Writing Resource Rules › LOGON-BY › Important Group Machine Information

Important Group Machine Information

Important details apply to the system entry process for logging onto group virtual machines.

• A user cannot log onto a machine with the AUTOONLY privilege, regardless of whether that machine is a group machine. Invalid logon attempts are reported in the Invalid Password/Authority Log (ACFRPTPW).
• Password suppression is an IBM security feature that is implemented in the PSUPRS operand of the SYSJRL macro. It forces you to enter your password on a separate line from your logonid when you log on. Your password is not displayed when you enter it.

  If this feature is turned off, CA ACF2 for z/VM does not accept your password on the same line as your logonid. For example, if you try to log onto the MAINT group machine as a group user (by supplying your own password) or as the machine itself (by supplying the MAINT password), CA ACF2 for z/VM denies access and sends the following error message:

  logon maint password
  ACFpgm278I Logon for groupid ‑‑ password will be ignored
  

  When you log onto a group machine as a group user, you do not need to be defined as a user ID in the VM directory. The only prerequisite for a group user is that the user is defined with a logonid record in the Logonid database. You must always define the group machine with a logonid record and a user ID in the VM directory.

• Every time someone attempts to gain access to the system on a machine with the GRPLOGON privilege, CA ACF2 for z/VM automatically looks for a group logon resource rule. This occurs regardless of the CA ACF2 for z/VM data access mode setting and any special privileges the user has.