CNZ_Syscons_Allowcmd

Description:

The check will compare the ALLOWCMD setting in the CONSOLxx parmlib member for the system console with the desired setting.

Reason for check:

To ensure that the system console is as available as possible to act as a console of last resort.

z/OS® releases the check applies to:

z/OS V1R12 and later.

User override of IBM® values:

The following shows the default keywords for the check, which you can override on either a POLICY statement in the HZSPRMxx parmlib member or on a MODIFY command. This statement may be copied and modified to override the check defaults:

UPDATE,                                                   
      DATE('date_of_the_change')
      REASON('YOUR REASON FOR MAKING THE UPDATE.')          
      ACTIVE                                                
      SEVERITY(LOW)                                         
      INTERVAL(24:00)

Parameters accepted:

Yes:

PARM('Y/N')

Indicates which setting is preferred for ALLOWCMD on the system console.

PARM('Y') indicates that ALLOWCMD should be specified for the system console.
PARM('N') indicates that commands should only be allowed from the system console if it's in PD-mode.

Reference:

For more information on systems consoles, see z/OS MVS Planning: Operations
For more information on ALLOWCMD in the CONSOLxx parmlib member, seez/OS MVS Initialization and Tuning Reference

Messages:

This check issues the following exception messages:

CNZHF0015E

See the CNZHF messages in z/OS MVS System Messages, Vol 4 (CBD-DMO).

SECLABEL recommended for multilevel security users:

SYSLOW - see z/OS Planning for Multilevel Security and the Common Criteria for information on using SECLABELs.