Running the Security Configurator (SECCONF)

You have just selected the function to specify 

PASSWORD ENCRYPTION option. This function allows 

you to turn the encryption ON or OFF.



Encryption is currently ON.

Please specify your new choice (ON/OFF):

This function allows the user to specify the value for the minimum 

password length. This value is applicable to USER, ACCOUNT, GROUP and 

device passwords (but not lockwords). 



Minimum password length currently is: 0

Please enter your choice (0-8):

This function allows you to specify the maximum number 

of invalid logons that a device can tolerate before it 

becomes unavailable (DOWNed). You can specify a number 

between 1 and 32766, or a zero (0) which is unlimited.

 

Maximum invalid attempts currently is: 4

Please enter your choice (0-32766):



Since you just set the maximum invalid logon count, you 

may want to configure a timeout interval, during which a 

violated device would be in the DOWN state. After that 

interval expires, MPE will automatically UP the device. 

The interval can be from 1 to 32766 seconds, or Zero (0). 

A zero means there is no automatic timeout, and the 

Operator must :UP the device manually.



The currently configured device timeout is: 0 

Please enter your choice (0-32766):

You have just selected the function to specify whether 

password prompts are mandatory for interactive logons.  

When this option is ON, MPE will not accept logon 

commands with embedded passwords, such as 



:HELLO USER/UPASS.ACCT/APASS



Mandatory Password Prompt is currently OFF (i.e. embedded passwords OK).

Please specify your new choice (ON/OFF):ON



Mandatory Password Prompt is now ON.



Since you've just enabled the mandatory password prompt option, you may 

want to consider exempting REMOTE HELLO from this rule. You might have 

applications which log on remotely from within a job, or do REMOTE HELLO 

programmatically. These applications will fail if the DS/NS terminals are 

not exempted.



Do you want to exempt DS/NS terminals from forced prompting (Yes/No) ?yes



DS/NS terminals are now EXEMPT.





Do you want to exempt DS/NS terminals from forced prompting (YES/NO)

The Global Timeout value currently is: 0

Please enter your choice (0 - 546):

You have just selected the function to specify the 

logon message option. Your choice is between using 

existing MPE friendly messages, or the generic, 

no-hint logon interface, which only say * INVALID * 

when logon error exists.



Generic Logon Message is currently OFF.

Please specify your new choice (ON/OFF):

You have just selected the function to specify whether 

a job/session is to be terminated if the initiation of 

UDC at logon time fails for any reason.  When this 

option is ON, it prevents users from bypassing your 

system logon UDC.



UDC Failure Termination is currently OFF (disabled).

Please specify your new choice (ON/OFF):

You have just selected the function to specify whether 

to log all FOPENs or only the ones that failed.

FOPEN LOGGING OPTION is currently: FOPEN FAILURE ONLY

Do you want to keep this option: 'logging FOPEN FAILURES ONLY' (Yes/No):

          

            GLOBAL PASSWORD MANAGEMENT VALUES



         0. Exit to Global Security Menu

         1. Global User Password Expiration Date 

         2. Global User Password Maximum Lifetime

         3. Global User Password Minimum Time

         4. Global User Password Warning Time

         5. Global User Password Expiration Time

 

            Please enter your choice (0-5):

  

         



            BATCH SUBMISSION SECURITY



         0. Exit to Global Security Menu

         1. Embedded Password Disallowed Option

         2. Cross Streaming Restriction Option

         3. Stream Privileges Option



            Please enter your choice (0-3):

You have just selected the function to configure whether

the auditability is to be assured when there is a system 

logging error.  When this option is ON, MPE will execute 

a CONTROL-A LOGOFF if a system logging error occurs.  At 

that time, only users with OP or SM capability can log on 

to the  system and try to correct the problem  and resume 

logging or shutdown the system.



Assurance of Auditability is currently OFF

Please specify your new choice (ON/OFF):

You have just selected the function to configure whether 

a NEWLY created object is going to be maximally protected.  

When this option is ON, MPE will configure the CREATOR of 

the object to be the only user who can access the object 

if no ACD is attached to that object.



Maximum Protection is currently OFF

Please specify your new choice (ON/OFF):

This function allows you to specify the maximum number 

of invalid user logons before the user ID becomes invalid.

You can specify a number between 1 and 32766, or zero (0)

which is unlimited.



Maximum invalid attempts currently is: 4

Please specify your new choice (0-32766):



Since you just set the maximum invalid logon count,

you may want to configure a timeout interval, during 

which a user ID will remain invalid.  After that time 

interval expires, MPE will automatically change the user

ID to valid.  The interval can be from 1 to 32766 

seconds, or zero (0).  A zero means there is no automatic

timeout, and the account manager or system manager must

re-activate the user.



The timeout is currently : 0



Please enter your choice (0-32766)

This function allows you to set the maximum protection for all

of the Global Security Options.  Use the LIST command to verify

the selections are acceptable.



Do you want to set all Global Security Options to maximum

protection (YES/NO):YES



Maximum protection has been set to maximum.

Following the "Command >" prompt, please enter the 

MPE COMMAND that you want to log or disable access.  

Once the command is verified to be a valid command,

you will be asked for the logging and access options 

for that command.



To terminate you input, enter "//" or a carriage return in response 

to the "command>" prompt.



If you want a list of all commands that are currently 

configured in the security table, enter "@".



Command > CONSOLE



CONSOLE    Prog. Access ON    General Execution ON  Logging OFF



        Programmatic Access Disabled (Yes/No) ?YES

        General Execution Disabled (Yes/No) ?YES

        Logging Enabled (Yes/No) ?YES



CONSOLE 	   Prog. Access OFF   General Execution OFF  Logging ON

All Others:        Prog. Access ON    General Execution ON   Logging OFF

Command>

Command > @



CONSOLE    Prog. Access OFF   General Execution OFF    Logging ON

PURGEACCT  Prog. Access OFF   General Execution OFF    Logging ON

ALTSEC     Prog. Access OFF   General Execution OFF    Logging ON

Since Command disabling may affect the functioning of 

your present programs and subsystems, you may want to 

set the Programmatic Access to WARNING level first.



At warning level, a command, when executed 

programmatically, will only cause the command to be 

logged via the Command Logging facility and a message to be sent to 

$STDLIST.

Then, after you have examined the system log files to 

ascertain that the disabled commands do not adversely 

affect your applications, you can reset the WARN flag 

to go to full disabling level (execution causes an error).



PROGRAMMATIC ACCESS LEVEL is currently: FULL DISABLING.



Do you want to change this to 'WARNING LEVEL' (Yes/No) ?

You have selected the choice to enable a disabled user ID.

The prompt will be repeated until you enter a (user.account) name 

or end your input with a "//" or carriage return.



Enter the user ID to enable (user.account):mgr.test

Enable mgr.test (YES/NO):YES

User  mgr.test  has been enabled

You have selected the choice to enable an invalid user password.

The prompt will be repeated until you enter a (user.account) name 

or end your input with a "//" or a carriage return.

The password will be set expired.

Enter the invalid user ID (Name.Account):

Enable the password for Name.Account (Yes/No):

User Name.Account is now expired

You have selected the choice to set the user password aging values.

Enter the user ID to set (name.account): mgr.test

Set the age values for MGR.TEST (YES/NO): yes

The maximum user password time currently is: 20

Enter the new maximum user password time (0-365 days) :50 

The user expiration time currently is: 0

Enter the new user expiration time (0-20 days) : 10

The user minimum password time currently is: 0

Enter the new minimum user password time (0-30 days) : 10

The user password warning time currently is: 0

Enter new user password warning time (0-10 days) : 5

The user password aging values have been updated.

This option set all users to PASSWORD REQUIRED. A selected  account,

accounts selected with a wild card, or all accounts if you enter @ for

the selection.  Users with blank passwords will have their passwords

set expired.

This option removes the user password required option.  A selected

account, accounts selected with a wild card, or all accounts if you

enter @ for the selection.