Keyboard Shortcuts
Likes
Search
Probably a stupid question - concerning Master Catalog Passwords
开云体育Sorry to ask another, probably stupid question and take up space but – I am at a loss to understand this and assume others have not had this issue. ? Jay Mosley’s instuctions homebuilt MVS3.8j system – working perfectly.???? Master Catalog – ‘sys1.vsam.master.catalog’ has as part of the build process a updatepw set to the value of SYSPROG – I understand the value of doing this. ? Any Batch jobs making a modification, console prompts me for the password – a reply to the message like? R12, SYSPROG works perfectly, the job is successful, obvious the password is working perfectly.???? Have written several JCL jobs that allocate a dataset or whatever that requires an update and they work fine. ? Here’s the issue ----?? In TSO, either with a ALLOC or where I first found this and thought I was stupid, in RPF 4.2 Allocate a dataset – set what I want, enter A – Get a clear screen, prompt for the Catalog password – I enter it, letter by letter carefully – get a response of *** and allocation failed.?? Try it in uppercase, lowercase, won’t work.?? Same at the TSO command prompt using ALLOC – it will not accept the password. ? Thought it was just me being stupid – but I conducted the following test, I wrote/ran a IDCAMS job, ALTER to NULLIFY the password, submitted it as a batch job, console notified me, entered the pw, success RC=0 -?? Now no password ? Tried using RPF 3.2 again -? works like a charm – same with ALLOC. ? Is there some secret to entering the password interactively???? Is something wrong with my build of MVS??? And I just insane??? I would like to put the password back but I also need for things like ind$file to be able to enter it at a TSO prompt and have it accepted. ? I assume most of you all use a Master Catalog password but no hits googling this issue, so that means I am doing something wrong, but what? ? Thanks, Dave – N8ZFM ? ? |
No magic secret here, or anywhere else in the universe as far as I know.
I t would be useful to know what message appears, not by magic, on the console. For example in case of wrong password
?
IEC331I 056-002,HMVS01 ,IKJACCNT,RCU ,IGG0CLBM
return code 056 = a security verification failed
reason code 002 = the user did not have the required authority ?
In case of other messages, it is necessary to verify which one it is and take the necessary measures reported in the sacred texts a.k.a. IBM manuals
?
Marco
|
I think you have misunderstood the value of password protecting the MASTER CATALOG.
It is there to prevent you from 'accidentally' updating it. Let me give you some background.
Before VSAM, the master catalog had to be on the IPL volume and also with the VSAM MCAT,
you do not want to have individual non-system datasets cataloged in the MCAT.
The reason is that you wish to have a simple way to upgrade your MVS or try a new version of
the system by just IPLing a different pack.
By having the datasets belonging to batch application systems or individual TSO users catloged
in a user catalog you eliminate a lot of catalog synchronization by re-connecting your existing
user catalogs to the new MCAT (when you have to build a new one).
The turnkey MVS systems are already set up with usercatalogs connections for the already
existing TSO users and there are probably procedures/JOBs for creating new TSO users which
include setting up connections to usercatlogs.
By convention, TSO users use there userid as the high-level-qualifyer and batch applications have
individual HLQs. Thus you have a relatively stable set of catalog connectors to add to a recreated MCAt.
This scheme also fits well with SMS ACS routines (on more recent MVS levels) and RACF protection.
Thus normal use of the MVS system will not update the MASTER CATALOG!
Anders Edlund |
开云体育I truly do understand why I would want to protect the master catalog, I just do not understand and need to correct the fact that the MCAT password would fine with a batch mode job that does an update to the MCAT, prompts me and accepts the password, but in an interactive TSO session, I get prompted for the MCAT password but it will not accept it.?? ? There is some difference on my system as built, that is causing this issue, but there are no logs that I can find or a specific error message to provide additional info (that I know of), TSO simply won’t accept the password, while batch job processing does, the only difference is that batch is on the local console session instead of a VTAM user session, but that should not make a difference. ? It for sure would be easier for me to use a TK system rather than my “do it yourself” version.??? Jay Mosley has spent considerable errort on his excellent instructions and I think him very much.?? I do not believe I would be able to learn as much without building this as I have. ? I do not really require security at all, as I am the only user but it still should work.? And an unresolved error, regardless if I need that function or not, is kinda unacceptable to me and will bother me until I know how to resolve it. ? Thanks, Dave ? From:
<[email protected]> on behalf of "andersedlund via groups.io" <andersedlund@...> ? I think you have misunderstood the value of password protecting the MASTER CATALOG. It is there to prevent you from 'accidentally' updating it. Let me give you some background. Before VSAM, the master catalog had to be on the IPL volume and also with the VSAM MCAT, you do not want to have individual non-system datasets cataloged in the MCAT. The reason is that you wish to have a simple way to upgrade your MVS or try a new version of the system by just IPLing a different pack. By having the datasets belonging to batch application systems or individual TSO users catloged in a user catalog you eliminate a lot of catalog synchronization by re-connecting your existing user catalogs to the new MCAT (when you have to build a new one). The turnkey MVS systems are already set up with usercatalogs connections for the already existing TSO users and there are probably procedures/JOBs for creating new TSO users which include setting up connections to usercatlogs. By convention, TSO users use there userid as the high-level-qualifyer and batch applications have individual HLQs. Thus you have a relatively stable set of catalog connectors to add to a recreated MCAt. This scheme also fits well with SMS ACS routines (on more recent MVS levels) and RACF protection. Thus normal use of the MVS system will not update the MASTER CATALOG! Anders Edlund |
开云体育The message logged on the console at the failure (in TSO) is: ??????????????? IEC331I ???056-012,DAVE????? ,IKJACCNT,RCU ,IGG0CLB6 ? Which I agree means a “a security verification failed”.??? So my user account has authority.?? The obvious is that I can’t type SYSPROG correctly, but that is not the case. ??? ? Thanks, Dave – N8ZFM ? From:
<[email protected]> on behalf of "M Verpelli via groups.io" <marco.verpelli@...> ? No magic secret here, or anywhere else in the universe as far as I know. t would be useful to know what message appears, not by magic, on the console. For example in case of wrong password ? IEC331I 056-002,HMVS01 ,IKJACCNT,RCU ,IGG0CLBM return code 056 = a security verification failed ? In case of other messages, it is necessary to verify which one it is and take the necessary measures reported in the sacred texts a.k.a. IBM manuals ? Marco |
开云体育You know I found in the message archive this - /g/H390-MVS/topic/hosed_password_for/74966269 From 2020 -? My problem is almost the same as what Doug was experiencing then, and it does not seem to have been answered, the root is the inability to enter the MCAT password from TSO. ? Thank you Marco for prompting me to google search IEC331I 056-012. ? Thanks, ? From:
<[email protected]> on behalf of Dave Trainor - N8ZFM <dave@...> ? The message logged on the console at the failure (in TSO) is: ??????????????? IEC331I ???056-012,DAVE????? ,IKJACCNT,RCU ,IGG0CLB6 ? Which I agree means a “a security verification failed”.??? So my user account has authority.?? The obvious is that I can’t type SYSPROG correctly, but that is not the case. ??? ? Thanks, Dave – N8ZFM ? From:
<[email protected]> on behalf of "M Verpelli via groups.io" <marco.verpelli@...> ? No magic secret here, or anywhere else in the universe as far as I know. t would be useful to know what message appears, not by magic, on the console. For example in case of wrong password ? IEC331I 056-002,HMVS01 ,IKJACCNT,RCU ,IGG0CLBM return code 056 = a security verification failed ? In case of other messages, it is necessary to verify which one it is and take the necessary measures reported in the sacred texts a.k.a. IBM manuals ? Marco |
Hi Dave, If you use X3270 you can activate the trace and in the trace you can analyze what TSO receives when you enter the password. HTH 搁别苍é Le dimanche 12 janvier 2025 à 23:48:19 UTC+1, Dave Trainor - N8ZFM <dave@...> a écrit : You know I found in the message archive this -/g/H390-MVS/topic/hosed_password_for/74966269 From 2020 -? My problem is almost the same as what Doug was experiencing then, and it does not seem to have been answered, the root is the inability to enter the MCAT password from TSO. ? Thank you Marco for prompting me to google search IEC331I 056-012. ? Thanks, ? From:<[email protected]> on behalf of Dave Trainor - N8ZFM <dave@...> ? The message logged on the console at the failure (in TSO) is: ??????????????? IEC331I ???056-012,DAVE????? ,IKJACCNT,RCU ,IGG0CLB6 ? Which I agree means a “a security verification failed”.??? So my user account has authority.?? The obvious is that I can’t type SYSPROG correctly, but that is not the case.??? ? Thanks, Dave – N8ZFM ? From:<[email protected]> on behalf of "M Verpelli via groups.io" <marco.verpelli@...> ? No magic secret here, or anywhere else in the universe as far as I know. t would be useful to know what message appears, not by magic, on the console. For example in case of wrong password ? IEC331I 056-002,HMVS01 ,IKJACCNT,RCU ,IGG0CLBM return code 056 = a security verification failed ? In case of other messages, it is necessary to verify which one it is and take the necessary measures reported in the sacred texts a.k.a. IBM manuals ? Marco |
开云体育Dave, Not clear HOW you are attempting to supply the password – from TSO – I believe you need to enter it via the operator console – ? Please run the job – check the console – let me know – I am trying to remember – ? ? ?
-J- ? Jeff Bassett (301) 424-3362 (office) (240) 388-7148 Cell ? Time spent flying? - is NOT deducted from one’s lifespan ? From: [email protected] <[email protected]>
On Behalf Of Dave Trainor - N8ZFM via groups.io
Sent: Sunday, January 12, 2025 5:48 PM To: [email protected] Subject: Re: [H390-MVS] Probably a stupid question - concerning Master Catalog Passwords ? You know I found in the message archive this - /g/H390-MVS/topic/hosed_password_for/74966269 From 2020 -? My problem is almost the same as what Doug was experiencing then, and it does not seem to have been answered, the root is the inability to enter the MCAT password from TSO. ? Thank you Marco for prompting me to google search IEC331I 056-012. ? Thanks, ? From:
<[email protected]> on behalf of Dave Trainor - N8ZFM <dave@...> ? The message logged on the console at the failure (in TSO) is: ??????????????? IEC331I ???056-012,DAVE????? ,IKJACCNT,RCU ,IGG0CLB6 ? Which I agree means a “a security verification failed”.??? So my user account has authority.?? The obvious is that I can’t type SYSPROG correctly, but that is not the case. ??? ? Thanks, Dave – N8ZFM ? From:
<[email protected]> on behalf of "M Verpelli via groups.io" <marco.verpelli@...> ? No magic secret here, or anywhere else in the universe as far as I know. t would be useful to know what message appears, not by magic, on the console. For example in case of wrong password ? IEC331I 056-002,HMVS01 ,IKJACCNT,RCU ,IGG0CLBM return code 056 = a security verification failed ? In case of other messages, it is necessary to verify which one it is and take the necessary measures reported in the sacred texts a.k.a. IBM manuals ? Marco |
开云体育TSO prompts for the password, and I type it in.??? If it is a batch job then the console prompts me with a message requiring a response, and it accepts that no problem – IE the R xx type response.?? That works fine.?? ? IN TSO if you do an alloc, or same in RPF – the prompt for the password is on the TN3270 user session – however the response to the user in TSO is simply a *** and the command fails, no specific error reported – but the console reports the IEC331I 056-102 error for the user session. ? This is a pure Jay Mosley instruction generated system, using only material from Jay.?? And there is an example (right at the top) on one of his excellent web pages of a TSO session with the password prompt and correct response – so I know it can work.? . ? Something is awry and I would like to correct the issue.??? I have ban-aided it by simply removing the password, but the fact it should work and does not bugs the heck out of me, as a long time IT guy – “all errors must be corrected”.? ? Thanks, Dave ? From:
<[email protected]> on behalf of Jeff Bassett <bassettj@...> ? Dave, Not clear HOW you are attempting to supply the password – from TSO – I believe you need to enter it via the operator console – ? Please run the job – check the console – let me know – I am trying to remember – ? ? ? ? -J- ? Jeff Bassett (301) 424-3362 (office) (240) 388-7148 Cell ? Time spent flying? - is NOT deducted from one’s lifespan ? From: [email protected] <[email protected]>
On Behalf Of Dave Trainor - N8ZFM via groups.io
Sent: Sunday, January 12, 2025 5:48 PM To: [email protected] Subject: Re: [H390-MVS] Probably a stupid question - concerning Master Catalog Passwords ? You know I found in the message archive this - /g/H390-MVS/topic/hosed_password_for/74966269 From 2020 -? My problem is almost the same as what Doug was experiencing then, and it does not seem to have been answered, the root is the inability to enter the MCAT password from TSO. ? Thank you Marco for prompting me to google search IEC331I 056-012. ? Thanks, ? From:
<[email protected]> on behalf of Dave Trainor - N8ZFM <dave@...> ? The message logged on the console at the failure (in TSO) is: ??????????????? IEC331I ???056-012,DAVE????? ,IKJACCNT,RCU ,IGG0CLB6 ? Which I agree means a “a security verification failed”.??? So my user account has authority.?? The obvious is that I can’t type SYSPROG correctly, but that is not the case. ??? ? Thanks, Dave – N8ZFM ? From:
<[email protected]> on behalf of "M Verpelli via groups.io" <marco.verpelli@...> ? No magic secret here, or anywhere else in the universe as far as I know. t would be useful to know what message appears, not by magic, on the console. For example in case of wrong password ? IEC331I 056-002,HMVS01 ,IKJACCNT,RCU ,IGG0CLBM return code 056 = a security verification failed ? In case of other messages, it is necessary to verify which one it is and take the necessary measures reported in the sacred texts a.k.a. IBM manuals ? Marco |
开云体育Yes, and it gets the correct characters. ? Thanks, Dave – N8ZFM ? From:
<[email protected]> on behalf of "Rene BRANDT via groups.io" <rbr146@...> ? Hi Dave, Le dimanche 12 janvier 2025 à 23:48:19 UTC+1, Dave Trainor - N8ZFM <dave@...> a écrit : ? ? You know I found in the message archive this -/g/H390-MVS/topic/hosed_password_for/74966269 From 2020 -? My problem is almost the same as what Doug was experiencing then, and it does not seem to have been answered, the root is the inability to enter the MCAT password from TSO. ? Thank you Marco for prompting me to google search IEC331I 056-012. ? Thanks, ? From:<[email protected]> on behalf of Dave Trainor - N8ZFM <dave@...> ? The message logged on the console at the failure (in TSO) is: ??????????????? IEC331I ???056-012,DAVE????? ,IKJACCNT,RCU ,IGG0CLB6 ? Which I agree means a “a security verification failed”.??? So my user account has authority.?? The obvious is that I can’t type SYSPROG correctly, but that is not the case.??? ? Thanks, Dave – N8ZFM ? From:<[email protected]> on behalf of "M Verpelli via groups.io"
<marco.verpelli@...> ? No magic secret here, or anywhere else in the universe as far as I know. t would be useful to know what message appears, not by magic, on the console. For example in case of wrong password ? IEC331I 056-002,HMVS01 ,IKJACCNT,RCU ,IGG0CLBM return code 056 = a security verification failed ? In case of other messages, it is necessary to verify which one it is and take the necessary measures reported in the sacred texts a.k.a. IBM manuals ? Marco |
I have a vague memory that you needed to be a Sysprog / Operator defined tso user for some system functions rather than a plain tso user. It's a vague memory, but may be pertinent. Regards,
--- τσ尘
On Monday, 13 January 2025 at 20:18, Dave Trainor - N8ZFM <dave@...> wrote:
-- --
τσ尘 |
开云体育Correct, and my userid has those permissions OPER and ACCT both defined.? MVS 3,8j, plain vanilla, does not appear to have a lot of security besides that. ? Thanks, Dave – N8ZFM ? From:
<[email protected]> on behalf of "botongrui, aka τσ尘. via groups.io" <botongrui@...> ? I have a vague memory that you needed to be a Sysprog / Operator defined tso user for some system functions rather than a plain tso user. ? It's a vague memory, but may be pertinent. ? Regards, --- τσ尘 ? On Monday, 13 January 2025 at 20:18, Dave Trainor - N8ZFM <dave@...> wrote:
?
|
Dave,Thanks for confirming my aging grey cells do sometimes retrieve stuff from the archives, now you mentioned those keywords I remember having JCL MOUNT OPER ACT options on mine :-) Regards,
--- τσ尘
On Monday, 13 January 2025 at 20:37, Dave Trainor - N8ZFM <dave@...> wrote:
-- --
τσ尘 |
开云体育Just to update the group on this issue I experienced, and in the interest of increasing knowledge and so if anyone else has this issue. ? The 056-012 is a RACF failure error message, thi sonly occurs because I have a MVS 3.8j system built without RACF (which postdates MVS3.8j) or more importantly RAKF which is a part of the TK series releases.?? The problem occurs because I was using the excellet application RPF and the utility 3.2 menu to preform an alloc, with a master catalog password set, as per the standard build process defined by Jay Moseley.? ? RPF does a RACF check as part of its alloc, and thus fails to correctly pass the entered password to TSO, responds with a RACF failure error 056-012.?? If there is no master catalog password set, then RPF does not preform a check and its able to alloc as expected. So this condition only occurs given the specific set of circumstances.? ??Attempts by others, confirm this, and recompiling RPF from source with the RACF/RAKF check deselected do not correct the issue.?? Possibly Rob with look at this, however his software is an asset to have, and if you are aware of this and do not have a Mast Cat Password set, then its not a problem, or if you have RAKF installed and setup, its not a problem.? At the current time, you can choose to either, 1) Setup RAKF, 2) Nullify the Mast Cat password and choose not to have one, or 3) not use RPF for an alloc and only use batch jobs to preform allocations – I consider option 3 a poor choice. ? My purpose here is just that since I received no hits on google searching for the 056-012 error code in versions of MVS prior to MVS-XA, that ?I may save someone from head scratching and they will know the source, and how to bypass the condition. ? Many thanks on my part to those who helped me in determining the cause.? It required some hours and effort to track it all down and its much appreciated. ? Thanks, Dave Trainor, NBZFM Louisville, KY?? ? From:
Dave Trainor <dave@...> ? Correct, and my userid has those permissions OPER and ACCT both defined.? MVS 3,8j, plain vanilla, does not appear to have a lot of security besides that. ? Thanks, Dave – N8ZFM ? From:
<[email protected]> on behalf of "botongrui, aka τσ尘. via groups.io" <botongrui@...> ? I have a vague memory that you needed to be a Sysprog / Operator defined tso user for some system functions rather than a plain tso user. ? It's a vague memory, but may be pertinent. ? Regards, --- τσ尘 ? On Monday, 13 January 2025 at 20:18, Dave Trainor - N8ZFM <dave@...> wrote:
?
|
Many thanks for digging into this. I was just living with the issue and figured that I had built my MVS incorrectly; it's nice to understand what the cause is. On Tue, Jan 21, 2025 at 12:07 AM, Dave Trainor - N8ZFM wrote:
|
开云体育In case anyone needs this – here is the JCL to be able to remove the Master Catalog password – this was also difficult to find, as it seems it’s not really ever used. And probably to the experienced SysProg’s, its trivial.???? This removes the password completely.?? Nice to know Doug, that I am not the only one to have experienced this issue, and yeah, I believe all error conditions need to be fully understood and documented. ?I thought the same as you, that I had simply made some mistake in the sysgen process. ? //ALTMCPW??? JOB (1),DAVE,CLASS=A,MSGCLASS=A //STEP01?? EXEC PGM=IDCAMS,REGION=4096K //SYSPRINT DD SYSOUT=* //SYSIN??? DD * ???? ALTER SYS1.VSAM.MASTER.CATALOG - ??????? NULLIFY(UPDATEPW) // ? ? Thanks, Dave ? ? From:
<[email protected]> on behalf of Doug Wegscheid <dwegscheid@...> ? Many thanks for digging into this. I was just living with the issue and figured that I had built my MVS incorrectly; it's nice to understand what the cause is. On Tue, Jan 21, 2025 at 12:07 AM, Dave Trainor - N8ZFM wrote:
|