XUA: How to enable UAGROUP SAFEGUARD-PRIVLOGON

XUA: How to enable UAGROUP SAFEGUARD-PRIVLOGON

As of Netbatch SPR T9190AER NetBatch now supports SAFEGUARD Security-Group privileges.
Safeguard PRIV-LOGON functionality available beginning with Safeguard releases H06.11 and G06.32.

The from_user must be $EVERYONE or $EVERYONE-NET as the NETBATCH attempts specific types of logins. If a specific user such as SUPER.SUPER is specified as the FROM_USER, when they fail, other login types are attempted, and causes multiple NO-UAGROUP-FOUND entries for a single job.

To enable SAFEGUARD_PRIVLOGON in XUA

1. Add or modify a UAGROUP to set SAFEGUARD_PRIVLOGON ON 

For Netbatch add the REQUESTOR for the following objects.

$SYSTEM.SYSTEM.NETBATCH

For SSH add the REQUESTOR for the following objects.

$SYSTEM.ZSSH.SSH2
$SYSTEM.ZSSH.ELP
$SYSTEM.ZSSH.STN
$SYSTEM.ZSSH.SFTPSERV
$SYSTEM.SYSnn.IMON


Example:
UAGROUP SAFEGUARD-PRIVLOGON
   DESCRIPTION "Safeguard Privlogon feature"
   FROM_USER           $EVERYONE-NET
   TO_USER                 $EVERYONE
   REQUESTOR           $SYSTEM.XYGATEAC.XYGATEAC
                       $SYSTEM.ZSSH.SSH2
                       $system.zssh.elp
                       $system.zssh.stn
                       $system.zssh.sftpserv
                       $system.system.netbatch
                       $system.sys16.imon
   SAFEGUARD_PRIVLOGON ON
   AUDIT_ACCESS_PASS        OFF
   AUDIT_ACCESS_FAIL          ON

2. Add Safeguard DISKFILE records for the REQUESTOR object files and set attribute PRIV-LOGON to ON. 

Example:

TACL> SAFECOM
= ADD DISKFILE $SYSTEM.ZSSH.SSH2, PRIV-LOGON ON, OWNER 253,1, ACCESS \*.253,1 (R,W,E,P,C,O)
= ALTER DISKFILE $SYSTEM.ZSSH.SSH2, ACCESS \*.*,* (R,E)
=EXIT



If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.