IBM OS/390 manual Administration Considerations, Tmeadmin Class, Password History Changes

Chapter 7. Administration Considerations

This chapter summarizes the changes to administration procedures that administrator should be aware of. For more OS/390information,Securitysee

Server (RACF) Security Administrator's. Guide

The TMEADMIN Class

The	new TMEADMIN class is used to associate a TME						administrator	with	a
MVS	identity	on	any MVS system that	is	part	of	a Tivoli management		re
The	TMEADMIN	class	contains a profile	for	each	TME	administrator	who	is

perform RACF user management tasks. The name of this profile is the T administrator string name. For example:

admin-login-name@TME-region-name

The hex code for @ is x'7C'. You need to use the key on your key provides that hex value. Sharing of a single RACF user ID by multiple administrators is not recommended. It is preferable that each TME ad map to a unique RACF user ID.

In

the

following

example, the

TME

administrator root

in

the

Tivoli

TMR r

pok01 would have a RACF user ID

of

CSMITH.

The APPLDATA

field of

this

contains

the

RACF

MVS userid.

Only

a

RACF

administrator

with

SPECIAL

autho

can

issue

this

command:

RDEFINE

TMEADMIN root@pokð1 APPLDATA('CSMITH')

For more information on the TMEADMIN

class,

see

“Tivoli

Management

Environment

(TME)

10

Global Enterprise

Management User Administration Service

on

page 8.

Password History Changes

When	an administrator	resets a password for	a user, the	old	passwor
the password history list. This is done with the use of				one	of th
commands:
ALTUSER (userid ...) PASSWORD
ALTUSER (userid ...) PASSWORD(password)
PASSWORD USER(userid ...)
For	more information,	see “Password History	Enhancements” on	page 7.

Program Control by System ID

Program control by system ID limits a user's access to a particular specified system. It improves system management and usability of pro products in the sysplex environment. In addition, it eliminates error-p procedures, eliminates the need to keep DASD that is not shared, an the possibility of license exposures.

 Copyright IBM Corp. 1994, 1997 31