FTPSERVE Fails When Given Only RACF READ Access Authority
APAR Identifier ...... PQ21409 Last Changed ........ 99/02/16
FTPSERVE FAILS WHEN GIVEN ONLY RACF READ ACCESS AUTHORITY
Symptom ...... DD DOC Status ........... CLOSED DOC
Severity ................... 4 Date Closed ......... 99/02/16
Component .......... 5735FAL00 Duplicate of ........
Reported Release ......... 310 Fixed Release ............
Component Name TCP/IP V2 FOR V Special Notice
Current Target Date .. Flags
SCP ...................
Platform ............
Status Detail: APARCLOSURE - APAR is being closed.
PE PTF List:
PTF List:
Parent APAR:
Child APAR list:
ERROR DESCRIPTION:
Customer followed the instructions provided in Appendix C of
"TCP/IP Function Level 310 Planning and Customization." to
enable the FTP server to use the RACROUTE facility. When
completing Step 2, the customer issued:
PERMIT ICHCONN CLASS(FACILITY) ID(FTPSERVE) ACCESS(READ)
This command complete successfully. However when the
FTP server was initialized, the following messages were
issued:
RACROUTE VERIFY call returns SafRc=00000004,RacfReas=00000020
RACROUTE cannot be used for minidisk authorization
Command "SRVRFTP inactive 1800 racf anonymou" ended with rc 0.
Issuing command "exec FTPDEXIT ABORT 0 SRVRFTP inactive 1800
racf anonymou"...
After issuing a second PERMIT command to change the Access
authority from "READ" to "UPDATE", FTP server initialization
was successful. The existing documentation is not correct; the
provided access authority MUST be "UPDATE".
LOCAL FIX:
PROBLEM SUMMARY:
****************************************************************
* USERS AFFECTED: Installations that plan to use the FTP *
* server in a RACF ESM (External Security *
* Manager) environment. *
****************************************************************
* RECOMMENDATION: UPDATE DOCUMENTATION *
****************************************************************
Information about RACF authorization requirements for the FTP
server in "TCP/IP Function Level 310 Planning and
Customization" is not correct.
The documentation in "Appendix C", "RACF Authorization
Requirements" of this publication incorrectly indicates that
providing the FTP server with READ authority is sufficient when
this server is enabled to use the RACROUTE facility. This is
not the case; the FTP server MUST be given UPDATE authority, as
indicated in the sample PERMIT command shown in this section.
PROBLEM CONCLUSION:
The revised information that follows will be included in any
future updates to the following publication(s):
SC24-5847-00 -- TCP/IP Function Level 310 Planning and
Customization
Appendix C, "Using TCP/IP with an External Security
Manager", p. 513
In the section titled "RACF Authorization Requirements", for
the second bullet or list item, which reads:
"The FTP and NFS servers must be enabled to use the RACROUTE
facility:"
the text for "Step 2" is not correct. The existing text:
2. Give READ or UPDATE access authority to FTP servers:
PERMIT ICHCONN CLASS(FACILITY) ID(userid | groupid)
ACCESS(UPDATE)
should instead be:
2. Give UPDATE access authority to FTP servers:
PERMIT ICHCONN CLASS(FACILITY) ID(userid | groupid)
ACCESS(UPDATE)
TEMPORARY FIX:
COMMENTS:
MODULES/MACROS:
SRLS: SC31584700
RTN CODES:
CIRCUMVENTION:
MESSAGE TO SUBMITTER:
|
