Limiting the number of logon attempts

The number of unsuccessful attempts users can make at entering information in response to logon prompts is limited to the value specified on the IKJTSO macro statement. If users exceed the limit, they must reissue the LOGON command. By default, a user can make 10 attempts at entering information in response to logon prompts. For example, a user can unsuccessfully respond to any of the logon prompts—password, account number, or procedure—and press the Enter key a total of 10 times before having to log on again. You might want to reduce the number of attempts a user can make to enter information, thus making it more difficult for unauthorized users to gain access to the system.

To change the number of unsuccessful attempts a user can make at entering information, use the IKJTSO macro instruction and submit a System Modification Program Extended (SMP/E) job to make the change. For example, to specify that a user can make 3 attempts before having to reenter the LOGON command, code IKJTSO as follows:

LIMITS IKJTSO LOGLINE=3

TSO/E provides a sample job in SYS1.SAMPLIB member IKJTSMPE that shows how to use IKJTSO. Instructions for using the sample job are included in the SYS1.SAMPLIB member. IKJTSO macro describes the syntax of IKJTSO.

If you used the TSO SYSGEN macro to change the number of unsuccessful attempts a user can make at entering logon information, when you install a new release of TSO/E, the default that TSO/E provides overlays your changes. After system generation, use IKJTSO to change the default attributes. By using IKJTSO, future SYSGENs or IOGENs do not replace your values.