduler (I think
IBM OPC or CA7). I can't remember the specifics for
> SVC allows you to execute authorized code in YOUR address space.
> It does not allow you to execute code in any arbitrary address space.
There is no YOUR address space. E.g. Getmain belongs to RSM but run authorized
in any address space that uses the getmain macro.
>From a product
Hello list,
I am Alicia, content designer for IBM Configuration Assistant for z/OS
Communications Server. IBM Configuration Assistant for z/OS Communications
Server, also known as Network Configuration Assistant or NCA, provides a
guided interface to help you create and manage TCP/IP profiles,
MFA is utter goodness and I would 100% encourage its use but you might note
that some (many?) shops use it only for their more privileged TSO userids, not
for all userids.
Charles
-Original Message-
From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf
Of
On Wed, 4 Sep 2019 22:46:24 +0300, ITschak Mugzach wrote:
>Not at all. Removing the user parameter from job card will limit use to
>cics. Surrohat will work on all environments.
True. But you can create one or more user IDs with less authority than
the CICS region's user ID has and give the
Hi Ross,
Thanks very much for the reply. We are currently evaluating IBM's MFA for zOS
as well as other products. If I have questions I will contact you. I agree with
you that it seems best to keep MFA on the mainframe.
At this point, I am hoping to hear from other mainframe shops using a
Not at all. Removing the user parameter from job card will limit use to
cics. Surrohat will work on all environments.
ITschak
בתאריך יום ד׳, 4 בספט׳ 2019, 22:24, מאת Tom Marchant <
000a2a8c2020-dmarc-requ...@listserv.ua.edu>:
> Does surrogate authority help?
>
>
> One argument management offers in mitigation is that most of these CICS users
> don't have TSO, so they > haven't the ability to submit batch jobs.
What art they smoking? If "There are CICS transactions that fire off batch
jobs; " then they have the ability to submit batch jobs. It's a
Cross-posted to Linux-390, IBMVM, and IBM-Main
All,
In the wake of the separation of SUSE from Micro Focus, the publishing
process for SUSE documentation is no longer owned by Micro Focus. This
is a heads-up to warn you of the coming changes, and to solicit your
help if problems are found.
The
Does surrogate authority help?
https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.icha700/surru.htm
--
Tom Marchant
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to
Bob,
few comments:
1. You don't need to specify user= in the job card. any job submitted
under CICS without propagation control, will be assigned the CICS userid.
2. can cics end users manipulate the jcl they are submitting or it is
just submitted by the transaction? I hope they
Hi Jim,
Compliance with an auditing requirement may not specify a specific platform
or architecture for MFA implementation but in my opinion there are many
benefits to keeping as much of the authentication process on the mainframe
as possible.
Many clients prefer to keep the mainframe security
On Wed, 4 Sep 2019 14:06:21 -0400, Bob Bridges wrote:
>
>One argument management offers in mitigation is that most of these CICS users
>don't have TSO, so they haven't the ability to submit batch jobs. Off-hand I
>can't contradict them, but I'm skeptical. I'm thinking there's probably a way
If they have 'job' authority, they can submit a JOB via SYSOUT(A,INTRDR)
On Wed, Sep 4, 2019 at 2:06 PM Bob Bridges wrote:
> Not sure where to ask this, but I've wondered about it off and on for a
> while and it's past time I asked. I'm responsible for security at a
> mainframe shop where they
ftp comes to mind, if submitting from a cics region I think that's more secure
because IIRC the CICS SYSPROG needs to set this up?
Carmen Vitullo
- Original Message -
From: "Rex Pommier"
To: IBM-MAIN@LISTSERV.UA.EDU
Sent: Wednesday, September 4, 2019 1:15:46 PM
Subject: Re:
On Wed, Sep 4, 2019 at 1:06 PM Bob Bridges wrote:
> Not sure where to ask this, but I've wondered about it off and on for a
> while and it's past time I asked. I'm responsible for security at a
> mainframe shop where they use a lot of CICS. There are CICS transactions
> that fire off batch
SDSF has the capability of submitting jobs, FTP can copy JCL to an internal
reader for a couple ways just off the top of my head.
-Original Message-
From: IBM Mainframe Discussion List On Behalf Of Bob
Bridges
Sent: Wednesday, September 4, 2019 1:06 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Not sure where to ask this, but I've wondered about it off and on for a while
and it's past time I asked. I'm responsible for security at a mainframe shop
where they use a lot of CICS. There are CICS transactions that fire off batch
jobs; the way this place handles it is to submit the job
SMPE with current HOLDDATA received:
REPORT MISSINGFIX ZONES()
FIXCAT(
IBM.Coexistence.z/OS.V2R2,
IBM.Coexistence.z/OS.V2R3).
Does anyone know for sure how long V2R3 is orderable? My guess would be end
of September 2019 when 2.4 is GA?
Dana
On Fri, 30 Aug 2019 17:19:57 +, David
Whoever in your organization handles User Administration for the IBM Support
Site needs to verify that you have FULL (access to all cases in the the account
number) as opposed to BASIC (you only see your own cases). If your company has
multiple account numbers, that can complicate things. If
On Tue, 3 Sep 2019 21:14:35 +, Jesse 1 Robinson wrote:
>You can use another model's stool only if it's inverse left-handed as clearly
>required in the tech doc for that CPU. So there.
"I am his mentor, Hippocrates. I sent him to school where he learned to stand
up for principle and to sit
On Tue, 3 Sep 2019 23:32:03 +, Ambros, Thomas
wrote:
>Anybody know how, in the "upgraded" IBMLink, how one searches for PMRs opened
>by their account and not just their own? I unchecked the "Search my service
>requests submitted online only" selection and selected "Search all service
Yes, Apache POI (the Java API for Microsoft Documents) should be able to
create Microsoft Excel (.xls) format files on z/OS. It's a set of Java
APIs, of programming libraries. You would install and use it just as you
would any other Java APIs on z/OS. xlsx4j (docx4j) is another possibility
if
Hi, you realize that the 25th of July 2019 has already gone by??? :)
Brian
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
why? He said that there is no sysplex involved, just what is it that he would
not be compatible with in a fall back scenario between 2.1 and 2.4? You would
be pretty hard pressed to find something that would cause them an issue, so
long as the hardware is compatible with 2.4 they are good to
N+anything is almost completely irrelevant in a non-sysplex environment. There
really is very little to be incompatible that would make a difference to a
fallback. The part that really matters in non-sysplex is that you actually
leave yourself with something to "fall back" to.
Brian
26 matches
Mail list logo
