|
View previous topic :: View next topic
|
| Author |
Message |
Kevin Santos
New User
Joined: 27 Jan 2009
Posts: 26
Location: toronto
|
|
|
|
| Is it possible to capture the terminal-id of the user executing a rexx pgm running under TSO and then forcing a logoff or killing the TSOID (c u=xxxxxx) of the user executing the rexx? |
|
| Back to top |
|
 |
Kevin Santos
New User
Joined: 27 Jan 2009
Posts: 26
Location: toronto
|
|
|
|
As an example:
Tom signs on to TSO, and executes a 'forbidden' rexx pgm eg: TSO EXEC "PROD.CLIST(FORBID)".
The forbidden pgm captures Tom's terminal-id then logs him off of his TSO session or force him off ie; issues a C U=TOM. |
|
| Back to top |
|
|
MBabu
Active User
Joined: 03 Aug 2008
Posts: 400
Location: Mumbai
|
|
|
|
| Sure, if he has authority to cancel his id. But why would you ever need to do this? Is this some sort of substitute for real security? If you set up your security right, it shouldn't matter what the user does - they won't have access to sensitive information. Getting around this type of fake 'security' would take an experienced user about than 20 seconds to bypass. |
|
| Back to top |
|
|
MBabu
Active User
Joined: 03 Aug 2008
Posts: 400
Location: Mumbai
|
|
|
|
| I might add that if a program randomly logged me off, I'd go searching for the reason and, as I said, would find it in under a minute. |
|
| Back to top |
|
|
Kevin Santos
New User
Joined: 27 Jan 2009
Posts: 26
Location: toronto
|
|
|
|
| Mbabu, it appears that way, but it's not. this will not compromise real security. this is on top of our already over killed security + strict internal and external security audits. I just need this as an add-on adhoc reporting |
|
| Back to top |
|
|
dick scherrer
Moderator Emeritus
Joined: 23 Nov 2006
Posts: 19243
Location: Inside the Matrix
|
|
|
|
Hello,
| Quote: |
| Tom signs on to TSO, and executes a 'forbidden' rexx pgm eg: TSO EXEC "PROD.CLIST(FORBID)". |
fwiw - i'd suggest that this and other "magic bullets" be placed in a library that Tom did not have any access permissions. . . Then there would be racf/acf2/tss denial and tracking. . . |
|
| Back to top |
|
|
PeD
Active User
Joined: 26 Nov 2005
Posts: 459
Location: Belgium
|
|
|
|
And Tom will have everytime the same terminal id??
If Tim comes and is supposed to have permission but - poor guy - uses the Tom's terminal ! |
|
| Back to top |
|
|
Peter Poole
New User
Joined: 07 Jan 2009
Posts: 50
Location: Scotland
|
|
|
|
Meanwhile, back at the question...
Yes, it is possible.
Whether or not you should, depends on context.
If you need to hammer home a point to someone that they should not mess with some execs, fair enough. (Though simply checking the userid and exiting the exec with an appropriate message might also work)
If it's in anyway related to production or system security, my 10 pence would be no, there are much better ways to do it with your site's real security software. (Assuming your site has some)
Cheers. |
|
| Back to top |
|
|
Kevin Santos
New User
Joined: 27 Jan 2009
Posts: 26
Location: toronto
|
|
|
|
doable but how???????  |
|
| Back to top |
|
|
Kevin Santos
New User
Joined: 27 Jan 2009
Posts: 26
Location: toronto
|
|
|
|
nevermind. thanks for the responses
fyi
sysvar(systermid) |
|
| Back to top |
|
|
dick scherrer
Moderator Emeritus
Joined: 23 Nov 2006
Posts: 19243
Location: Inside the Matrix
|
|
|
|
Hello,
FWIW - many systems no longer use fixed terminal-ids - they are assigned dynamically. |
|
| Back to top |
|
|
Kevin Santos
New User
Joined: 27 Jan 2009
Posts: 26
Location: toronto
|
|
|
|
^^ Good point thanks.
My adhoc REXX pgm will run on a LPAR using fixed termids. |
|
| Back to top |
|
|
Pragati Soni
New User
Joined: 18 Jan 2008
Posts: 47
Location: India
|
|
|
|
Terminal ids can be captured using variable zuser.
For instance
"ISPEXEC VGET (CL ZUSER)"
USRID = ZUSER
SAY USRID
Here usrid will contain the id.
| Kevin Santos wrote: |
^^ Good point thanks.
My adhoc REXX pgm will run on a LPAR using fixed termids. |
|
|
| Back to top |
|
|
Pedro
Global Moderator
Joined: 01 Sep 2006
Posts: 2593
Location: Silicon Valley
|
|
|
|
Terminal Id is not the same thing as an User Id. One represents hardware and the other represents a person. Variable ZUSER will contain a userid.
Perhaps variables ZLUNAME or ZIPPORT can be used to determine the terminal id. |
|
| Back to top |
|
|
|
|
