IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Determine Missing Authority when using CTLSPEC in Command Verifier

    Posted 03/04/20 11:15 PM
    We are attempting to use Control System Special for our administrators that could be using zSecure ISPF or Visual.    

    We have granted the administrators access to the following profiles to give them access to the specific commands needed for user administration:
    C4R.ADDGROUP.=CTLSPEC
    C4R.ADDUSER.=CTLSPEC
    C4R.ALTGROUP.=CTLSPEC
    C4R.ALTUSER.=CTLSPEC
    C4R.CONNECT.=CTLSPEC
    C4R.DELGROUP.=CTLSPEC
    C4R.DELUSER.=CTLSPEC
    C4R.LISTUSER.=CTLSPEC

    I have also given them the following permissions so they can access the fields/attributes/segments on the User IDs:
    C4R.USER.ATTR.AUDITOR.**
    C4R.USER.ATTR.OPERATIONS.**
    C4R.USER.ATTR.RESTRICTED.**
    C4R.USER.ATTR.ROAUDIT.**
    C4R.USER.ATTR.SPECIAL.**
    C4R.USER.ATTR.UAUDIT.**
    C4R.USER.CICS
    C4R.USER.CSDATA
    C4R.USER.DFLTGRP.**
    C4R.USER.ID.**
    C4R.USER.INSTDATA.**
    C4R.USER.MFA
    C4R.USER.NAME.**
    C4R.USER.NETVIEW
    C4R.USER.OMVS
    C4R.USER.OWNER.**
    C4R.USER.PASSWORD.**
    C4R.USER.TSOC4R.USER.**

    Right now I am keeping the profiles very generic until I test the approach of using CTLSPEC.    I may make the profiles more specific to limit the User IDs the administrators can administer.

    So when I try to add a user it typically ends with messages like this:
    adduser PWTEST04 password(?) name('PSWD SYNC TEST      ') owner(DSAPP10) dfltgrp(DSAPP10)
    C4R638I Uncontrolled options prevented use of Controlled Temporary Special: Group
    ICH01011I INSUFFICIENT AUTHORITY.
    ICH01010I USER(S) NOT ADDED.
    CKX962F Command failed, return code 8 (decimal)

    On the syslog we see messages like this:
    21:59:28 ICH408I USER(LGSTEST ) GROUP(G0046390) NAME(CTLSPEC TEST ID-LGS )
    21:59:28   FULL VIOLATION ON COMMAND ADDUSER


    I realize it's a issue with access  to a Command Verifier profile, but there is nothing to tell me which profile.   How do you perform problem resolution on the issue?    Typically in a lot of instances if Command Verifier stops a command from happening you see the ICH408I and the $POLICY profile that prevented the command from running.

    Thanks for the assistance.






    ------------------------------
    Linnea Sullivan
    ------------------------------


  • 2.  RE: Determine Missing Authority when using CTLSPEC in Command Verifier

    Posted 03/05/20 04:00 AM
    Linnea,
    This sounds very similar to an issue you had already raised with zSecure support where the resolution was to grant access to the relevant C4R.CONNECT.ID.<group>.<user> profile.

    I have already opened a serviceability request, in agreement with zSecure Development, to consider issuing extra ICH408I messages in cases where we drop into a C4R638I message situation. I also note that you've opened a Request For Enhancement (RFE) along the same lines.
    These requests will be considered by zSecure Developement and Offering Management as usual.
    Regards, Mike

    ------------------------------
    Mike Riches
    ------------------------------



  • 3.  RE: Determine Missing Authority when using CTLSPEC in Command Verifier

    Posted 03/05/20 11:31 PM
    Thanks, I realize I been dealing with this on several fronts.  Sorry about that, but we are really trying to get this to work.    I did create a C4R.CONNECT.ID.** and that resolved the issue.  But another C4R638I message surfaced on the CONNECT.  I defined for now a C4R.CONNECT.** so that I can see what else is needed.    That did allow the ADDUSER command to complete.

    ------------------------------
    Linnea Sullivan
    ------------------------------

    Original Message


  • 4.  RE: Determine Missing Authority when using CTLSPEC in Command Verifier

    Posted 03/05/20 04:48 AM
    Edited by Rob van Hoboken 03/06/20 03:55 AM
    Hi Linnea

    The DFLTGRP(DSAPP10) parameter implies creation of a connect to this group.  Connects are controlled/protected by the C4R.CONNECT.ID.group.user policy profiles.  Message  C4R638I indicates that there is no profile for resource C4R.CONNECT.ID.DSAPP10.PWTEST04

    Did you create a C4R.CONNECT.ID.** policy profile?

    You are right, the value Group in msg C4R638I is somewhat generic, it would have been more helpful if the message had pointed to Dfltgrp, but then the message description should have pointed out that DFTLGRP leads to verification of several policies.  Connect would lead to similar confusion.

    The Command Verifier User Guide contains a table of the policies verified due to =CTLSPEC.  Around page 50.


  • 5.  RE: Determine Missing Authority when using CTLSPEC in Command Verifier

    Posted 03/05/20 11:35 PM
    Thanks for the assistance.   Yes, I had to define 2 CONNECT profiles to get it to work for now.   I made them rather generic for now just to get the functionality working.    I will go back later and make the profiles more discrete.

    I did see the table in the 2.3.1 manual, that is where I saw it could be multiple CONNECT profiles.   So for now when I get the C4R638I I will just need to "play" around to determine which profile is needed.

    Now that we have Access Monitor running, I assume I could look at that data to see what resource it was trying to validate?

    ------------------------------
    Linnea Sullivan
    ------------------------------

    Original Message


Related Content