View source for LOGCTL command: Modifying user ID entries in the password table

==Summary==
<dl>
<dt>Privileges
<dd>System manager
<dt>Function
<dd>Adds, deletes, or changes login user ID entries in the password table
</dl>

==Syntax==
<p class="syntax">LOGCTL [{NP | P} CMS] 
       <span class="squareb">|</span> [{A | D |C} <span class="term">userid</span> [NOEXPIRE]]       
</p>
 
Where:
<ul> 
<li><code>NP CMS</code> specifies that <var class="product">Model&nbsp;204</var> bypass password prompts for z/VM users. <code>P CMS</code> reinstitutes password prompts for z/VM users. Refer to [[Defining the user environment (CCAIN)#Bypassing password prompts|Bypassing password prompts]] for information on the automatic login facility under&nbsp;z/VM.   </li>

<li><var>A, D,</var> or <var>C</var> specifies to add, delete, or change, respectively, a login user ID.</li>

<li><var class="term">userid</var> is the name, one to ten characters long, of the login user ID to be added, deleted, or changed.    </li>

<li><var>NOEXPIRE</var> allows the specified <var class="term">userid</var> a password that does not expire, regardless of the settings of the security parameters, <var>PWDEXP</var> and <var>PWDWARN</var>.

<p class="note"><b>Note:</b> If you issue a <code>LOGCTL C</code> command and do not change the password, the expiration status is unchanged. If the password is changed, it will expire unless <var>NOEXPIRE</var> is specified. The <var>NOEXPIRE</var> option is an attribute associated with a specific password.</p></li>
</ul>

==Usage notes==
The system manager can change any of the following specifications in a login user ID entry:
<ul> 
<li>Password</li>
 
<li>User privileges</li>
 
<li>Priority</li>
 
<li>Terminal list</li>
</ul>
<p>
When a login user ID entry is being changed, all responses are optional.</p>

===Changing a user ID entry===
<p>
The <var>LOGCTL</var> command adds, deletes, or changes login user ID entries in the password table. If add (<var>A</var>) or change (<var>C</var>) is specified, <var class="product">Model&nbsp;204</var> prompts for information as shown in the following dialog:</p>
<p class="code"><b>LOGCTL A USER1 </b>
<b></b>*** M204.0374: ENTER PASSWORD,PRIVILEGES,PRIORITY 
<b><i>password,X'pp',priority</i></b>
<b></b>*** M204.2633: RE-ENTER NEW PASSWORD
<b><i>password</i></b>
<b></b>*** M204.0379: ENTER TERMINAL LIST, ALL, NONE, ADD, DEL OR RETURN
<b>ALL</b>
<b></b>USER1       X'FF'     HIGH    ALL    
<b></b>*** M204.0376: PARAMETERS ACCEPTED
<b></b>*** M204.0345: CCASTAT UPDATED 
</p>

====Syntax for command dialog====
<ul>
<li>In response to the M204.0374 prompt (see example above):
<p class="syntax"><span class="term">password</span> [,<span class="term">X'pp'</span>] [,<span class="term">priority</span>]
</p>
<blockquote class="note">
<p><b>Note:</b> If the system manager omits an entry (comma retained to denote an omitted entry), the system does not supply the default but preserves the corresponding entry in the password table. For example:</p>
<p class="syntax">LOGCTL C USER1 
newpw,,HIGH
</p>
<p>
If the privilege byte is X'01' in the password table for <code>USER1</code>, and if a privilege byte is not specified in the command (denoted by comma placement), <var class="product">Model&nbsp;204</var> preserves the privilege byte of X'01' and does not replace it with the default of X'00'. This is true also for password and priority.</p>
<p>
Additional valid examples of omitted entries follow: </p>
<p class="code">,X'01',HIGH
newpw,X'01',
newpw,X'01'
,,HIGH
</p></blockquote></li>

<li>In response to the M204.0379 terminal list prompt (see example above):
<p class="syntax">{<span class="term">terminal</span> [,<span class="term">terminal</span>...] | ALL | NONE
 | ADD <span class="term">terminal</span> [,<span class="term">terminal</span>...] 
 | DEL <span class="term">terminal</span> [,<span class="term">terminal</span>...]}
</p></li>
</ul>

====Arguments for the responses to the command prompts====
<table> 
<tr>
<th>password</th>
<td>The user's password may contain:
<ul>
<li>One to eight characters (Model 204 version 7.6 or earlier). </li>

<li>One to 127 characters (Model 204 version 7.7 or later). </li>

<li>May not contain commas.  However, commas are allowed when the password is changed with the <var>[[LOGONCP command|LOGONCP]]</var> or the <var>[[$Sir_Login]]</var> function.</li>

<li>May contain blanks and special characters.  However, leading and trailing blanks are stripped.</li>

</ul>
If the Password Expiration feature is installed, the user's password must:
<ul> 
<li>Not be the same as the <var>[[USERID parameter|USERID]]</var> value, the current password, or the previous password.</li>
 
<li>Be six, seven, or eight characters long (Model&nbsp;204 version 7.6 or earlier), or be at least six characters long and up to a maximum of 127 characters (Model 204 version 7.7 or later).</li>
 
<li>Begin with an alphabetic character.</li>
 
<li>Include at least one numeric character.</li>
</ul>
<p>
If the Password Expiration feature has been installed at your site, the following message is issued to confirm your password: </p>
<p class="code">M204.2633: RE-ENTER NEW PASSWORD
</p>
</td></tr>
 
<tr>
<th>pp</th>
<td>A one-byte representation of the user's privileges. The default privileges are X'00'. The privilege byte can be any combination of the settings (in hexadecimal) shown in the following table. 
<table>
   
<tr class="head"> 
<th>Setting</th> 
<th>User is allowed to...</th> </tr>
   
<tr> <th><var>X'80'</var></th> 
<td>Create a file with the <var>CREATE</var> command (Superuser privileges).
</td> </tr>
 
<tr> <th><var>X'40'</var></th> 
<td>Issue certain privileged commands (System administrator privileges). Such commands include <var>LOGWHO</var>, <var>MONITOR</var>, <var>PRIORITY</var>, <var>WARN</var>, and so on.</td> </tr>
 
<tr> <th><var>X'20'</var></th> 
<td>Change the file password when it is used to open a file.</td> </tr>
 
<tr> <th><var>X'10'</var></th> 
<td>Change the login password when logging into the system.</td> </tr>
 
<tr> <th><var>X'08'</var></th> 
<td>Issue certain privileged commands such as <var>LOGCTL</var>, <var>DUMPG</var>, and <var>IFAMDRAIN</var> (System manager privileges).</td> </tr>
 
<tr> <th><var>X'04'</var></th> 
<td>Override record security. </td> </tr>
</table>
</td></tr>
 
<tr>
<th>priority</th>
<td>One of the following:
<ul> 
<li>NONE (the default)</li>
 
<li>LOW</li>
 
<li>STANDARD</li>
 
<li>HIGH</li>
</ul>
</td></tr>
 
<tr>
<th>terminal</th>
<td>The number of a terminal from which a user can issue a <var>[[LOGIN or LOGON command|LOGIN]]</var> command for this user ID. 
<ul> 
<li>If the system manager presses &lt;Return> in response to the <code>TERMINAL LIST</code> prompt, <var class="product">Model&nbsp;204</var> assumes a default of ALL terminals. </li>
 
<li>If an installation does not use terminal security features, the system manager must enter ALL or allow <var class="product">Model&nbsp;204</var> to supply the default terminal setting. </li>
</ul>
</td></tr>
</table>

==Mixed-case passwords==
<p>
Mixed-case passwords improve login security. They are supported for:</p>
<ul> 
<li>Logins via the RACF, ACF2, and TOP SECRET interfaces</li>
 
<li>Logins using CCASTAT passwords</li>
</ul>
<p>
To enable mixed-case login password support, set the <var>[[CUSTOM parameter|CUSTOM]]</var> parameter in CCAIN. </p>
<p>
To store a mixed-case-login password in CCASTAT, specify the <var>[[*LOWER command|*LOWER]]</var> command before any <var>LOGCTL</var> command that adds or changes a login password.</p>
<p>
CCASTAT passwords can never be displayed, so if a user's password is rejected, use the <var>LOGCTL</var> command to change that user's password and try again.</p>
<p class="note"><b>Note:</b> Mixed-case passwords are not supported for files. Lowercase passwords stored in CCASTAT for files can never be used to open a file or file group.</p>

===Example of adding a logon ID with lowercase password===
<p>
To use passwords containing lowercase characters, the Online environment  must have a <code>CUSTOM=11</code> parameter setting in the CCAIN parameter stream:</p>
<p class="code">//CCAIN DD * 
LOGADD=200,CUSTOM=11
</p>
<p class="note"><b>Note:</b>  With this setting in place, automatic translation of password strings into uppercase is disabled. Any existing passwords that were saved in uppercase would need to be entered in uppercase.</p>
<p>
To add a login ID (<b>always</b> translated to upper case) and a password with lowercase characters, issue the following:  </p>
<p class="code">LOGIN SYSADMIN	 
password 
<b></b>********************************************************* 
<b></b>* Ensure CUSTOM=11 is set and caps lock is <b>off</b>  
<b></b>********************************************************* 
<b></b>* Add new login id and password with lowercase characters  
<b></b>********************************************************* 
LOGCTL A NEWID 
<b></b>***  M204.0374: ENTER PASSWORD,PRIVILEGES,PRIORITY 
<b></b>MiXCaSe,X'10',STANDARD 
<b></b>***  M204.0379: ENTER TERMINAL LIST, ALL, NONE, ADD, DEL, OR RETURN 
<b></b>ALL 
<b></b>NEWID       X'10'     STANDARD    ALL    
<b></b>*** M204.0376: PARAMETERS ACCEPTED
<b></b>*** M204.0345: CCASTAT UPDATED 
<b></b>********************************************************* 
<b></b>* Login with new Login ID 
<b></b>********************************************************* 
LOGIN NEWID 
MiXCaSe
</p>

==Using the NOEXPIRE parameter==
<p>
If after running the ZCTLTAB utility you want to maintain some user IDs with passwords that do not expire, you must include the <var>NOEXPIRE</var> parameter in every <var>LOGCTL</var> command that makes any other change to that user ID. Otherwise, the user ID and password become subject to expiring like all other accounts.</p>
<p>
The corollary action is also true: if you want to reset a user ID so that the password is subject to expiring, simply execute a <var>LOGCTL</var> command for that user ID omitting the <var>NOEXPIRE</var> parameter. </p>

===Understanding the password creation date===
<p>
The password creation date is the basis for calculating the warning, expiration, and purge periods. If you issue a <code>LOGCTL C</code> command against a user ID and do not change the password, the password creation date is not changed.</p>
<p>
The exception to this rule is when the <var>NOEXPIRE</var> keyword is specified, then the date calculations are irrelevant.</p>

===Handling expired passwords===
<p>
When a user ID is suspended because the password expired or too many successive incorrect passwords were entered, the system manager may reactivate the user ID by issuing the <var>LOGCTL</var> command to change the password for the user ID.</p>
<p>
A password is required when changing a login entry that has been revoked or has expired. If the system manager attempts to change another login user ID option without entering a password, the following message is issued and the command is rejected: </p>
<p class="code">M204.2641: A NEW PASSWORD MUST BE ENTERED: THE CURRENT ONE {HAS EXPIRED | WAS REVOKED}
</p>

[[Category: System manager commands]]
[[Category:Commands]]