CA Top Secret Security for z/os CA RS 1803 Service List

Transcription

1 CA Top Secret Security for z/os CA RS 1803 List Description Type RO98826 LOOP IN PROGRAM SAFOEOTS WHEN SEARCHING UID TABLE PTF RO98925 ABEND S0C4 DURING RACR=EXTRACT TYPE=REPLACE ON AES128/AES256 PTF RO99650 ADD WBEM TO TSS STATIC RDT TABLE WITH POSIT=604 PTF RO99694 ABENDS 0C4 / 0C7 IN TSSKERNL MODULE TSSKECA (CEM) PTF RO99844 TSSCFILE NOT LISTING CRITERIA FOR CSFKEYS PTF RO99952 TSS REPLACE(XXXXX) PHRASE(*,0) NOT WORKING PTF SO00039 CICS: U734/U1800 AT INIT W/SYSLOG/OPERLOG ISSUES PTF SO00092 S0C4 ABEND IN TSSKERNL DURING USER LOGON PTF SO00139 NBDATE / NADATE ON REKEY OF CERTIFICATE PTF SO00140 MODI(CACHE(CLEAR)) CAUSES SECFILE SERVICES S0C4 PTF SO00170 PERMIT FACILITY RESTRICTIONS NOT LISTED CORRECTLY PTF SO00249 ABEND S0C4 ON TSS COMMAND WITH INVALID SUBFIELD DATA PTF SO00250 USER UNABLE TO LOGON WITH RADIUS CREDENTIALS PTF SO00254 TSS9993E INTERNAL SYSTEM ERROR W/ ACID REFRESH IN IMS PTF SO00262 S0C4 TSSMNGR+5DB1C AT STARTUP BUILDING UID EXTENSION TABLE **HIPER** SO00365 Z/OSMF REST API SECURITY FAILURE PTF SO00387 IMPROVE PERFORMANCE OF CHECK_PRIV PROCESSOR PTF The CA RS 1803 service count for this release is 17

2 CA Top Secret Security for z/os 2 CA RS 1803 List for FMID Description Type RO98826 LOOP IN PROGRAM SAFOEOTS WHEN SEARCHING UID TABLE PTF RO98925 ABEND S0C4 DURING RACR=EXTRACT TYPE=REPLACE ON AES128/AES256 PTF RO99650 ADD WBEM TO TSS STATIC RDT TABLE WITH POSIT=604 PTF RO99694 ABENDS 0C4 / 0C7 IN TSSKERNL MODULE TSSKECA (CEM) PTF RO99844 TSSCFILE NOT LISTING CRITERIA FOR CSFKEYS PTF RO99952 TSS REPLACE(XXXXX) PHRASE(*,0) NOT WORKING PTF SO00092 S0C4 ABEND IN TSSKERNL DURING USER LOGON PTF SO00139 NBDATE / NADATE ON REKEY OF CERTIFICATE PTF SO00140 MODI(CACHE(CLEAR)) CAUSES SECFILE SERVICES S0C4 PTF SO00170 PERMIT FACILITY RESTRICTIONS NOT LISTED CORRECTLY PTF SO00249 ABEND S0C4 ON TSS COMMAND WITH INVALID SUBFIELD DATA PTF SO00250 USER UNABLE TO LOGON WITH RADIUS CREDENTIALS PTF SO00254 TSS9993E INTERNAL SYSTEM ERROR W/ ACID REFRESH IN IMS PTF SO00262 S0C4 TSSMNGR+5DB1C AT STARTUP BUILDING UID EXTENSION TABLE **HIPER** SO00365 Z/OSMF REST API SECURITY FAILURE PTF SO00387 IMPROVE PERFORMANCE OF CHECK_PRIV PROCESSOR PTF The CA RS 1803 service count for this FMID is 16

3 CA Top Secret Security for z/os 3 CA RS 1803 List for CAKOG01 FMID Description Type CAKOG01 SO00039 CICS: U734/U1800 AT INIT W/SYSLOG/OPERLOG ISSUES PTF The CA RS 1803 service count for this FMID is 1

4 CA Top Secret Security for z/os CA RS PTF RO98826 RO98826 RO98826 M.C.S. ENTRIES = ++PTF (RO98826) LOOP IN PROGRAM SAFOEOTS WHEN SEARCHING UID TABLE A tight instruction loop can be seen in program SAFOEOTS (part of SAFOEDRV) when searching the UID table extension. The UID table extension is used to store new UIDs prior to merging them into the base UID table. No messages or abends, but the loop results in poor system performance because it takes almost all available CPU. All other jobs / tasks in the system will be adversely affected. Without CPU cycles, they will appear to have stopped working. Issue the command 'TSS MODIFY OMVSTABS' as soon as possible following the additon of new UID / GID values. CA Top Secret for z/os Release 15.0 CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00385-TSS160-SP1 DESC(LOOP IN PROGRAM SAFOEOTS WHEN SEARCHING UID TABLE FMID () PRE ( RO92696 ) SUP ( RO91248 TR91248 TR98826 ) ++HOLD (RO98826) SYSTEM FMID() REASON (DYNACT ) DATE (18033) PURPOSE Activate change without IPL USERS All users KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH 2. Restart Top Secret with a REINIT 3. Rebuild OMVS tables with 'F TSS,OMVSTABS' command

5 CA Top Secret Security for z/os CA RS PTF RO98925 RO98925 RO98925 M.C.S. ENTRIES = ++PTF (RO98925) ABEND S0C4 DURING RACR=EXTRACT TYPE=REPLACE ON AES128/AES256 Issuing a RACROUTE REQ=EXTRACT TYPE=REPLACE with FIELDS FLAG4, PASSDATE, PASSWORD and using an AES128 or an AES256 TSS security file, it will abend with: TSS9999E CA-TSS SECURITY SVC ABEND S0C4 IN TSSKERNL+3A14 The abend is in module TSSKEXT2 at offset TSS9999E CA-TSS SECURITY SVC ABEND S0C4 IN TSSKERNL+3A14 The applicaton issuing a RACROUTE REQ=EXTRACT TYPE=REPLACE abends. None. CA-TOP SECRET-MVS Release 16.0 TSSMVS Copyright (C) 2017 CA. All rights reserved. R00388-TSS160-SP1 DESC(ABEND S0C4 DURING RACR=EXTRACT TYPE=REPLACE ON AES128/AES256 FMID () PRE ( RO84794 RO86945 RO87883 RO91603 RO92696 RO92771 RO96977 RO96998 RO97892 RO98716 ) SUP ( RO95857 RO97317 RO97746 RO98458 TR95857 TR97150 TR97317 TR97746 TR98458 TR98925 ) ++HOLD (RO98925) SYSTEM FMID() REASON (DYNACT ) DATE (17338) PURPOSE Load module into LLA and activate USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority LLA REFRESH and restart CA Top Secret with TSS,,,REINIT

6 CA Top Secret Security for z/os CA RS PTF RO99650 RO99650 RO99650 M.C.S. ENTRIES = ++PTF (RO99650) ADD WBEM TO TSS STATIC RDT TABLE WITH POSIT=604 Add WBEM to the TSS static RDT table with POSIT=604. RESOURCE CLASS = WBEM RESOURCE CODE = X'xxx' ATTRIBUTE = NOMASK,MAXOWN(08),MAXPERMIT(008),ACCESS ACCESS = ALL(FFFF),CONTROL(C400),UPDATE(C000),READ(4000) ACCESS = NONE(0000) DEFACC = NONE WBEM currently is not in the TSS STATIC RDT TABLE with POSIT=604. Add WBEM to the TSS static RDT table with POSIT=604. None. CA-TOP SECRET-MVS Release 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00421-TSS160-SP1 DESC(ADD WBEM TO TSS STATIC RDT TABLE WITH POSIT=604 FMID () PRE ( RO89334 RO92696 RO94909 RO99320 ) SUP ( RO80064 RO86294 RO89936 RO92811 RO94298 TR80064 TR86294 TR89936 TR92489 TR92800 TR92811 TR94298 TR99420 TR99650 ) ++HOLD (RO99650) SYSTEM FMID() REASON (DYNACT ) DATE (18043) PURPOSE Load module into LLA and activate USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority 1. LLA REFRESH and restart CA Top Secret with TSS,,,REINIT NOTE: the following messages will appear on the mvs console TSS9048I RDT SYNCHRONIZATION RENAMED WBEM USERxxxx DUE TO CONFLICT TSS9045I RDT SYNCHRONIZATION COMPLETE 2. Own the necessary resources via: TSS ADD(dept) WBEM(CIMSERV) 3. Permit access to CIM region control acid via: TSS PERMIT(CIMSERV) WBEM(CIMSERV) ACC(CONTROL) 4. Permit access to the users, for example, CIMUSR, via: TSS PERMIT(CIMUSR) WBEM(CIMSERV) ACC(READ)

7 CA Top Secret Security for z/os CA RS PTF RO99694 RO99694 RO99694 M.C.S. ENTRIES = ++PTF (RO99694) ABENDS 0C4 / 0C7 IN TSSKERNL MODULE TSSKECA (CEM) Two different abends can occur in the Compliance Event Manager TSSKERNL module TSSKECA as follows: 1. Abend 0C4 occurs when an administrator enters a TSS WHOHAS command without parentheses around the target resource, i.e. TSS WHOHAS UNIXPRIV SUPERUSER 2. Abend 0C7 occurs for an object access event for the resource class CASECAUT if the user owns the target resource and also has security bypass attributes. 1. TSS9190A CA-TSS COMMAND PROCESSOR ABEND S0C4 IN TSSKERNL TSS9191I TSS COMMAND SUBTASK RECOVERY COMPLETE 2. TSS9999E CA-TSS SECURITY SVC ABEND S0C7 IN TSSKERNL The task will abend but the product will continue to function. The compliance event records that represent these events will not be generated successfully. 1. Enter the TSS WHOHAS command with the parentheses as documented: TSS WHOHAS UNIXPRIV(SUPERUSER) 2. Transfer ownership of the resources to an organizational ACID and permit the administrator to them. CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00423-TSS160-SP1 DESC(ABENDS 0C4 / 0C7 IN TSSKERNL MODULE TSSKECA (CEM) FMID () PRE ( RO99320 ) SUP ( AR95026 RO83110 RO87735 RO94517 RO96081 TR81849 TR83110 TR86561 TR87677 TR87735 TR92091 TR93550 TR94514 TR94517 TR94968 TR96081 TR99694 ) ++HOLD (RO99694) SYSTEM FMID() REASON (DYNACT ) DATE (18047) PURPOSE Activate change without IPL USERS Users of Compliance Event Manager KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH 2. Restart Top Secret with a REINIT

8 CA Top Secret Security for z/os CA RS PTF RO99844 RO99844 RO99844 M.C.S. ENTRIES = ++PTF (RO99844) The following items are included in this solution: 1. TSSCFILE NOT LISTING CRITERIA FOR CSFKEYS 2. ADDED BLANK IN MFA CFILE ========================================================================== TSSCFILE NOT LISTING CRITERIA FOR CSFKEYS TSSCFILE is not displaying the CRITERIA field when listing the CSFKEY associated with dataset encryption. The following can be seen in the TSSCFILE output: Unknown data encountered on next line for XXXXXXX CRITERIA = SMS(DSENCRYPTION) TSSCFILE will not display the CRITERIA value for CSFKEY. None available. CA Top Secret for z/os Release 16.0 TSSMVS ========================================================================== ADDED BLANK IN MFA CFILE 1. Running TSSCFILE for an MFA user (TSS LIST(username) DATA(MFA) ), the Tag Data field can have a blank in it if the Tag name and data are longer than 67 characters. 2. If the date format is set with a space delimiter, only the character in the date before the space will display in the TSSCFILE output. 1.) A possible blank in the middle of MFA TAG DATA in cfile record R5206B. 2.) Only the first two characters show in the date field. 1.) A possible blank in the middle of MFA TAG DATA in cfile record R5206B. 2.) Only characters before the blank in date format display in TSSCFILE. N/A CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00427-TSS160-SP1 DESC(TSSCFILE NOT LISTING CRITERIA FOR CSFKEYS FMID () PRE ( RO80995 RO82138 RO84794 RO88415 RO89334 RO92696 RO92808 RO93298 RO95026 RO95454 RO96977 RO97892 RO98232 RO98297 RO99320 ) SUP ( RO81160 RO87515 RO90626 TR81160 TR87515 TR90626 TR99531 TR99844 ) ++HOLD (RO99844) SYSTEM FMID() REASON (DYNACT ) DATE (18046) PURPOSE Activate change without IPL USERS All users

9 CA Top Secret Security for z/os CA RS PTF RO99844 KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH 2. Resubmit TSSCFILE or TSSCFBK job

10 CA Top Secret Security for z/os CA RS PTF RO99952 RO99952 RO99952 M.C.S. ENTRIES = ++PTF (RO99952) TSS REPLACE(XXXXX) PHRASE(*,0) NOT WORKING On a DES security file, one cannot make a phrase non-expiring via the replace command with PHRASE(*,0) specified. The command completes butthere is no changes done. After issuing 'TSS REP(USERA) PHRASE(*,0)' one receives message: 'TSS0300I REPLACE FUNCTION SUCCESSFUL'. However the expiration date has not been changed to non-expiring. User cannot use 'TSS REP(USERA) PHRASE(*,0)' to make a phrase nonexpiring. Issue the command with the full phrase specified. TSS REPL(USERA) PHRASE(ONEANDONLYONE,0) CA Top Secret for z/os Release 15.0 CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00431-TSS160-SP1 DESC(TSS REPLACE(XXXXX) PHRASE(*,0) NOT WORKING FMID () PRE ( RO84794 RO86945 RO92696 RO94913 RO95454 RO96977 RO97114 RO97892 RO98297 RO98716 RO99167 RO99320 RO99512 RO99690 ) SUP ( AR93059 AR94686 RO79659 RO85956 RO90186 RO91707 RO93059 RO94686 RO95244 RO98365 TR79659 TR85956 TR90186 TR91707 TR93059 TR94686 TR95191 TR95244 TR98365 TR99952 ) ++HOLD (RO99952) SYSTEM FMID() REASON (DYNACT ) DATE (18032) PURPOSE Activate change without IPL USERS User of TSS Commands KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH 2. Restart TSS,,,REINIT

11 CA Top Secret Security for z/os CA RS PTF SO00039 SO00039 SO00039 M.C.S. ENTRIES = ++PTF (SO00039) CICS: U734/U1800 AT INIT W/SYSLOG/OPERLOG ISSUES Since z/os V1R7 and the Console restructure, SVC35 (SVC23) WTO/WTOR may get several new return codes in CA Top Secret R16, such as RC50/54/58/5C/60/64. One of them, RC54, may be returned when hardcopy is assigned to syslog (CONSOLxx HARDCOPY DEVNUM(SYSLOG) ) but does not necessarily indicate a failure. (RC54 Meaning: Environmental error. The message could not be fully processed because of a hardcopy failure. The message might not appear in the hardcopy log.) These RCs may be returned from WTO for various reasons, including: - JES2 is down - Trouble with message queuing between JES2 and OPERLOG The CICS Interface for CA TOP SECRET for z/os needs to tolerate these non-zero RCs rather than consider them a critical failure and abend the region. CTS region abend U1800, preceded by the following messages: TSS6093I - TSS/CICS Initialization Phase 0 started. BPXP018I THREAD 3BE8E , IN PROCESS , ENDED WITHOUT BEING UNDUBBED WITH COMPLETION CODE DE, AND REASON CODE Region outage. None. CA Top Secret for z/os Release 15.0 CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00436-TSS160-SP1 DESC(CICS: U734/U1800 AT INIT W/SYSLOG/OPERLOG ISSUES FMID (CAKOG01) SUP ( ST00039 ) ++HOLD (SO00039) SYSTEM FMID(CAKOG01) REASON (DYNACT ) DATE (18017) CA Top Secret for z/os CICS Component Version 16.0 PURPOSE Activate change without IPL USERS Users of CICS KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH

12 CA Top Secret Security for z/os CA RS PTF SO Restart CICS Region

13 CA Top Secret Security for z/os CA RS PTF SO00092 SO00092 SO00092 M.C.S. ENTRIES = ++PTF (SO00092) S0C4 ABEND IN TSSKERNL DURING USER LOGON An S0C4 abend can occur in the TSSKERNL module TSSKGAR when a user logs on and either the user ACID or connected profile ACID contains a CSFKEYS permit. The abend is dependent on the order of permissions and storage allocations. TSS9999E CA-TSS SECURITY SVC ABEND S0C4 IN TSSKERNL The user logon fails and a dump of the abend is generated. A retry of the logon may be successful due to storage allocations. Remove any CSFKEYS permissions from the user and/or profile ACIDS if possible. CA Top Secret for z/os Release 15.0 TSSMVS 9763 Copyright (C) 2018 CA. All rights reserved. R00442-TSS160-SP1 DESC(S0C4 ABEND IN TSSKERNL DURING USER LOGON FMID () PRE ( RO84794 RO92696 RO99320 ) SUP ( RO92675 ST00092 TR92664 TR92675 TR93902 ) ++HOLD (SO00092) SYSTEM FMID() REASON (DYNACT ) DATE (18051) PURPOSE Load module into LLA and activate USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority SMP APPLY, LLA REFRESH and restart CA Top Secret with TSS,,,REINIT

14 CA Top Secret Security for z/os CA RS PTF SO00139 SO00139 SO00139 M.C.S. ENTRIES = ++PTF (SO00139) The following items are included in this solution: 1. NBDATE / NADATE ON REKEY OF CERTIFICATE 2. INCORRECT COMMAND VALIDATION OF FACILITY ACTIONS ========================================================================== NBDATE / NADATE ON REKEY OF CERTIFICATE When REKEY of a certificate occurs, having the DATE control option set to DD/MM/YY causes CA Top Secret to reject the NBDATE or NADATE. NBDATE and NADATE need to be in MM/DD/YY format. TSS0215E INVALID NADATE TSS0301I REKEY FUNCTION FAILED, RETURN CODE = 4 The certifcate is not generated. Reset the DATE format to MM/DD/YY. Issue the REKEY. CA Top Secret for z/os Version 16.0 TSSMVS ========================================================================== INCORRECT COMMAND VALIDATION OF FACILITY ACTIONS A TSS command that adds a FACILITY with actions to a user does not correctly validate the list of actions. The only valid actions for a FACILITY are AUDIT, DENY, and NOTIFY. Any other action value should be rejected. Actions like EXIT, REVERIFY, FAIL, PASSWORD, NODSN included on the CREATE or ADD command are not flagged as invalid. A TSS LIST of the user will report incorrect results for facilities. Only specify the documented actions for a FACILITY. CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00444-TSS160-SP1 DESC(NBDATE / NADATE ON REKEY OF CERTIFICATE FMID () PRE ( RO82138 RO82305 RO84794 RO86945 RO92696 RO94913 RO95428 RO95454 RO96977 RO97114 RO97832 RO97892 RO98051 RO98297 RO98716 RO99320 RO99394 RO99690 SO00132 ) SUP ( AR96977 RO91002 RO92619 RO92967 RO93757 RO94101 RO95291 RO96103 RO97041 ST00139 TR91002 TR92609 TR92619 TR92967 TR93757 TR94101 TR95109 TR95291 TR96103 TR97041 TR98858 TR99033 TR99034 TR99543 ) ++HOLD (SO00139) SYSTEM FMID() REASON (DYNACT ) DATE (18047) PURPOSE Activate change without IPL USERS All users

15 CA Top Secret Security for z/os CA RS PTF SO00139 KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH 2. Restart Top Secret with a REINIT

16 CA Top Secret Security for z/os CA RS PTF SO00140 SO00140 SO00140 M.C.S. ENTRIES = ++PTF (SO00140) MODI(CACHE(CLEAR)) CAUSES SECFILE SERVICES S0C4 Issuing a TSS MODIFY(CACHE(CLEAR)) command could result in the following abend: TSS9681A CA-TSS SECURITY FILE SERVICES ABEND S0C4 IN TSSMNGR+346CC TSSSFS S0C4 at 2D4346CC LMOD TSSMNGR4 CSECT TSSSFSC TSS9681A CA-TSS SECURITY FILE SERVICES ABEND S0C4 IN TSSMNGR+346CC TSSSFS S0C4 at 2D4346CC LMOD TSSMNGR4 CSECT TSSSFSC Access to CACHE for a specific task will abend. Do not issue command TSS MODIFY(CACHE(CLEAR)) via TSO or BATCH. CA-TOP SECRET-MVS Release 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00445-TSS160-SP1 DESC(MODI(CACHE(CLEAR)) CAUSES SECFILE SERVICES S0C4 FMID () PRE ( RO80995 RO82138 RO83157 RO84470 RO84794 RO85310 RO85843 RO86945 RO87918 RO88415 RO88932 RO89334 RO92696 RO93298 RO95026 RO95938 RO96977 RO98232 RO98297 RO98716 RO99320 RO99396 ) SUP ( RO79885 RO89682 RO95424 RO98361 ST00140 TR79885 TR84431 TR89682 TR95112 TR95424 TR96281 TR98361 ) ++HOLD (SO00140) SYSTEM FMID() REASON (DYNACT ) DATE (18040) PURPOSE Load module into LLA and activate USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority LLA REFRESH and restart CA Top Secret with TSS,,,REINIT

17 CA Top Secret Security for z/os CA RS PTF SO00170 SO00170 SO00170 M.C.S. ENTRIES = ++PTF (SO00170) PERMIT FACILITY RESTRICTIONS NOT LISTED CORRECTLY A TSS LIST command that lists permissions containing facility restrictions will contain incorrect output if the number of facility restrictions is greater than 56. The maximum number that can be displayed correctly is also dependent on the size of each facility name. The list of facility restrictions will contain gaps, missing commas, and may not include all the names. There are no abends or failures. Subsequent processing that is dependent on correctly formatted list data, including TSSCFILE, will also be incorrect. None available. CA Top Secret for z/os Release 15.0 CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00447-TSS160-SP1 DESC(PERMIT FACILITY RESTRICTIONS NOT LISTED CORRECTLY FMID () PRE ( RO84794 RO89361 RO92696 RO95454 RO96977 RO97892 RO98297 RO99167 ) SUP ( RO97814 ST00170 TR97068 TR97814 ) ++HOLD (SO00170) SYSTEM FMID() REASON (DYNACT ) DATE (18051) PURPOSE Activate without an IPL USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority 1. LLA REFRESH 2. Restart Top Secret with a REINIT

18 CA Top Secret Security for z/os CA RS PTF SO00249 SO00249 SO00249 M.C.S. ENTRIES = ++PTF (SO00249) ABEND S0C4 ON TSS COMMAND WITH INVALID SUBFIELD DATA A S0C4 abend will occur on a TSS command where a character is followed by a quote for example: TSS PERM(userid) OTRAN(xxxx) S' CCSR010E TSSAUTHZ S0C4 at 1AA2ACDC LMOD TSSAUTHZ CSECT TSSSTOR C The command fails and a dump is produced. Do not issue commands with a character followed by a quote. CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00450-TSS160-SP1 DESC(ABEND S0C4 ON TSS COMMAND WITH INVALID SUBFIELD DATA FMID () SUP ( RO90633 RO97905 ST00249 TR90633 TR97905 ) ++HOLD (SO00249) SYSTEM FMID() REASON (DYNACT ) DATE (18038) PURPOSE Load module into LLA and activate USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority 1. LLA REFRESH and restart CA Top Secret with TSS,,,REINIT

19 CA Top Secret Security for z/os CA RS PTF SO00250 SO00250 SO00250 M.C.S. ENTRIES = ++PTF (SO00250) USER UNABLE TO LOGON WITH RADIUS CREDENTIALS Users are unable to logon with RADIUS credentials. Error codes 8/12/8 are returned from the R_factor Getuser extract event. The tagname gets used instead of the TSS user ID. TSS7062E Unable to validate signon credentials: RADIUS server is unavailable. The user is unable to logon with RADIUS credentials. Use the Top Secret password or pass phrase if running with the FALLBACK option. CA Top Secret for z/os Release 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00451-TSS160-SP1 DESC(USER UNABLE TO LOGON WITH RADIUS CREDENTIALS FMID () PRE ( RO89334 RO92696 RO94971 RO95793 RO96977 RO98716 ) SUP ( RO97257 ST00250 TR97257 ) ++HOLD (SO00250) SYSTEM FMID() REASON (DYNACT ) DATE (18033) PURPOSE User unable to logon with RADIUS credentials. USERS RADIUS users using CA-AAM. KNOWLEDGE 1- SMP/E 2- z/os Systems Programming REQUIRED 3- Security Administration ACCESS SMP/E CSI libraries 1. LLA Refresh 2. Recycle TSS with REINIT

20 CA Top Secret Security for z/os CA RS PTF SO00254 SO00254 SO00254 M.C.S. ENTRIES = ++PTF (SO00254) TSS9993E INTERNAL SYSTEM ERROR W/ ACID REFRESH IN IMS Message TSS9993E INTERNAL SYSTEM ERROR - STORAGE NOT FREED (W) is displayed at the console due to a free storage failure. This occurs in an IMS DC/TM environment after a successful TSS REFRESH request has been performed for a user. A subsequent REFRESH or user logoff will result in the failed free storage request. TSS9993E INTERNAL SYSTEM ERROR - STORAGE NOT FREED (W) No abend or failure, the transaction completes successfully. Low impact unless a signficant number of REFRESH requests for the same user are executed. There is a small amount of subpool 230 key 3 storage that is not freed on each request. None available. CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00452-TSS160-SP1 DESC(TSS9993E INTERNAL SYSTEM ERROR W/ ACID REFRESH IN IMS FMID () PRE ( RO83104 RO84794 RO86945 RO88603 RO88796 RO89334 RO92696 RO92771 RO94971 RO95793 RO96696 RO96857 RO98297 RO98804 RO99167 RO99320 RO99512 RO99645 SO00168 ) SUP ( AR88603 AR98297 BR88603 RO89210 RO89889 RO90784 RO94168 RO95692 RO97390 RO97899 RO98795 ST00032 ST00254 TR89210 TR89691 TR89889 TR90753 TR90784 TR94168 TR95692 TR97390 TR97899 TR98062 TR98715 TR98795 TR99976 ) ++HOLD (SO00254) SYSTEM FMID() REASON (DYNACT ) DATE (18059) PURPOSE Activate change without IPL USERS Users of IMS DC/TM KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH 2. Restart Top Secret with a REINIT

21 CA Top Secret Security for z/os CA RS PTF SO00262 SO00262 SO00262 M.C.S. ENTRIES = ++PTF (SO00262) S0C4 TSSMNGR+5DB1C AT STARTUP BUILDING UID EXTENSION TABLE An S0C4 abend may occur at TSSMNGR+5DB1C at startup while trying to build the UID extension table. The problem will occur for sites which have between 131,066 and 131,071 acids defined with UIDs. TSS9681A CA-TSS SECURITY FILE SERVICES ABEND S0C4 IN TSSMNGR+5DB1C CA Top Secret cannot be started with the current security file. The TSS MODIFY OMVSTABS (or F TSS,OMVSTABS) command may fail as well. It may be possible to start CA Top Secret with a backup security file which has a different number of acids containing UIDs. TSSMVS Copyright (C) 2018 CA. All rights reserved. R00453-TSS160-SP1 DESC(S0C4 TSSMNGR+5DB1C AT STARTUP BUILDING UID EXTENSION TABLE FMID () PRE ( RO82138 RO84794 RO85310 RO86945 RO95938 RO98297 RO99320 RO99396 SO00140 ) SUP ( RO79885 RO98361 ST00262 TR79885 TR95112 TR96281 TR98361 ) ++HOLD (SO00262) SYSTEM FMID() REASON (DYNACT ) DATE (18045) PURPOSE Load module into LLA and activate USERS All KNOWLEDGE 1. Console commands REQUIRED 2. Top Secret administration ACCESS 1. Console authority REQUIRED 2. TSS administrative authority Refresh LLA and restart TSS

22 CA Top Secret Security for z/os CA RS PTF SO00365 SO00365 SO00365 M.C.S. ENTRIES = ++PTF (SO00365) Z/OSMF REST API SECURITY FAILURE z/osmf REST API SECURITY FAILURE z/osmf REST API SECURITY FAILURE Cannot use z/osmf None CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00459-TSS160-SP1 DESC(Z/OSMF REST API SECURITY FAILURE FMID () PRE ( RO84794 RO92696 ) SUP ( RO87881 RO98773 ST00365 TR87881 TR98773 ) ++HOLD (SO00365) SYSTEM FMID() REASON (DYNACT ) DATE (18037) PURPOSE Activate change without IPL USERS Users of z/osmf KNOWLEDGE Operator commands ACCESS z/os Operator console 1. LLA REFRESH 2. Refresh SAF module 'F TSS,REFRESH(OEDRV)'

23 CA Top Secret Security for z/os CA RS PTF SO00387 SO00387 SO00387 M.C.S. ENTRIES = ++PTF (SO00387) The following items are included in this solution: 1. IMPROVE PERFORMANCE OF CHECK_PRIV PROCESSOR 2. BAD 64-BIT ADDRESS CAUSES SAFOEGES S0C4 ========================================================================== IMPROVE PERFORMANCE OF CHECK_PRIV PROCESSOR The OMVS check_priv processor does not pass a work area to the recovery setup and cancel routines, which causes additional GETMAINs to be issued. Eliminating these by passing a work area could significantly improve performance in some environments. Potential throughput slowdown. Potential throughput slowdown. None. CA Top Secret for z/os Release 15.0 CA Top Secret for z/os Release 16.0 TSSMVS 9951 ========================================================================== BAD 64-BIT ADDRESS CAUSES SAFOEGES S0C4 When SAFOEGES is running in 64-bit mode, mode and the hi-order word of reg2 contains garbage, causing abend S0C4. CCSR010E SAFOEGES S0C4 at LMOD SAFOEDRV CSECT SAFOEGES A user's supplemental groups table cannot be built. None CA Top Secret for z/os Version 16.0 TSSMVS Copyright (C) 2018 CA. All rights reserved. R00460-TSS160-SP1 DESC(IMPROVE PERFORMANCE OF CHECK_PRIV PROCESSOR FMID () PRE ( RO95981 ) SUP ( ST00355 ST00387 TR96079 TR96801 ) ++HOLD (SO00387) SYSTEM FMID() REASON (DYNACT ) DATE (18038) PURPOSE Enable new code without IPL USERS All users KNOWLEDGE MVS Console commands ACCESS MVS Console

24 CA Top Secret Security for z/os CA RS PTF SO LLA Refresh 2. F TSS,REFRESH(SAFOEDRV) MCS SO00039 STARTS ON PAGE 0011 MCS SO00092 STARTS ON PAGE 0012 MCS SO00139 STARTS ON PAGE 0013 MCS SO00140 STARTS ON PAGE 0016 MCS SO00170 STARTS ON PAGE 0017 MCS SO00249 STARTS ON PAGE 0018 MCS SO00250 STARTS ON PAGE 0019 MCS SO00254 STARTS ON PAGE 0020 MCS SO00262 STARTS ON PAGE 0022 MCS SO00365 STARTS ON PAGE 0023 MCS SO00387 STARTS ON PAGE 0024

25 CA Top Secret Security for z/os CA RS 1803 Product/Component Listing Product Family Product Release Security CA TOP SECRET FOR Z/OS The CA RS 1803 Product/Component Count for this release is 1

26 CA Top Secret Security for z/os All CA RS Levels List CA RS Level FMID CAR1803 SO00387 SO00365 SO00262 SO00254 SO00250 SO00249 SO00170 SO00140 SO00139 SO00092 SO00039 RO99952 RO99844 RO99694 RO99650 RO98925 RO98826 CAKOG01 CAR1802 SO00169 CAKOG01 SO00168 SO00132 SO00082 SO00049 RO99939 RO99736 RO99645 RO99610 RO99576 RO99396 RO98940 RO98773 RO98733 RO98492 RO97905 CAKOG01 CAKOG01 CAR1801 RO99690 RO99512 RO99484 RO99394 RO99320 RO99095 RO99091 RO99005 RO98361 RO97776 CAR1712 RO99287 RO99167 RO98943 RO98852 RO98804 RO98757 RO98395 RO98011 RO94537 CAR1711 RO98795 RO98734 CAKOG03 RO98716

27 CA Top Secret Security for z/os All CA RS Levels List CA RS Level FMID RO98634 RO98458 RO98455 RO98437 RO98394 RO98390 RO98389 RO98365 RO98358 RO98297 RO97411 RO94019 RO94018 CAKOG03 CAKOG02 CAKOG02 CAR1710 RO98232 RO98051 RO97899 RO97892 RO97832 RO97814 RO97809 RO97746 RO97567 RO97504 RO97390 RO97372 RO97371 RO91062 CAKOG02 CAKOG01 CAR1709 RO97317 RO97257 RO97114 RO97009 CAR1708 RO97041 RO96998 RO96977 RO96857 RO96670 RO96542 RO96225 RO96135 RO95752 RO94449 RO94015 RO91735 RO91733 CAKOG01 CAKOG01 CAR1707 RO96696 RO96321 RO96125 RO96103 RO96081 CAR1706 RO96001 RO95981 RO95938 RO95857 RO95818 RO95793

28 CA Top Secret Security for z/os All CA RS Levels List CA RS Level FMID RO95454 RO95428 RO95424 RO92920 CAR1705 RO95692 RO95291 RO95244 RO95201 RO95061 RO88301 CAR1704 RO95026 RO94971 RO94913 RO94909 RO94718 RO94686 RO94168 RO93932 CAR1703 RO94517 RO94383 RO94298 RO94101 RO93840 CAR1702 RO93979 RO93757 RO93744 RO93398 CAR1701 RO93171 RO92888 RO92584 CAR1612 RO93298 RO93059 RO92967 RO92772 RO92771 RO92742 RO92581 RO92412 RO92198 RO92092 RO92039 CAKOG01 CAKOG01 CAR1611 RO92854 RO92811 RO92809 RO92808 RO92696 RO92675 RO92619 RO92560 RO92502 RO91873 RO91186 RO88880 CAR1610 RO91454 RO91447

29 CA Top Secret Security for z/os All CA RS Levels List CA RS Level FMID CAR1609 RO91707 RO91702 RO91603 RO91469 RO91248 RO91172 RO90979 RO90633 CAKOG01 CAR1608 RO91002 RO90784 RO90627 RO90626 RO90186 RO89750 RO88433 RO86556 CAKOG01 CAR1607 RO90358 RO90317 RO90165 RO89936 RO89828 CAR1606 RO90184 CAKOG01 RO90069 RO89965 RO89889 RO89888 RO89682 RO89668 RO89233 CAR1605 RO89361 RO89334 RO89210 RO89203 CAR1604 RO88969 CAKOG02 RO88968 RO88932 RO88848 RO88796 RO88651 RO88603 RO88551 RO88473 RO88415 RO87918 RO87883 RO87515 CAR1603 RO88130 RO87961 RO87881 RO87875 RO87826 CAKOG01 CAR1602 RO87827 RO87738 RO87735 RO86945

30 CA Top Secret Security for z/os All CA RS Levels List CA RS Level FMID RO86559 RO86552 RO86294 RO85890