Previous Topic: Protecting ACCOUNT UseNext Topic: Protecting the DIAL Command

Writing Resource Rules › Protecting the AUTOLOG and XAUTOLOG Commands

Protecting the AUTOLOG and XAUTOLOG Commands

This section provides some guidelines to follow when you implement AUTOLOG and XAUTOLOG command control. The following terms are used in this section:

Initiator Machine

Indicates the virtual machine (or user of that machine) who issues the AUTOLOG or XAUTOLOG command.

Target Machine

Indicates the virtual machine that is autologged using the AUTOLOG or XAUTOLOG command.

Password Suppression

Specifies an option that applies to the AUTOLOG, XAUTOLOG, and LOGON (not LINK) command. When you must supply a password with AUTOLOG or XAUTOLOG, this option requires that you enter the password following a prompt. The password is automatically suppressed by CA ACF2 for z/VM. If you enter the password on the same line as the AUTOLOG command, CA ACF2 for z/VM rejects the command when password suppression is in effect. CA ACF2 for z/VM cannot recognize a password that you enter on the same line as the AUTOLOG command.

Special CA ACF2 for z/VM logonid attributes for the AUTOLOG and XAUTOLOG command include:

AUTONOPW

Indicates a virtual machine with this privilege can be autologged without specifying a password. AUTONOPW has no effect on the logon process. The user of a machine with this privilege can log on using normal logon procedures.

AUTOALL

Indicates a virtual machine with this privilege can autolog any virtual machine without specifying a password, no matter what privileges the machines being autologged might have. Like AUTONOPW, AUTOALL has no effect on the logon process. The user of a machine with this privilege can log on using normal logon procedures.

Complete the following steps to implement the AUTOLOG command control:

  1. Establish the appropriate command limiting controls to let users execute the AUTOLOG and XAUTOLOG commands. Implementation for these controls is at your discretion. The initiator machine must have the appropriate CP privileges for the AUTOLOG command.
  2. Implement password suppression if required. Use HCPAC0 VMXAOPTS PSWDSUP=YES.
  3. Establish AUTOLOG resource rule sets that let target virtual machines be autologged.
  4. Determine which users can autolog or be autologged without passwords. Assign AUTOALL or AUTONOPW logonid privileges accordingly.