Storing security information (CCASTAT) - Revision history

Dme: /* Creating CCASTAT */

2019-03-12T04:08:01Z

Creating CCASTAT

← Older revision		Revision as of 04:08, 12 March 2019
Line 7:		Line 7:
	For additional information about security and modification of CCASTAT, see [[Establishing and maintaining security]]. </p>		For additional information about security and modification of CCASTAT, see [[Establishing and maintaining security]]. </p>

	==Creating CCASTAT==		==<b id="zbldtab"></b>Creating CCASTAT==
	<p>		<p>
	Before you can turn on any security options, you must create a prototype password table using the utility program ZBLDTAB. </p>		Before you can turn on any security options, you must create a prototype password table using the utility program ZBLDTAB. </p>
Line 68:		Line 68:
	<p class="code">UPSI 00010000		<p class="code">UPSI 00010000
	</p>		</p>

	==Using CCASTAT==		==Using CCASTAT==

Dme: /* z/OS procedures */

2019-03-12T04:06:57Z

z/OS procedures

← Older revision		Revision as of 04:06, 12 March 2019
Line 17:		Line 17:
	<p>		<p>
	Use the following z/OS JCL to create CCASTAT:</p>		Use the following z/OS JCL to create CCASTAT:</p>
	<p class="code">//EXEC PGM=ZBLDTAB,REGION=50K		<p class="code">//RUNZBLDT EXEC PGM=ZBLDTAB,REGION=50K
	//STEPLIB DD DSN=M204.LOADLIB,DISP=SHR		//STEPLIB DD DSN=M204.LOADLIB,DISP=SHR
	//CCASTAT DD DSN=M204.CCASTAT,UNIT=3330,		//CCASTAT DD DSN=M204.CCASTAT,UNIT=3330,

JAL: minor formatting

2018-09-04T16:58:13Z

minor formatting

JDamon: /* Expanding CCASTAT on disk */

2018-08-30T22:48:52Z

Expanding CCASTAT on disk

← Older revision		Revision as of 22:48, 30 August 2018
Line 196:		Line 196:
	===Expanding CCASTAT on disk===		===Expanding CCASTAT on disk===
	<p>		<p>
	The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can be expanded, on disk, by simply copying the current data set to a larger, physical-sequential data set, with the same LRECL, BLKSIZE and RECFM, using any sequential-data-set-copy utility such as IBM's IEBGENER. ZBLDTAB/ZCTLTAB cannot be used to expand an existing CCASTAT data set because those utilities completely re-initialize and rebuild CCASTAT, and save only the single userid, SUPERKLUGE.		The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can be expanded, on disk, by simply copying the current data set to a larger, physical-sequential data set, with the same LRECL, BLKSIZE and RECFM, using any sequential-data-set-copy utility such as IBM's IEBGENER. ZBLDTAB or ZCTLTAB cannot be used to expand an existing CCASTAT data set because those utilities completely re-initialize and rebuild CCASTAT, and save only the single userid, SUPERKLUGE.
	</p>		</p>

JDamon: /* Expanding the size of the password table on disk */

2018-08-30T22:40:47Z

Expanding the size of the password table on disk

← Older revision		Revision as of 22:40, 30 August 2018
Line 194:		Line 194:
	Refer to [[#z/VSE procedures\|z/VSE procedures]] for instructions on creating CCASTAT and z/VSE-specific considerations.</p>		Refer to [[#z/VSE procedures\|z/VSE procedures]] for instructions on creating CCASTAT and z/VSE-specific considerations.</p>

	===Expanding ~~the size of the password table~~ on disk===		===Expanding CCASTAT on disk===
	<p>		<p>
	The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can ~~be moved or copied with any sequential-data-set-copy utility such as IBM's IEBGENER. CCASTAT can also~~ be expanded, on disk, by simply copying the current data set to a larger, physical-sequential data set, of the same LRECL, BLKSIZE and RECFM~~, again~~, using ~~for example,~~ IBM's IEBGENER ~~utility~~. ZBLDTAB/ZCTLTAB cannot be used to expand an existing CCASTAT data set because those utilities completely re-initialize and rebuild CCASTAT, and save only the single userid, SUPERKLUGE.		The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can be expanded, on disk, by simply copying the current data set to a larger, physical-sequential data set, with the same LRECL, BLKSIZE and RECFM, using any sequential-data-set-copy utility such as IBM's IEBGENER. ZBLDTAB/ZCTLTAB cannot be used to expand an existing CCASTAT data set because those utilities completely re-initialize and rebuild CCASTAT, and save only the single userid, SUPERKLUGE.
	</p>		</p>

JDamon: /* Expanding the size of the password table on disk */

2018-08-30T22:19:01Z

Expanding the size of the password table on disk

← Older revision		Revision as of 22:19, 30 August 2018
Line 196:		Line 196:
	===Expanding the size of the password table on disk===		===Expanding the size of the password table on disk===
	<p>		<p>
	The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can be moved or copied with any sequential-data-set-copy utility such as IBM's IEBGENER. CCASTAT can also be expanded ~~in size~~, on disk, by simply copying the current data set to a larger, physical-sequential data set, of the same BLKSIZE and RECFM, again using for example, IBM's IEBGENER utility. ZBLDTAB/ZCTLTAB cannot be used to expand an existing CCASTAT data set ~~since all entries are deleted~~ and only the userid, SUPERKLUGE~~, is added~~		The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can be moved or copied with any sequential-data-set-copy utility such as IBM's IEBGENER. CCASTAT can also be expanded, on disk, by simply copying the current data set to a larger, physical-sequential data set, of the same LRECL, BLKSIZE and RECFM, again, using for example, IBM's IEBGENER utility. ZBLDTAB/ZCTLTAB cannot be used to expand an existing CCASTAT data set because those utilities completely re-initialize and rebuild CCASTAT, and save only the single userid, SUPERKLUGE.
	</p>		</p>

JDamon: Added a section on expanding the size of the CCASTAT data set.

2018-08-30T21:04:08Z

Added a section on expanding the size of the CCASTAT data set.

← Older revision		Revision as of 21:04, 30 August 2018
Line 194:		Line 194:
	Refer to [[#z/VSE procedures\|z/VSE procedures]] for instructions on creating CCASTAT and z/VSE-specific considerations.</p>		Refer to [[#z/VSE procedures\|z/VSE procedures]] for instructions on creating CCASTAT and z/VSE-specific considerations.</p>

			===Expanding the size of the password table on disk===
			<p>
			The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can be moved or copied with any sequential-data-set-copy utility such as IBM's IEBGENER. CCASTAT can also be expanded in size, on disk, by simply copying the current data set to a larger, physical-sequential data set, of the same BLKSIZE and RECFM, again using for example, IBM's IEBGENER utility. ZBLDTAB/ZCTLTAB cannot be used to expand an existing CCASTAT data set since all entries are deleted and only the userid, SUPERKLUGE, is added
			</p>

	===Backing up the password table===		===Backing up the password table===
	<p>		<p>
Line 306:		Line 311:
	<li>Job A updates the password table.</li>		<li>Job A updates the password table.</li>

	<li>When Job A updates, <var class="product">Model 204</var> reads a current copy of the disk version of the password table into ~~core~~. Because this copy was made after Job B's updates, it contains Job B's updates; therefore, Job A has access to Job B's updates. However, Job B does not have access to Job A's updates. Job B must update the password table again to get a current copy of the disk version of the password table data set. </li>		<li>When Job A updates, <var class="product">Model 204</var> reads a current copy of the disk version of the password table into virtual storage. Because this copy was made after Job B's updates, it contains Job B's updates; therefore, Job A has access to Job B's updates. However, Job B does not have access to Job A's updates. Job B must update the password table again to get a current copy of the disk version of the password table data set. </li>
	</ol>		</ol>

	==Overview of the Password Expiration feature==		==Overview of the Password Expiration feature==
	<p>		<p>

JDamon: Further clarification on adding entries

2018-08-30T20:45:19Z

Further clarification on adding entries

← Older revision		Revision as of 20:45, 30 August 2018
Line 263:		Line 263:
	===Updates that exceed allocated storage===		===Updates that exceed allocated storage===
	<p>		<p>
	A password table update by Job A can increase the number of entries in the CCASTAT data set on disk. This might make the disk version too large to fit into the ~~core~~ storage allocated for the table by a concurrently running job, Job B, that attempts a subsequent update to the table. For example:</p>		A password table update, by Job A, can increase the number of password entries in the CCASTAT data set on disk. This might make the disk version too large to fit into the virtual storage allocated for the table, during initialization, by a concurrently running job, Job B, that attempts a subsequent update to the table. For example:</p>
	<ol>		<ol>
	<li>Job A and Job B are concurrently running copies of <var class="product">Model 204</var> using the same password table data set. Job A has <var>LOGADD</var> set to 7; Job B has it set to 5.</li>		<li>Job A and Job B are concurrently running copies of <var class="product">Model 204</var> using the same password table data set. Job A has <var>LOGADD</var> set to 7; Job B has it set to 5.</li>
Line 269:		Line 269:
	<li>Job A updates the password table, adding six passwords.</li>		<li>Job A updates the password table, adding six passwords.</li>

	<li>Job B cannot update because not enough storage to hold the new disk version of the password table ~~was allocated~~. </li>		<li>Now Job B cannot update CCASTAT because not enough virtual storage was allocated (due to LOGADD=5), to hold the new (after the update by Job A) disk version of CCASTAT (the password table). </li>
	</ol>		</ol>
	<p>		<p>

JDamon: Clarification of increasing the number of entries in CCASTAT

2018-08-30T20:24:12Z

Clarification of increasing the number of entries in CCASTAT

← Older revision		Revision as of 20:24, 30 August 2018
Line 263:		Line 263:
	===Updates that exceed allocated storage===		===Updates that exceed allocated storage===
	<p>		<p>
	A password table update can ~~enlarge~~ the disk ~~version, which~~ might make the disk version too large to fit into the core storage allocated for the table by a concurrently running job that attempts a subsequent update to the table. For example:</p>		A password table update by Job A can increase the number of entries in the CCASTAT data set on disk. This might make the disk version too large to fit into the core storage allocated for the table by a concurrently running job, Job B, that attempts a subsequent update to the table. For example:</p>
	<ol>		<ol>
	<li>Job A and Job B are concurrently running copies of <var class="product">Model 204</var> using the same password table data set. Job A has <var>LOGADD</var> set to 7; Job B has it set to 5.</li>		<li>Job A and Job B are concurrently running copies of <var class="product">Model 204</var> using the same password table data set. Job A has <var>LOGADD</var> set to 7; Job B has it set to 5.</li>
Line 293:		Line 293:
	<li>Job A does not have enough storage even though both jobs specified the same value for <var>LOGADD</var>. Job B initialized after Job A updated the password table and, as a result, Job B was allocated a greater amount of core storage during initialization. </li>		<li>Job A does not have enough storage even though both jobs specified the same value for <var>LOGADD</var>. Job B initialized after Job A updated the password table and, as a result, Job B was allocated a greater amount of core storage during initialization. </li>
	</ol>		</ol>

	===Multiple copies of Model 204===		===Multiple copies of Model 204===
	<p>		<p>

JDamon: Added a note about secondary extents

2018-08-30T20:11:34Z

Added a note about secondary extents

← Older revision		Revision as of 20:11, 30 August 2018
Line 25:		Line 25:
	<ul>		<ul>
	<li>You can specify any direct access unit and any BLKSIZE. If no BLKSIZE is specified, ZBLDTAB assigns a default BLKSIZE of 6302 bytes.</li>		<li>You can specify any direct access unit and any BLKSIZE. If no BLKSIZE is specified, ZBLDTAB assigns a default BLKSIZE of 6302 bytes.</li>

	<li>Each password table entry that does not have terminal security requires 26 bytes. (For more information, see [[Establishing and maintaining security\|Terminal security]].)</li>		<li>Secondary extents, if defined in the SPACE parameter, will be taken (as needed), as new entries are added and the data set grows.</li>

			<li>Each password table entry that does not have terminal security requires 26 bytes. (For more information, see [[Establishing and maintaining security\|Terminal security]].)</li>
	</ul>		</ul>

	===z/VM procedures===		===z/VM procedures===
	<p>		<p>

← Older revision		Revision as of 16:58, 4 September 2018
Line 26:		Line 26:
	<li>You can specify any direct access unit and any BLKSIZE. If no BLKSIZE is specified, ZBLDTAB assigns a default BLKSIZE of 6302 bytes.</li>		<li>You can specify any direct access unit and any BLKSIZE. If no BLKSIZE is specified, ZBLDTAB assigns a default BLKSIZE of 6302 bytes.</li>

	<li>Secondary extents, if defined in the SPACE parameter, will be taken (as needed), as new entries are added and the data set grows.</li>		<li>Secondary extents, if defined in the SPACE parameter, will be taken (as needed) as new entries are added and the data set grows. </li>

	<li>Each password table entry that does not have terminal security requires 26 bytes. (For more information, see [[Establishing and maintaining security\|Terminal security]].)</li>		<li>Each password table entry that does not have terminal security requires 26 bytes. (For more information, see [[Establishing and maintaining security\|Terminal security]].)</li>
Line 196:		Line 196:
	===Expanding CCASTAT on disk===		===Expanding CCASTAT on disk===
	<p>		<p>
	The CCASTAT data set is a simple, physical-sequential data set. Therefore, it can be expanded, on disk, by simply copying the current data set to a larger, physical-sequential data set, with the same LRECL, BLKSIZE and RECFM, using any sequential-data-set-copy utility such as IBM's IEBGENER. ZBLDTAB or ZCTLTAB cannot be used to expand an existing CCASTAT data set because those utilities completely re-initialize and rebuild CCASTAT, ~~and save~~ only the single ~~userid~~, SUPERKLUGE.		The CCASTAT data set is a simple physical-sequential data set. Therefore, it can be expanded on disk by simply copying the current data set to a larger physical-sequential data set, with the same LRECL, BLKSIZE, and RECFM, using any sequential-data-set-copy utility, such as IBM's IEBGENER. </p>
			<p>
			ZBLDTAB or ZCTLTAB cannot be used to expand an existing CCASTAT data set, because those utilities completely re-initialize and rebuild CCASTAT, saving only the single user ID, <code>SUPERKLUGE</code>.
	</p>		</p>

Line 261:		Line 263:
	The password table can be updated by concurrently running copies of <var class="product">Model 204</var> without preventing a subsequent update to the same table. In order for concurrently running copies of <var class="product">Model 204</var> to update the password table, the in-core version of the table must have sufficient core storage allocated to it by the run. The amount of core storage allocated is determined by: </p>		The password table can be updated by concurrently running copies of <var class="product">Model 204</var> without preventing a subsequent update to the same table. In order for concurrently running copies of <var class="product">Model 204</var> to update the password table, the in-core version of the table must have sufficient core storage allocated to it by the run. The amount of core storage allocated is determined by: </p>
	<ul>		<ul>
	<li>Size of CCASTAT when <var class="product">Model 204</var> was initialized </li>		<li>Size of CCASTAT when <var class="product">Model 204</var> was initialized </li>

	<li>Value of the <var>[[LOGADD parameter\|LOGADD]]</var> parameter</li>		<li>Value of the <var>[[LOGADD parameter\|LOGADD]]</var> parameter </li>
	</ul>		</ul>

	===Updates that exceed allocated storage===		===Updates that exceed allocated storage===
	<p>		<p>
	A password table update, by Job A, can increase the number of password entries in the CCASTAT data set on disk. This might make the disk version too large to fit into the virtual storage allocated for the table, during initialization, by a concurrently running job, Job B, that attempts a subsequent update to the table. For example:</p>		A password table update, by Job A, can increase the number of password entries in the CCASTAT data set on disk. This might make the disk version too large to fit into the virtual storage allocated for the table, during initialization, by a concurrently running job, Job B, that attempts a subsequent update to the table. For example:</p>
	<ol>		<ol>
	<li>Job A and Job B are concurrently running copies of <var class="product">Model 204</var> using the same password table data set. Job A has <var>LOGADD</var> set to 7; Job B has it set to 5.</li>		<li>Job A and Job B are concurrently running copies of <var class="product">Model 204</var> using the same password table data set. Job A has <var>LOGADD</var> set to 7; Job B has it set to 5. </li>

	<li>Job A updates the password table, adding six passwords.</li>		<li>Job A updates the password table, adding six passwords. </li>

	<li>Now Job B cannot update CCASTAT because not enough virtual storage was allocated (due to LOGADD=5), to hold the new (after the update by Job A) disk version of CCASTAT (the password table). </li>		<li>Now Job B cannot update CCASTAT because not enough virtual storage was allocated (due to LOGADD=5) to hold the new (after the update by Job A) disk version of CCASTAT (the password table). </li>
	</ol>		</ol>
	<p>		<p>
Line 309:		Line 311:
	<li>Job A does not have access to Job B's updates at this point.</li>		<li>Job A does not have access to Job B's updates at this point.</li>

	<li>Job A updates the password table.</li>		<li>Job A updates the password table. </li>

	<li>When Job A updates, <var class="product">Model 204</var> reads a current copy of the disk version of the password table into virtual storage. Because this copy was made after Job B's updates, it contains Job B's updates; therefore, Job A has access to Job B's updates. However, Job B does not have access to Job A's updates. Job B must update the password table again to get a current copy of the disk version of the password table data set. </li>		<li>When Job A updates, <var class="product">Model 204</var> reads a current copy of the disk version of the password table into virtual storage. Because this copy was made after Job B's updates, it contains Job B's updates; therefore, Job A has access to Job B's updates. However, Job B does not have access to Job A's updates. Job B must update the password table again to get a current copy of the disk version of the password table data set. </li>
Line 316:		Line 318:
	==Overview of the Password Expiration feature==		==Overview of the Password Expiration feature==
	<p>		<p>
	The Password Expiration feature enhances the <var class="product">Model 204</var> CCASTAT security feature to manage password expiration and includes the changes described in this section.</p>		The Password Expiration feature enhances the <var class="product">Model 204</var> CCASTAT security feature to manage password expiration and includes the changes described in this section. </p>

	===Tracking the days a password is valid===		===Tracking the days a password is valid===