Security Service tools user IDs and passwords

(1)

System

i

Security

Service

tools

user

IDs

and

passwords

Version

5 Release

4

(2)

(3)

System

i

Security

Service

tools

user

IDs

and

passwords

Version

5 Release

4

(4)

Note

Beforeusingthisinformationandtheproductitsupports,read theinformationin“Notices,”on page35.

FifthEdition(September2007)

Thiseditionappliestoversion5,release4,modification0ofIBMi5/OS(productnumber5722-SS1)andtoall subsequentreleasesandmodificationsuntilotherwiseindicatedinneweditions.Thisversiondoesnotrunonall reducedinstructionsetcomputer(RISC)modelsnordoesitrunonCISCmodels.

©CopyrightInternationalBusinessMachinesCorporation2003,2007.Allrightsreserved.

(5)

Service

tools

user

IDs

and

passwords

. 1

What’snewforV5R4 . . . 1

PrintablePDFs. . . 1

ConceptsforservicetoolsuserIDsandpasswords . 2

TerminologyforservicetoolsuserIDsand passwords . . . 2

DSTandSSTaccessmethods . . . 3

ServicetoolsuserIDs . . . 4

PasswordpoliciesforservicetoolsuserIDs . . . 6

Servicetoolslanguageversions . . . 7

Servicetoolsserver . . . 7

ManagingservicetoolsuserIDsandpasswords . . 8

Accessingservicetools . . . 8

AccessingservicetoolsusingDST . . . 8

AccessingservicetoolsusingSST . . . 10

Changingtheservicetoolslanguageofyour systemorlogicalpartition . . . 11

AccessingservicetoolsusingiSeriesNavigator 11 ManagingservicetoolsuserIDs . . . 12

ConfiguringservicetoolsuserIDs. . . 12

ConfiguringservicetoolsuserIDsusing DST . . . 13

ConfiguringservicetoolsuserIDsusing SST . . . 16

ChangingservicetoolsuserIDsand passwords. . . 20

ChangingservicetoolsuserIDsand passwordsusingDST . . . 20

ChangingservicetoolsuserIDsand passwordsusingSST . . . 21

ChangingservicetoolsuserIDsand passwordsusingtheSTRSSTcommandor QSYCHGDSAPI . . . 22

RecoveringorresettingQSECOFRpasswords 22 ResettingtheQSECOFRuserprofile password . . . 23

ResettingtheQSECOFRservicetoolsuser IDandpassword . . . 23

Savingandrestoringservicetoolssecurity data . . . 24

Savingservicetoolssecuritydata . . . . 24

Restoringservicetoolssecuritydata . . . 24

Recommendationsformanagingservicetools userIDs . . . 25

Configuringtheservicetoolsserver . . . 25

ConfiguringtheservicetoolsserverforDST 26 Configuringtheservicetoolsserverusing DST . . . 26

Configuringtheservicetoolsserverusing SST . . . 27

Configuringtheservicetoolsserverfori5/OS 27 Monitoringservicefunctionuse . . . 28

MonitoringservicefunctionusethroughDST 28 Monitoringservicetoolsusethroughsecurity auditlog . . . 29

Changingservicetoolssecuritypolicies . . . 29

Changingtoallowdefaultandexpired passwordstobeusedfromSST. . . 29

EnablingworkingwithdeviceIDsfromSST . . 30

Changingthepasswordexpirationinterval. . . 30

Changingthemaximumfailedsign-onattempts 31 Changingtheduplicatepasswordcontrol . . . 31

TroubleshootingservicetoolsuserIDsand passwords. . . 31

RelatedinformationforServicetoolsuserIDsand passwords. . . 32

Appendix.

Notices

.

. 35

ProgrammingInterfaceInformation . . . 36

Trademarks . . . 37

(6)

(7)

Service

tools

user

IDs

and

passwords

Servicetoolsare usedtoconfigure,manage,andserviceyour iSeries™models5xx,270,and 8xx,orthe 8xxlogicalpartitions(LPAR).Tomanagelogicalpartitionsonserversotherthanmodel8xx,youmustuse theHardwareManagementConsole(HMC).

Servicetoolscanbeaccessedfromdedicated servicetools(DST)orsystemservicetools(SST).Service toolsuserIDsarerequiredifyouwanttoaccessDST,SST,andtousetheiSeriesNavigatorfunctionsfor logicalpartitionmanagement anddiskunitmanagement.

Servicetoolsuser IDshavebeen referredtoasDSTuserprofiles,DSTuserIDs,servicetoolsuserprofiles, oravariationofthesenames.Withinthis topiccollection,thetermservicetoolsuserIDsisused.

What’s

new

for

V5R4

Thistopichighlightschanges madetothistopiccollection forV5R4.

What’s

new

as

of

April

2007

Youcanuseanew servicetoolsuserprivilegecalledTakeoverconsole,whichallowsanOperations Consoletotakecontrolfromanotherconsoledevice.Formore information,seeTakeoverorrecovery of anOperationsConsoleconnection.

Also,enhancementshavebeenmadetoallowformoreflexibilityforsomesecuritypolicesorrules.The WorkwithServiceToolsSecurityDatamenuhasbeenexpandedtoincludetheseadditionaloptions: v Option7:Workwithlock fordeviceIDsfromSST.

v Option8:Passwordexpirationinterval indays.

v Option9:Maximumsign-onattemptsallowed.

v Option10:Duplicatepasswordcontrol.

Formoreinformation,seeChangingservicetoolssecuritypolicies.

What’s

new

as

of

September

2007

Anoptionisprovidedinthededicatedservicetools(DST).Ifyouwanttouseadifferentlanguage versionastheservicelanguage,youcanchangeit intheserviceenvironment ofdedicatedservicetools (DST).By default,theprimarylanguageofthecurrentoperatingsystemandtheservicelanguagestayin synchunlessyouchangetheservicelanguage.For moreinformation,seeChangingtheservicetools languageofyoursystemor logicalpartition.

How

to

see

what’s

new

or

changed

Tohelpyouseewheretechnicalchanges havebeen made,this informationuses: v The

imagetomarkwhereneworchangedinformationbegins. v The

imagetomarkwhereneworchangedinformationends.

Tofindotherinformationaboutwhat’s neworchangedthisrelease,seetheMemotousers.

Printable

PDFs

Usethistoview andprintaPDFofthis information. | | | | | | | | | | | | | | | |

(8)

ToviewordownloadthePDFversionofthisdocument,selectServicetoolsuserIDsand passwords(420 KB).

Youcanview ordownloadtherelatedtopicOperationsConsole(1900KB).ThetopicPDFcontains informationaboutplanning,settingup,managing, andtroubleshootingOperationsConsole.

Saving

PDF

files

Tosavea PDFonyour workstationforviewingor printing: 1. Right-clickthePDFinyourbrowser(right-click thelinkabove).

2. ClicktheoptionthatsavesthePDFlocally.

3. Navigatetothedirectoryinwhichyouwanttosave thePDF.

4. ClickSave.

Downloading

Adobe

Reader

YouneedAdobe Readerinstalledonyour systemtovieworprintthesePDFs.Youcandownloada free copyfromtheAdobe Website(www.adobe.com/products/acrobat/readstep.html)

.

Concepts

for

service

tools

user

IDs

and

passwords

Theseconceptsprovidethebasicinformationyouneedtoget startedwith servicetoolsuserIDsand passwords.

Terminology

for

service

tools

user

IDs

and

passwords

Thislistprovides theterminologythatrelatestoservicefunctionsortoolsuserIDsandpasswords.

DataEncryptionStandard(DES)

Itisa typeofreversibleencryptionalgorithm.DESusestwopiecesofinformation:thedatatobe encryptedandthekeyto encryptthedata.IfyousupplyDESwiththeencrypteddataandthe encryptionkey,youcandecryptthedataandgettheoriginaldata.

dedicatedservice tools(DST)

Dedicatedservicetools(DST)areservicefunctionsorservicetoolsthatareavailable onlyfrom theconsoleandcanrunwhentheoperatingsystem isnotavailable.

defaultpassword

Defaultpasswordisidentical withtheservicetoolsuserID.For example,theIBM-supplied QSECOFRservicetoolsuser IDisshippedwithadefaultpasswordofQSECOFR.

disabledpassword

Apasswordismarkedasbeingunabletosignonwith itbecauseyouhavehad toomanysign-on attemptsthatare notvalid.Youcannotsignonusinga disabledpassword.

expiredpassword

Anexpiredpasswordisa passwordthathasnotbeenchangedwithin 180ormoredays,or a passwordthatisincludedonupgrademedia providedbyIBM.Youcanstillsignonusingan expiredpassword,butyoumustchangethepasswordatthetimeof sign-on.

functionalprivileges

Withfunctionalprivileges,youcangrantorrevokeaccesstoindividual servicetoolsfunctions.

i5/OS® userprofiles

Theseprofilesare createdwiththeCreateUserProfile(CRTUSRPRF)commandoriSeries Navigator,andareusedtosignontotheoperatingsystem.

| | | | | |

(9)

locked

Itisa mechanismtocontrolprogrammaticchanges tocertainfunctions.Ifafunctionis″locked″, itcannotbe changedthroughnormaluser interfaces.Youmustunlockit tochangeit.

passwordlevels

WithinDST,apasswordlevelcanbe set.ThepasswordlevelspecifieswhetherData Encryption Standard(DES)orSecureHashAlgorithm(SHA)encryptionisusedwhenstoringpasswords. ThedefaultlevelisDES.

SecureHashAlgorithm(SHA)

SecureHashAlgorithmisanencryptionmethod,inwhichdataisencryptedina waythatis mathematicallyimpossibletoreverse.Different datacanpossibly producethesamehashvalue, butthereisnowaytousethehash valuetodeterminetheoriginaldata.

servicefunctions

Servicefunctionsarespecific capabilitieswithin servicetools.Servicefunctionsaretypicallyused forproblemanalysisandproblemsolving,oftenwith theassistanceofIBM servicerepresentative. ExamplesofservicefunctionsincludeLicensedInternalCodetrace,LicensedInternalCodelog, andthedisplay,alter,dump functions.Youcanaccessservicetoolsthroughdedicated service tools(DST),systemservicetools(SST),andotherservice-relatedCLcommands.Improperuseof servicetoolscandamageyour system.

servicetools

Servicefunctionsandservicetoolsare thesame thing.Botharepart ofDSTorSST;bothrequire DSTorSSTuser IDand password.Servicefunctionsand servicetoolscanbe used

interchangeably.Servicetoolsare functionsthatare usedtoconfigure,manage,and service importantoperationalaspectsofthesystem.Servicetoolsenableyoutodotasks,suchas

configuringyour logicalpartitions,managingyourdiskunits,and troubleshootingproblems.You canaccessservicetoolsthroughDST, SST,and otherservice-relatedCLcommands.Improperuse ofservicetoolscandamageyour system.

servicetoolsdeviceIDs

ServicetoolsdeviceIDsareusedwiththeLANconsoletocontrolaccesstothesystem.

servicetoolsserver

Withtheservice toolsserver,youcanuseyourPCtoperformservicetoolsfunctionsthrough TCP/IP.

servicetoolsuserIDs

Servicetoolsuser IDsare requiredtoaccessDST,SST,iSeriesNavigator(forlogicalpartitionsand diskunitmanagement),andOperationsConsole.ServicetoolsuserIDsarecreatedthrough DST orSST,and theyareseparatefromuser profiles.

systemservice tools(SST)

Withthesystem servicetools(SST),youcanaccessservicefunctionsfromtheoperatingsystem. YoucanusetheStartSST(STRSST)commandtoaccessservice tools.Thei5/OSuserIDneeds *SERVICEauthoritytoaccessSST.

DST

and

SST

access

methods

Youcanusededicatedservicetools(DST)orsystemservicetools(SST)toaccessservicetoolsand service functions.

DSTisavailablewhen theLicensedInternalCodeisstartedevenif theoperatingsystem hasnotbeen loaded.SSTisavailablefromtheoperatingsystem.

Servicetoolsare usedtoperform thefollowingactions:

Note: Thislistisnotallinclusive butgivesyouanoverviewof thefunctionsprovidedbyservicetools.

v Diagnosesystemproblems.

| | | | | | | | | | | | | | | |

(10)

v Addhardwareresourcestothesystem.

v Managediskunits.

v Managelogicalpartition(LPAR)activities,includingmemory.

v ReviewtheLicensedInternalCodeand productactivity logs.

v TraceLicensedInternalCode.

v Performmainstoragedumps.

v

Managesystem security.

v Manageotherservicetoolsuser IDs.

v ManageTakeoverconsole,whichallowsa secondLANconsoletotakeoveranexistingLANconsole.

1. Youneed toenabletheTakeoverconsolebeforeusingit.Todoso,usetheSelect consolemenu.

2. WhenattemptingtotakeoveranexistingLANconsolewith asecond LANconsole,theusermust

havetheTakeoverprivilegeortheServicetoolsecurityprivilege.

ThefollowingtableoutlinesthebasicdifferencesinaccessmethodsbetweenDSTand SST.

Characteristic DST SST

Howtoaccess Physicalaccessthroughconsole duringamanualIPLorbyselecting option21onthecontrolpanel.

Accessthroughinteractivejobwith theabilitytosignonwithQSECOFR orthefollowingauthorizations: v AuthorizationtotheStartSST

(STRSST)CLcommand. v

Servicespecialauthority

(*SERVICE).

v FunctionalprivilegetouseSST.

Whenavailable Availableevenwhenthesystemhas limitedcapabilities.Theoperating systemisnotrequiredforaccessing DST.

Availablewhentheoperatingsystem isstarted.Theoperatingsystemis requiredforaccessingSST.

Howtoauthenticate RequiresservicetoolsuserIDand password.

RequiresservicetoolsuserIDand password.

Related information

Takeover orrecoveryofan OperationsConsoleconnection

Service

tools

user

IDs

Servicetools userIDs areuserIDsthatare requiredforaccessingservicefunctionsthrough dedicated servicetools(DST),systemservicetools(SST),iSeriesNavigator(for logicalpartitionsand diskunit management),andOperationsConsole.

Servicetoolsuser IDsarecreatedthrough DSTorSSTandare separatefromi5/OSuserprofiles.IBM providesthefollowingservicetoolsuserIDs:

v

QSECOFR

v QSRV

v 22222222

v 11111111

ThepasswordsforservicetoolsuserIDsQSECOFR,QSRV, and22222222areshippedasexpired.All servicetoolspasswordsareshippedinuppercase.

| | | |

(11)

Youcancreatea maximumof100 servicetoolsuserIDs(includingthefourIBM-supplieduser IDs). SpecificauthoritiesaregrantedtotheIBM-providedservicetoolsuserIDs.TheIBM-suppliedservice toolsuserID11111111isusefulwhenupgrading OperationsConsole.

Note: WhenIBMshipsasystem,thereisaQSECOFRuser profileandaQSECOFR servicetoolsuserID.

Thesearenotthesame.Theyexistindifferentlocationsand areusedtoaccessdifferentfunctions. YourQSECOFRservicetoolsuser IDcanhaveadifferentpasswordfromyourQSECOFR user profile. Servicetoolsuser IDshavedifferentpasswordpoliciesfromuserprofiles.

CreatingadditionalservicetoolsuserIDsallows asecurityadministratortomanage andaudittheuseof servicetoolswithoutgivingoutthepasswordstotheIBM-suppliedservicetoolsuserIDs.Youcancreate additionalservicetoolsuserIDsusingdedicatedservicetools(DST)orsystemservicetools(SST).

Attention: Ifyouloseorforgetthepasswordsforallsecurityofficerprofilesand allsecurityservice

toolsuserIDs,youmight needtoinstalland initializeyour systemfromdistributionmedia torecover them.For thisreason,it issuggestedthatyoucreatemultiple profilesanduser IDs.Contact yourservice providerforassistance.

ThepasswordsforservicetoolsuserIDscanhaveexpirationdates,whichallowyouto minimizethe securityrisktoyour system.Whentheuserssignonwith anexpiredpassword, theymustchangethe password.Aservicetoolsuser IDcanbe disabled,inwhichcaseitcannotbeusedatall untilsomeone withtheappropriateauthoritylevelre-enablesit.

Functional

privileges

for

service

tools

user

IDs

Functionalprivilegescontrolwhichservicefunctionscanbeaccessedbyanyservicetoolsuser ID.Youcan setupfunctionalprivileges tograntorrevoketheabilityforaservicetoolsuser IDtoaccessindividual servicefunctions.Theseexamplesshowhowyoumightwanttousefunctional privileges.

v Youcanallowoneuser totakecommunicationsandLicensedInternalCodetracesand giveadifferent

userthefunctionalprivilege tomanagediskunits.

v YoucancreateaservicetoolsuserIDwiththesamefunctional privilegesastheIBM-supplied

QSECOFRservicetoolsuser ID.Youcanthen disabletheIBM-suppliedQSECOFRservicetoolsuser ID.ThispreventspeoplefromusingtheknownQSECOFRuser IDand helpsprotect yoursystemfrom securityrisks.

Youcanmanage thefunctional privilegesthrough DSTorSST.Whenset torevoked,theStartService Toolsprivilegeallowsaservicetoolsuser IDtoaccessservicefunctionsthroughDST, butrestrictsthe userIDfromaccessingSST.

Beforeauser isallowedtouseorperform aservicefunction,a functionalprivilegecheck isperformed. If auser hasinsufficientprivileges, accesstotheservicefunctionisdenied. Thereisanauditlogtomonitor servicefunctionusebyservicetoolsusers.

LikeservicetoolsuserIDs,deviceIDsalsohavepermissionsthatcanbegrantedorrevokedand permissionsthatcanpreventfunctionsfromworking.YoucanaccessdeviceIDsthrough DSTorSST.

Related concepts

“Monitoringservicefunction use”onpage28

Youcanmonitortheuseof servicefunctionsthrough thededicatedservicetools(DST)securitylogor through thei5/OSsecurityauditlog.Theselogshelpyoutrace unusualaccesspatternsor potential securityrisks.

Related reference

“Passwordpolicies forservicetoolsuserIDs” onpage6

Here arethepasswordpolicies forservicetoolsuserIDsandtheprocessof changingDataEncryption Standard (DES)andSecureHashAlgorithm(SHA)encryption.

| | |

| |

(12)

“Accessingservicetools”onpage8

Toaccessservicetools,youcanusededicatedservice tools(DST), systemservicetools(SST),oriSeries Navigator.

TipsandToolsforSecuringYouriSeries

Operationsconsole

Securityof yourOperationsConsoleconfiguration

Password

policies

for

service

tools

user

IDs

Hereare thepasswordpoliciesforservicetoolsuser IDsandtheprocessofchangingData Encryption Standard(DES)andSecureHashAlgorithm(SHA)encryption.

Note: Multiple attemptstosignonwithincorrect passworddisabletheservicetoolsuserID. Ifthat

occurs, youcansignonwiththedisableduser IDfromtheconsolewhentheuser IDisQSECOFR, and thenresettheuserID. ToenableotheruserIDs,youneed tohavetheQSECOFR userIDor anotheruser IDwith theservicetoolsecurityprivilege.

Servicetoolsuser IDsareseparatefromi5/OSuserprofiles.PasswordsforservicetoolsuserIDsare encryptedatdifferentlevelsofsecurity.ThedefaultpasswordlevelusesDESencryption.Youshoulduse DESencryptionif youhavepre-V5R1clients usingiSeriesNavigatortoconnecttoservicefunctionssuch aslogicalpartitionsand diskunitmanagement.

YoucanchangethepasswordleveltouseSHAencryption,whichismathematicallyimpossibletoreverse andprovidesstronger encryptionand ahigherlevelofsecurity.IfyouchangetoSHAencryption,

however,youcannotchangebacktoDESencryption.Also,if youchangetoSHAencryption,youcanno longerconnecttotheservicetoolsserverwithpre-V5R1clients,suchasOperationsConsole. Whenyou upgradeyourpasswordleveltoSHA,youneedtoupgradeanyclients thatusethesefunctions.

DES

encryption

WhenyouuseDESencryption,servicetoolsuser IDsandpasswordshavethefollowingcharacteristics: v Use10-digit,uppercaseuser IDs.

v

Use8-digit,case-sensitive passwords.WhenyoucreateauserIDandpassword, theminimum required

forthepasswordis1 digit.Whenyouchangea password,theminimumrequiredis6 digits.

v PasswordsforuserIDsdo notexpire after180days.By default,theinitial passwordsforIBM-supplied

servicetoolsuserIDs,however,areshippedasexpired.The exceptiontothis istheuser ID11111111. ThisuserIDisnotexpired.

v Eventhoughpasswordsdon’texpirewhenusingDESencryption,itstill canbecreatedexpired.

v Bydefault,passwordsareinitially setasexpired(unlessexplicitlysetonthedisplaytoNo).

SHA

encryption

WhenyouuseSHAencryption,servicetoolsuserIDsand passwordshavethefollowingcharacteristics: v Use10-digit,uppercaseuser IDs.

v Use128-digit case-sensitivepasswords.Whenyoucreateauser IDand password,theminimum

requiredforthepasswordis1digit.Whenyouchangeapassword, theminimum requiredis6digits. v Bydefault,passwordsforuser IDsexpireafter180days. Theexpirationinterval canbe changed

throughOption8 (Passwordexpirationintervalindays) ontheWorkwith ServiceToolsSecurityData menu.Thevaluecanbe 0for*NOMAXorupto999days.

v Bydefault,passwordsareinitially setasexpired(unlessexplicitlysetonthedisplaytoNo).

TochangetouseSHAencryption,accessDSTand performthefollowingsteps: | | | | | | |

(13)

1. Sign ontoDSTusingyourservicetoolsuser ID.TheUsededicatedservicetools(DST)displayis

shown.

2. Select option5(Workwith DSTenvironment)and pressEnter. TheWorkwithDSTEnvironment

displayisshown.

3. Select option6(Servicetoolssecuritydata)and pressEnter.

4. Select option6(Changepasswordlevel)and pressEnter. PressEnteragainif youarereadytogo to

thenew passwordlevel.ThecurrentstatusofPWLVL2isdisplayed.

“AccessingservicetoolsusingDST”onpage8

Toaccessservicetools,youcanusededicatedservicetools(DST)fromthesystemcontrolpanelor froma manualinitialprogramload(IPL).

“ChangingservicetoolsuserIDsand passwordsusingtheSTRSSTcommandor QSYCHGDSAPI”on

page22

Youcanchangeyourservicetoolsuser IDpasswordusingtheStartSystemServiceTools(STRSST) commandortheChangeServiceToolsUserID(QSYCHGDS)API.

“Recovering orresettingQSECOFR passwords”onpage22

WhenIBMshipsasystem,botha QSECOFRuser profileand aQSECOFR servicetoolsuserIDare supplied.Whenyouloseyour QSECOFRuser profilepasswordoryourQSECOFR servicetoolsuser ID, useoneofthepasswordstoresettheother.

Related tasks

“ChangingservicetoolsuserIDsand passwordsusingDST”onpage20

Tochangea servicetoolsuserIDpasswordusingdedicatedservicetools(DST),completethesesteps.

“ChangingservicetoolsuserIDsand passwordsusingSST” onpage21

Tochangea servicetoolsuserIDpasswordusingsystemservicetools(SST),completethese steps.

“Changingyourservicetoolsuser IDpasswordusingtheSTRSSTcommand”onpage22

Tochangeyour servicetoolsuserIDpasswordusingtheStartSystemServiceTools(STRSST) command, completethesesteps.

“Servicetoolsuser IDs”onpage4

ServicetoolsuserIDsareuser IDsthatarerequiredforaccessingservicefunctionsthrough dedicated servicetools(DST),system servicetools(SST),iSeriesNavigator(forlogicalpartitionsanddiskunit management),and OperationsConsole.

Service

tools

language

versions

Ifyouwanttousea differentlanguageversion astheservicelanguage,youcanchangeitintheservice environmentsofdedicated servicetools(DST). Youcanalsochange theservicelanguagebacktoa previouslychosenlanguage.Bydefault,theprimarylanguageofthecurrentoperatingsystemandthe servicelanguagestayinsynchunlessyouchangetheservicelanguage.

“Changingtheservicetoolslanguageof yoursystemorlogicalpartition”onpage11

Youcanchangetheservicetoolslanguagetothelanguageofyour servicerepresentative.The followingprocedurecanguideyouthroughinstallinga servicetoolslanguage.

Service

tools

server

Withtheservicetoolsserver,youcanuseyourPCtoperformservicefunctionsthrough TCP/IP. InordertousetheservicetoolsservertoperformGUI-basedlogicalpartitionsordisk management activities,youneedtomaketheservicetoolsserveravailable.Youcanconfiguretheservicetoolsserver forDST,theoperatingsystem,orboth.Afterconfiguration,authorizeduserscanusefunctionssuchas LPARordiskmanagement iniSeriesNavigator.

| | | | | | | |

(14)

Notes:

1. Youare notable toaccessanyiSeriesNavigatorservicefunctionsuntil youhaveconfigured

andstartedtheservice toolsserver.

2. Ifyourservermodelisnot8xx, youmust usetheHardwareManagement Console(HMC)to

managei5/OSlogicalpartitions.

3. IfyouuseOperationsConsole(LAN),theservicetoolsserverisalreadyconfigured. Related concepts

“AccessingservicetoolsusingiSeriesNavigator”onpage11

Youcanaccessservice toolsfromiSeries Navigatorwhenyour systemhasbeen poweredonto dedicatedservicetools(DST)orisrunningtheoperatingsystem.

“Configuringtheservicetoolsserver”onpage25

Youcanconfiguretheservicetoolsserverfordedicatedservicetools(DST),theoperatingsystem,or both.

Partitioningwith theSystemi Diskmanagement

Managing

service

tools

user

IDs

and

passwords

Toeffectivelymanageand maintainyourservicetoolsuser IDsandpasswords,youneedtoknowthe differentwaystoaccessservicetools,howtoconfiguretheservicetoolsserver,and howtochangeyour userIDsand passwords.

Accessing

service

tools

Toaccessservicetools,youcanusededicatedservicetools(DST),system servicetools(SST),oriSeries Navigator.

Theservicefunctionsavailabletoyoudependonthefunctionalprivilegesyouhave.Ifyoudonothave thecorrectprivileges,youmaynotbeable tosignontoSST.Ifyouhavetheappropriatefunctional privileges,youcanmanage servicetoolsuserIDsfromSSTorDST.

“Servicetoolsuser IDs”onpage4

ServicetoolsuserIDsareuser IDsthatarerequiredforaccessingservicefunctionsthroughdedicated servicetools(DST), systemservicetools(SST),iSeriesNavigator(forlogicalpartitionsanddiskunit management),and OperationsConsole.

“Managingservicetoolsuser IDs”onpage12

Developing aneffectivestrategy formanagingservicetoolsuser IDsinvolvesaseriesoftasks, suchas configuringservicetoolsuserIDs,resettingQSECOFR passwords,and savingorrestoringservice toolssecuritydata.

Accessing

service

tools

using

DST

Toaccessservicetools,youcanusededicatedservicetools(DST)fromthesystem controlpanelorfroma manualinitial programload(IPL).

TheservicetoolsuserIDyouusetoaccessservicetoolswith DSTneedstohavethefunctionalprivilege touseDST.YoucanstarttheDSTbyusingfunction 21fromthesystem controlpanelorbyusinga manualinitial programload(IPL).

(15)

Accessing

service

tools

using

DST

from

the

system

control

panel

ToaccessservicetoolsusingDSTfromthecontrolpanel,completethefollowingsteps: 1. Putthecontrolpanelinmanual mode.

2. Use thecontrolpaneltoselectfunction 21andpressEnter. TheDSTSignOndisplayappears onthe

console.

3. Sign ontoDSTusingyourservicetoolsuser IDand password.TheUsededicatedservicetools(DST)

displayappears.

4. Select theappropriateoption fromthelistand pressEnter.

v Selectoption5(Workwith DSTenvironment) togettoadditionaloptionsforworkingwithservice

toolsuserIDs.

v Selectoption7(Starta servicetool)to startanyoftheservicetoolsavailable fromDST.

v Selectanyoftheotheroptions,asappropriate.

Accessing

service

tools

using

DST

from

a

manual

IPL

ToaccessservicetoolsusingDSTfromamanualinitial programload(IPL),completethefollowingsteps: 1. Putthecontrolpanelinmanual mode.

2. Ifthesystemispoweredoff,turnthesystemon.

3. If thesystem ispoweredon tothe operatingsystem, enterthePower DownSystem (PWRDWNSYS)

command, PWRDWNSYS *IMMEDRESTART(*YES),on acommandlineto turnoff thesystemand restart it. 4. Sign ontoDSTusingyourservicetoolsuser IDand password.TheUsededicatedservicetools(DST)

displayappears.

5. Select theappropriateoption fromthelistand pressEnter.

v Selectoption5(Workwith DSTenvironment) togetadditionaloptionsforworkingwithservice

toolsuserIDs.

v Selectoption7(Starta servicetool)to startanyoftheservicetoolsavailable fromDST.

v Selectanyoftheotheroptions,asappropriate. Related tasks

“Creatingaservicetoolsuser IDusingDST”onpage13

Tocreatea servicetoolsuserIDusingdedicatedservice tools(DST), followthesesteps.

“Resetting theQSECOFR userprofilepassword”onpage23

IfyouknowthepasswordfortheQSECOFRservicetoolsuserID, usethis passwordtoresetthe QSECOFR userprofiletoitsinitial value(QSECOFR).

“Monitoringservicefunction usethrough DST”onpage28

Youcanusethededicatedservicetools(DST)securitylogtomonitor servicefunctions.Anytimea user signsontoDSTusingaservicetoolsuser ID,theeventisloggedbytheservicetoolssecurity log.

“Changingthedescriptionfora servicetoolsuserIDusingDST”onpage14

Tochangethedescriptionforaservicetoolsuser IDfromdedicatedservicetools(DST), complete thesesteps.

“Changingthefunctionalprivilegesfora servicetoolsuserIDusingDST”onpage14

Tochangethefunctionalprivileges foraservicetoolsuser IDusingdedicatedservicetools(DST), followthesesteps.

“Deletinga servicetoolsuserIDusingDST” onpage16

Todeletea servicetoolsuser IDfromdedicatedservicetools(DST),completethese steps.

“Disablinga servicetoolsuserIDusingDST”onpage15

(16)

“Displaying aservicetoolsuserIDusingDST”onpage14

Todisplaya servicetoolsuserIDfromdedicatedservicetools(DST),completethesesteps.

“Enablinga servicetoolsuser IDusingDST”onpage15

Toenablea servicetoolsuserIDfromdedicatedservicetools(DST),completethesesteps.

“Changingtoallowdefaultandexpiredpasswordstobe usedfromSST” onpage29

Youcanmakechangestoallowdefaultand expiredservicetoolspasswordstobeusedfromsystem servicetools(SST).

“TroubleshootingservicetoolsuserIDsand passwords”onpage31

Whenyouhaveproblemswith servicetoolsuserIDsandpasswords,refertothisinformationfor solutions.

Accessing

service

tools

using

SST

Ifyouruser profilehastherequiredauthorizations,youcanusesystemservicetools(SST)toaccess servicetools.

TheservicetoolsuserIDyouusetoaccessSSTneedstohavethefunctionalprivilegetouseSST.The i5/OSuser profileneedstohavethefollowingauthorizations:

v AuthorizationtotheStartSST(STRSST)CLcommand.

v Servicespecialauthority(*SERVICE).

ToaccessservicetoolsusingSST,completethefollowingsteps:

1. EnterSTRSST(StartSST)on ani5/OScommandline.The StartSSTSign On displayappears.

2. Enterthefollowinginformation:

v ServiceToolsUserID:TheservicetoolsuserIDyousignonwith.

v Password:Thepasswordassociatedwiththisuser ID.

3. PressEnter. Related tasks

“Creatingaservicetoolsuser IDusingSST”onpage16

Tocreatea servicetoolsuserIDfromsystemservicetools(SST),completethesesteps.

“Changingthedescriptionfora servicetoolsuserIDusingSST”onpage18

Tochangethedescriptionforaservicetoolsuser IDfromsystemservicetools(SST),completethese steps.

“Changingthefunctionalprivilegesfora servicetoolsuserIDusingSST”onpage17

Tochangethefunctionalprivileges foraservicetoolsuser IDfromsystemservice tools(SST), completethesesteps.

“Deletinga servicetoolsuserIDusingSST” onpage19

Todeletea servicetoolsuser IDfromsystemservicetools(SST),completethesesteps.

“Disabling aservicetoolsuserIDusingSST”onpage19

Todisablea servicetoolsuserIDfromsystemservicetools(SST),completethesesteps.

“Displaying aservicetoolsuserIDusingSST”onpage18

Todisplaya servicetoolsuserIDfromsystemservicetools(SST),completethesesteps.

“Enablinga servicetoolsuser IDusingSST” onpage18

Toenablea servicetoolsuserIDfromsystemservicetools(SST),completethesesteps.

(17)

“Configuringservicetoolsuser IDs”onpage12

Youcancreate,display,change,and deleteservicetoolsuserIDsfromdedicatedservicetools(DST)or systemservice tools(SST).

Changing

the

service

tools

language

of

your

system

or

logical

partition

Youcanchangetheservicetoolslanguagetothelanguageofyourservicerepresentative.Thefollowing procedurecanguideyouthroughinstallingaservicetoolslanguage.

Prerequisites

Beforeyoubegintochangetheservicetoolslanguage,obtainthemedia labeledasI_BASE_01.Ensure thattherelease andmodification ofyoursystemare thesame asthatofyour media.Youneedtobe awareofthefollowingthings:

v YouwillneedtheCDimagethatcontainstheLicenseInternal Codefortheversion,release,and

modificationlevelinstalledonthesystem.

v Imagecatalogs(virtualopticalandtapedevices)do notsupport theproceduresinthis topic.

v Youcanonlychangetheservicetoolslanguageonetimebefore aninitialprogramload(IPL)is

required.

Tochangetheservice toolslanguageonthesystemorlogicalpartition,followthesesteps: 1. LoadthemedialabeledI_BASE_01intheopticaldevice.

2. Accessservicetoolsusingdedicatedservicetools(DST).Refer toAccessingservicetoolsusingDST.

Note: UsetheservicetoolsuserIDQSECOFRtosignontotheDST.

3. Select option5(Workwith DSTenvironment).

4. Select option7(Changeservicetoolslanguage).TheSelectServiceToolsLanguagedisplayisshown

includinga listof servicelanguagesthatyoucanchoosefrom.Thedisplayalsoindicatestheprimary languageofthecurrentoperatingsystem.

5. EnterthelanguageID(29xx)of yourdesiredservicetoolslanguageintheSelection fieldandpress

Enter. Forexample,ifyour servicerepresentativesunderstandEnglish,youmightwanttochoose 2924.

6. Select theopticaldevicefromstep1 andpressEnter.

7. The ConfirmSelect ServiceToolsLanguagedisplayisshown.PressEnter.

8. The nextdisplaydependsonthemethod usedtoaccessservicetoolsusingDST.

v IfyouaccesstheservicetoolsusingDSTfromthesystemcontrolpanel, thei5/OSSignOn display

isshown.

v IfyouaccesstheservicetoolsusingDSTfromamanual IPL,theIPLorInstalltheSystemdisplayis

shown.

“Servicetoolslanguageversions”onpage7

Ifyouwanttouseadifferentlanguageversionastheservicelanguage,youcanchangeitinthe serviceenvironmentsofdedicatedservicetools(DST).Youcanalsochangetheservicelanguageback toa previouslychosenlanguage.Bydefault,theprimarylanguageofthecurrentoperatingsystem and theservicelanguagestayinsynchunlessyouchangetheservicelanguage.

Accessing

service

tools

using

iSeries

Navigator

YoucanaccessservicetoolsfromiSeriesNavigatorwhenyoursystemhasbeenpoweredontodedicated servicetools(DST)orisrunningtheoperatingsystem.

Accessing

service

tools

using

iSeries

Navigator

when

powered

on

to

DST

Note: IfyouuseOperationsConsole(LAN),theservicetoolsserverisalreadyconfigured.

| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

(18)

ToaccessservicetoolsusingiSeriesNavigatorwhenthesystemhasbeen poweredontoDST, makesure theservicetoolsserverisconfiguredforDSTandhasbeenstarted,andthencompletethefollowing steps:

1. FromiSeriesNavigator,selectMyConnectionsoryouractiveenvironment.

2. SelectOpeniSeriesNavigator servicetoolswindowintheTaskpadwindow.IftheTaskpadwindow

isnotdisplayed,selectViewand selectTaskpad.

3. AfteryouselecttheTaskpaditem, typetheIPaddress ofthesystemtowhichyouwanttoconnect.

Accessing

service

tools

using

iSeries

Navigator

when

running

i5/OS

ToaccessservicetoolsusingiSeriesNavigatorwhenthesystemisrunningi5/OS,makesure theservice toolsserverisconfigured forthei5/OSoperatingsystemandhasbeenstarted,andthen completethe followingsteps:

1. FromiSeriesNavigator,expandMy Connectionsoryour activeenvironment.

2. Selectthesystem withwhichyouwanttowork.

3. Selectthespecific servicefunctionwith whichyouwanttowork.

v Forlogicalpartitionmanagement, expandConfigurationandService.SelectLogicalPartitions.

v Fordiskunitmanagement,expandConfiguration andService.ExpandHardware.ExpandDisk

Units.

Youarepromptedtosignonusingyour servicetoolsuserID.

“Configuringtheservicetoolsserverfori5/OS”onpage27

Youmustaddtheservicetoolsservertotheservicetabletoaccessservicetoolsontheoperating system usingTCP/IPandiSeriesNavigator.

“Servicetoolsserver” onpage7

Withtheservicetoolsserver,youcanuseyour PCtoperformservicefunctionsthroughTCP/IP.

“ConfiguringtheservicetoolsserverforDST”onpage26

Youcanconfiguretheservicetoolsservertobeavailablewhenyour systemhasbeenpoweredonto dedicatedservicetools(DST).

Connecting toSystemi:iSeries Navigator

Managing

service

tools

user

IDs

DevelopinganeffectivestrategyformanagingservicetoolsuserIDsinvolvesa seriesoftasks,suchas configuringservicetoolsuser IDs,resetting QSECOFRpasswords,andsavingorrestoringservicetools securitydata.

“Accessingservicetools”onpage8

Toaccessservicetools,youcanusededicatedservice tools(DST), systemservicetools(SST),oriSeries Navigator.

Configuring

service

tools

user

IDs

Youcancreate,display,change,anddeleteservicetoolsuser IDsfromdedicatedservicetools(DST)or systemservicetools(SST).

“AccessingservicetoolsusingSST”onpage10

Ifyour userprofilehastherequiredauthorizations,youcanusesystemservicetools(SST)toaccess servicetools.

(19)

“ConfiguringtheservicetoolsserverusingDST”onpage26

Toenabletheservicetoolsserverwithitsownnetworkinterfacecard,completethese steps.

“ConfiguringtheservicetoolsserverusingSST”onpage27

Toenabletheservicetoolsserverwithitsownnetworkinterfacecard,completethese steps.

“ChangingservicetoolsuserIDsand passwords”onpage20

YouhavevariouswaystochangetheservicetoolsuserIDsand passwords.Youcanusededicated servicetools(DST),or systemservicetools(SST),whichistheStartSST(STRSST)command, orthe ChangeServiceToolsUserID(QSYCHGDS)API.

ConfiguringservicetoolsuserIDsusingDST:

Youcanusededicatedservicetools(DST)tocreate,change,display,enable,disable,anddeleteservice toolsuserIDs.

Creatingaservicetools userIDusingDST:

Tocreateaservicetoolsuser IDusingdedicatedservicetools(DST),followthesesteps. 1. StartDST. Refertotheinformationaboutaccessingservice toolsusingDST.

2. Sign ontoDSTusingyourservicetoolsuser IDand password.

3. WhentheUsededicatedservicetools(DST)displayappears,selectoption5 (WorkwithDST

environment) andpressEnter. TheWorkwithDSTEnvironmentdisplayappears.

4. From theWorkwithDSTEnvironmentdisplay,selectoption 3(ServicetoolsuserIDs)toworkwith

service toolsuser IDs.TheWorkwithServiceToolsUserIDsdisplayappears.

5. Type 1(Create)ontheWorkwithServiceToolsUserIDsdisplay,typethenewservicetoolsuserIDin

thefieldprovidedand pressEnter. TheCreateServiceToolsUserIDdisplayappears.

Note: UserIDscanbefrom1-10 characters.Theyshouldbeinuppercase andcanincludelettersand

numbers,aswellasthespecialcharacters #,@,$,or_.Specialcharactersareallowed forthe firstcharacterintheuserID. UserIDscannotinclude spacesbetweencharacters.

6. Enterinformationaboutthenewuser ID:

v Username:Thenameofthenewservicetoolsuser ID.

v Password:Thispasswordisusedbythenewuser ID.Thepasswordmustbe atleast1 characterin

length.IfyouuseDESencryption(ordefaultpasswordlevel),themaximumpasswordallowed is8 digits.IfyouuseSHAencryption(orpasswordlevel2),then 128-digitcase-sensitivepasswordsare allowed.

v AllowuserIDaccessbeforestoragemanagementrecovery:Thedefaultforthis fieldis2 (No).

v Setpasswordtoexpired:The defaultforthisfieldis1(Yes).

v Description:Thisisanoptional field,whichcanbeusedformoredetailedinformationaboutthe

owneroftheuserID, suchasname, department,andtelephone number.

7. AfterallinformationabouttheuserIDhasbeen entered,youcanchooseoneoftheseoptions:

v Tocreatetheuser IDwith thedefaultfunctionalprivileges,pressEnter.

v Tochangethedefaultfunctional privileges,pressF5togo totheChangeServiceToolsUserID

Privilegesdisplay.Thisdisplaylistsalltheservicetools,towhichprivilegesmightbe granted.See “Changingthefunctionalprivileges foraservicetoolsuser IDusingDST”onpage14formore informationaboutchanging functionalprivileges.

| | | |

(20)

Toaccessservicetools,youcanusededicatedservice tools(DST)fromthesystemcontrolpanelor froma manualinitialprogramload(IPL).

ChangingthefunctionalprivilegesforaservicetoolsuserIDusingDST:

Tochangethefunctionalprivilegesfora servicetoolsuserIDusingdedicatedservicetools(DST),follow thesesteps.

1. StartDST.Refertotheinformationaboutaccessing servicetoolsusingDST.

2. SignontoDSTusingyourservicetoolsuser IDand password.

3. WhentheUsededicatedservicetools(DST)displayappears,selectoption5 (WorkwithDST

environment)andpressEnter. TheWorkwithDSTEnvironmentdisplayappears.

4. FromtheWorkwithDSTEnvironmentdisplay,selectoption 3(ServicetoolsuserIDs)toworkwith

servicetoolsuser IDs.TheWorkwithServiceToolsUserIDsdisplayappears.

5. OntheWorkwithServiceToolsUser IDsdisplay,selecttheuserIDtochangeandtype 7(Change

privileges)intheOptionfield.The ChangeServiceToolsUserPrivilegesdisplayappears. v

Type1(Revoke) intheOption fieldnexttothefunctionalprivilegesyouwanttoremovefromthe

userID.

v Type2(Grant) intheOptionfieldnexttothefunctionalprivileges youwanttoaddtotheuser ID.

6. PressEntertoenablethesechanges.IfyoupressF3(Exit)before pressingEnter,thechangesdonot

takeeffect. IfyoupressF9(Defaults),thefunctionalprivilegesare resettothedefaultvalues.

ChangingthedescriptionforaservicetoolsuserIDusingDST:

Tochangethedescriptionfora servicetoolsuserIDfromdedicatedservicetools(DST),completethese steps.

2. SignontoDSTusingyourservicetoolsuser IDand password.WhentheUsededicated servicetools

(DST)displayappears,selectoption5(Workwith DSTenvironment) andpressEnter. TheWorkwith DSTEnvironmentdisplayappears.

4. OntheWorkwithServiceToolsUser IDdisplay,selecttheuserIDdescriptiontochangeand type8

(Changedescription)intheOptionfield.

5. IntheDescriptionfield,entera newdescriptionfortheuser ID.Thismightinclude theuser’sname,

department,andtelephonenumber.

DisplayingaservicetoolsuserIDusing DST:

(21)

1. StartDST. Refertotheinformationaboutaccessingservice toolsusingDST.

2. Sign ontoDSTusingyourservicetoolsuser IDand password.WhentheUsededicated servicetools

4. On theWorkwithServiceToolsUser IDsdisplay, selecttheuserIDyouwanttodisplayandtype 4

(Display) intheOptionfield.TheDisplay ServiceToolsUserIDdisplayappears.Thisdisplayshows informationrelatingtotheuser ID,includingthefollowinginformation:

v Previoussign-on(dateandtime).

v Sign-onattemptsnotvalid.

v Status.

v Datepasswordlastchanged.

v AllowuserIDaccessbefore storagemanagementrecovery (YesorNo).

v Datepasswordexpires.

v Passwordset toexpire(YesorNo).

5. PressF5(Displayprivileges) toviewthefunctionalprivileges associatedwiththisuser ID.The

Display ServiceToolsUserPrivileges displayappears.Thisdisplaylists allfunctionalprivileges and theuser’sstatusforeach.Youcannotmakechanges totheuser IDfromthis display.

EnablingaservicetoolsuserIDusingDST:

Toenableaservicetoolsuser IDfromdedicatedservicetools(DST), completethese steps. 1. StartDST. Refertotheinformationaboutaccessingservice toolsusingDST.

4. On theWorkwithServiceToolsUser IDdisplay,selecttheuser IDyouwanttoenableandtype5

(Enable) intheOptionfield.TheEnableServiceToolsUserIDdisplayappears. 5. PressEntertoconfirmyourchoicetoenabletheservicetoolsuserIDyouselected.

DisablingaservicetoolsuserIDusingDST:

Todisableaservicetoolsuser IDfromdedicatedservicetools(DST), completethese steps. 1. StartDST. Refertotheinformationaboutaccessingservice toolsusingDST.

(22)

4. OntheWorkwithServiceToolsUser IDdisplay,selecttheuserIDyouwanttodisableandtype6

(Disable)intheOptionfield.TheDisableServiceToolsUserIDdisplayappears. 5. PressEntertoconfirmyourchoicetodisabletheservicetoolsuserIDyouselected.

DeletingaservicetoolsuserIDusing DST:

TodeleteaservicetoolsuserIDfromdedicatedservicetools(DST),completethesesteps.

Note: IBM-suppliedservicetoolsuserIDscannotbedeleted.

2. SignontoDSTusingyourservicetoolsuser IDand password.WhentheUsededicated servicetools

4. OntheWorkwithServiceToolsUser IDdisplay,selecttheuserIDyouwanttodeleteandtype3

(Delete)intheOptionfield.TheDelete ServiceToolsUserIDdisplayappears. 5. Youare promptedforconfirmationof yourchoicetodeletetheuser ID.

v PressEntertodeletetheuserID.

v PressF12(Cancel)tocanceltheactionand returntotheWorkwithServiceToolsUserIDdisplay. Related concepts

ConfiguringservicetoolsuserIDsusingSST:

Youcanusesystemservicetools(SST)tocreate,change,display,enable,disable,and deleteservicetools userIDs.

Creatingaservicetools userIDusingSST:

Tocreateaservicetoolsuser IDfromsystemservicetools(SST),completethesesteps. 1. StartSST.

2. SignontoSSTusingyour servicetoolsuserIDandpassword.

3. WhentheSystemServiceTools(SST)mainmenuappears,selectoption 8(Workwithservicetools

userIDsanddevices).

4. FromtheWorkWithServiceToolsUserIDsAnd Devicesdisplay,selectoption 1(Servicetoolsuser

IDs).

5. Type1(Create)ontheServiceToolsUserIDsdisplay,and typethenewservicetoolsuserIDinthe

(23)

Note: UserIDscanbefrom1-10 characters.Theyshouldbeinuppercase andcanincludelettersand

numbers,aswellasthespecialcharacters #,@,$,or_.Specialcharactersareallowed forthe firstcharacterintheuserID. UserIDscannotinclude spacesbetweencharacters.

6. Enterinformationaboutthenewuser ID:

v Username:Thenameofthenewservicetoolsuser ID.

v Password:Thispasswordisusedbythenewuser ID.Thepasswordmustbe atleast1 characterin

length.IfyouuseDESencryption(ordefaultpasswordlevel),themaximumpasswordallowed is8 digits.IfyouuseSHAencryption(orpasswordlevel2),then 128-digitcase-sensitivepasswordsare allowed.

v AllowuserIDaccessbeforestoragemanagementrecovery:Thedefaultforthis fieldis2 (No).

v Setpasswordtoexpired:The defaultforthisfieldis1(Yes).

v Description:Thisisanoptional field,whichcanbeusedformoredetailedinformationaboutthe

owneroftheuserID, suchasname, department,andtelephone number.

7. AfterallinformationabouttheuserIDhasbeen entered,youcanchooseoneoftheseoptions:

v Tocreatetheuser IDwith thedefaultfunctionalprivileges,pressEnter.

v Tochangethedefaultfunctional privileges,pressF5togo totheChangeServiceToolsUserID

Privilegesdisplay.Thisdisplaylistsalltheservicetoolstowhichprivilegesmight begranted.See Changingthefunctionalprivilegesfora servicetoolsuserIDusingSSTfor moreinformationabout changingfunctionalprivileges.

“Changingthefunctionalprivilegesfora servicetoolsuserIDusingSST”

Tochangethefunctionalprivileges foraservicetoolsuser IDfromsystemservicetools(SST), completethesesteps.

ChangingthefunctionalprivilegesforaservicetoolsuserIDusingSST:

Tochangethefunctional privilegesfora servicetoolsuserIDfromsystemservicetools(SST),complete thesesteps.

1. StartSST.

2. Sign ontoSSTusingyour servicetoolsuserIDandpassword.WhentheSystemServiceTools(SST)

mainmenuappears,selectoption8 (WorkwithservicetoolsuserIDsand devices).

3. From theWorkWithServiceToolsUserIDsAnd Devicesdisplay,selectoption 1(Servicetoolsuser

IDs).

4. On theServiceToolsUserIDsdisplay,selecttheuser IDto changeandtype7 (Changeprivileges)in

theOptionfield.TheChangeServiceToolsUserPrivileges displayappears. v

Type1(Revoke) intheOptionfieldnext tothefunctionalprivilegesyouwantto removefromthe

userID.

v Type2(Grant) intheOptionfieldnexttothefunctionalprivileges youwanttoaddtotheuser ID.

5. PressEntertoenablethesechanges.IfyoupressF3(Exit)before pressingEnter, thechangesdonot

takeeffect. IfyoupressF9(Defaults),thefunctionalprivilegesare resettothedefaultvalues.

Tocreatea servicetoolsuserIDfromsystemservicetools(SST),completethesesteps. |

| | |

(24)

ChangingthedescriptionforaservicetoolsuserIDusingSST:

Tochangethedescriptionfora servicetoolsuserIDfromsystemservicetools(SST),completethese steps.

1. StartSST.

2. SignontoSSTusingyour servicetoolsuserIDandpassword.WhentheSystemServiceTools(SST)

mainmenuappears,selectoption8 (Workwithservicetoolsuser IDsand devices).

IDs).

4. OntheServiceToolsUserIDsdisplay,selecttheuser IDdescriptiontochangeand type8(Change

description)intheOptionfield.

5. IntheDescriptionfield,entera newdescriptionfortheuser ID.Thismightinclude theuser’sname,

department,andtelephonenumber.

DisplayingaservicetoolsuserIDusing SST:

Todisplayaservicetoolsuser IDfromsystemservice tools(SST),completethesesteps. 1. StartSST.

2. SignontoSSTusingyour servicetoolsuserIDandpassword.WhentheSystemServiceTools(SST)

mainmenuappears,selectoption8 (Workwithservicetoolsuser IDsand devices).

IDs).

4. OntheServiceToolsUserIDsdisplay,selecttheuser IDyouwanttodisplayandtype4 (Display)in

theOptionfield.TheDisplayServiceToolsUserIDdisplayappears.Thisdisplayshowsinformation relatingtotheuser ID,includingthefollowinginformation:

v Previoussign-on(dateandtime).

v Sign-onattemptsnotvalid.

v Status.

v Datepasswordlastchanged.

v AllowuserIDaccessbefore storagemanagementrecovery (YesorNo).

v Datepasswordexpires.

v Passwordset toexpire(YesorNo).

5. PressF5(Displayprivileges) toviewthefunctionalprivileges associatedwiththisuser ID.The

DisplayServiceToolsUserPrivileges displayappears.Thisdisplaylists allfunctionalprivileges and theuser’sstatusforeach.Youcannotmakechanges totheuser IDfromthis display.

EnablingaservicetoolsuserIDusingSST:

(25)

1. StartSST.

IDs).

4. On theServiceToolsUserIDsdisplay,selecttheuser IDyouwanttoenableandtype5 (Enable)in

theOptionfield.TheEnableServiceToolsUserIDdisplayappears.

5. PressEntertoconfirmyourchoicetoenabletheservicetoolsuserIDyouselected. Related tasks

DisablingaservicetoolsuserIDusingSST:

Todisableaservicetoolsuser IDfromsystem servicetools(SST),completethesesteps. 1. StartSST.

IDs).

4. On theServiceToolsUserIDsdisplay,selecttheuser IDyouwanttodisableandtype6 (Disable)in

theOptionfield.TheDisableServiceToolsUserIDdisplayappears.

5. PressEntertoconfirmyourchoicetodisabletheservicetoolsuserIDyouselected. Related tasks

DeletingaservicetoolsuserIDusing SST:

TodeleteaservicetoolsuserIDfromsystemservicetools(SST),completethese steps.

Note: IBM-suppliedservicetoolsuserIDscannotbedeleted.

1. StartSST.

IDs).

4. On theServiceToolsUserIDsdisplay,selecttheuser IDyouwanttodeleteand type3 (Delete)inthe

Optionfield.TheDelete ServiceToolsUserIDdisplayappears.

5. Youare promptedforconfirmationof yourchoicetodeletetheuser ID.

v

PressEntertodeletetheuserID.

v PressF12(Cancel)tocanceltheactionand returntotheWorkwithServiceToolsUserIDdisplay. Related tasks

(26)

Changing

service

tools

user

IDs

and

passwords

YouhavevariouswaystochangetheservicetoolsuserIDsandpasswords.Youcanusededicated servicetools(DST),orsystemservicetools(SST),whichistheStartSST(STRSST)command,orthe ChangeServiceToolsUserID(QSYCHGDS)API.

YoushouldhavealreadyconfiguredservicetoolsuserIDsand youmight wanttoreviewthe

recommendationsformanagingservice toolsuser IDsbeforechanginganyexistingservicetoolsuserIDs andpasswords.

Attention: Ifyouloseorforgetthepasswordsforallsecurityofficerprofilesand allsecurityservice

toolsuserIDs,youmight needtoinstall andinitializeyour systemfromthedistributionmediato recover them.Forthisreason,it issuggestedthatyoucreatemultiple profilesanduser IDs.Contact yourservice providerforassistance.

“Recovering orresettingQSECOFR passwords”onpage22

WhenIBMshipsasystem,botha QSECOFRuser profileand aQSECOFR servicetoolsuserIDare supplied.Whenyouloseyour QSECOFRuser profilepasswordoryourQSECOFR servicetoolsuser ID, useoneofthepasswordstoresettheother.

“Configuringservicetoolsuser IDs”onpage12

Youcancreate,display,change,and deleteservicetoolsuserIDsfromdedicatedservicetools(DST)or system servicetools(SST).

“RecommendationsformanagingservicetoolsuserIDs” onpage25

Here aretherecommendationstoensurethesecurityofyour servicetoolsuserIDs.

Changingservice toolsuserIDsandpasswordsusingDST:

Tochangeaservicetoolsuser IDpasswordusingdedicatedservicetools(DST),completethesesteps. 1. StartDST.Refertotheinformationaboutaccessing servicetoolsusingDST.

2. SignontoDSTusingyourservicetoolsuser IDand password.TheUsededicatedservicetools(DST)

displayappears.

3. Selectoption5(Workwith DSTenvironment)and pressEnter. TheWorkwithDSTEnvironment

displayappears.

5. OntheWorkwithServiceToolsUser IDdisplay,findtheuser IDtochangeand type2(Change

password)intheOptionfield.

a. Ifyouhavetheservicetoolsecurityprivilegethatallowsyoutochangeotherservicetoolsuser

IDs,theChangeServiceToolsUserPasswordforAnotherUserdisplayisshown.Theservicetools user IDnameisdisplayed.Verifythatthis istheuserIDnameyouwanttochange.Completethe followingfields:

v New password:Enteranew password.

v SetPasswordtoexpired:Type 1(Yes)or2 (No)inthisfield.Thedefaultvalue is1 (Yes).

b. Ifyoudonothavethesystem administrativeprivilegethatallows youtochangeotherservice

toolsuser IDs,theChangeServiceToolsUserPassworddisplayisshown.Completethefollowing fields:

v Current password:Enterthepasswordcurrentlyinusefortheservicetoolsuser ID.

v New password:Enteranew password.Thispasswordcannotbeoneof your18previous

passwordsforthis servicetoolsuserID.Thedefaultprevious passwordrememberedis18. Option10(Duplicate passwordcontrol)canbeusedtochangethevaluefrom0to 32. v New password(to verify):Enterthenewpasswordagain.

(27)

6. PressEntertocompletethechange.Ifyournew passwordisnotaccepted,youmight nothave

complied withthepasswordpolicies forservicetoolsuserIDs.Reviewthese policiesandmake sure youcomplywiththemwhenchoosing aservicetoolsuserIDpassword.Themaximum requiredfor thepasswordis8 or128digits dependinguponwhetheryouuseDESorSHAencryption.

“Creatingaservicetoolsuser IDusingDST”onpage13

Tocreatea servicetoolsuserIDusingdedicatedservice tools(DST), followthesesteps.

“Configuringservicetoolsuser IDsusingDST”onpage13

Youcanusededicatedservice tools(DST)tocreate,change,display,enable,disable,and deleteservice toolsuser IDs.

Changingservicetools userIDsandpasswords usingSST:

Tochangeaservicetoolsuser IDpasswordusingsystemservicetools(SST),completethesesteps. 1. StartSST.

2. Sign ontoSSTusinga servicetoolsuserIDandpasswordthathastheservicetoolsecurityprivilege.

The SystemServiceTools(SST)mainmenuappears.

3. From theSystemServiceTools(SST)mainmenu,selectoption8(Workwith servicetoolsuserIDs

and devices).

IDs).

5. On theServiceToolsUserIDsdisplay,findtheuserIDtochangeandtype 2(Changepassword)in

theOptionfield.

6. The ChangeServiceToolsUserPasswordforAnotherUserdisplayappears.Theservicetoolsuser ID

nameisdisplayed.Verifythatthisistheuser IDnameyouwanttochangeandcompletethe followingfields:

v Newpassword:Entera newpassword.Theminimum requiredforthepasswordis1 digit(sameas

creatingapassword)andthemaximumis8or128 digitsdependinguponwhetheryouuseDESor SHAencryption.

v SetPasswordtoexpired:Type 1(Yes)or2 (No)inthis field.The defaultvalueis1(Yes).

7. PressEntertocompletethechange.Ifyournew passwordisnotaccepted,youmight nothave

complied withthepasswordpolicies forservicetoolsuserIDs.Reviewthese policiesandmake sure youcomplywiththemwhenchoosing aservicetoolsuserIDpassword.

Tocreatea servicetoolsuserIDfromsystemservicetools(SST),completethesesteps.

“Configuringservicetoolsuser IDsusingSST” onpage16

Youcanusesystem servicetools(SST)tocreate,change,display,enable,disable,anddeleteservice toolsuser IDs.

(28)

Changingservice toolsuserIDsandpasswordsusingtheSTRSSTcommandorQSYCHGDSAPI:

Youcanchangeyour servicetoolsuserIDpasswordusingtheStartSystemServiceTools(STRSST) commandortheChangeServiceToolsUserID(QSYCHGDS)API.

ChangingyourservicetoolsuserIDpasswordusingtheSTRSST command:

Tochangeyourservicetoolsuser IDpasswordusingtheStartSystemServiceTools(STRSST)command, completethese steps.

1. OntheSTRSSTcommandsign-onpanel,type yourservicetoolsuserIDandpressF9(Change

Password).TheChangePassworddisplayappears.

2. FromtheChangePassworddisplay,enteryour currentpassword,yournew password,andthenew

passwordagaintoverify it.Thispasswordcannotbe oneofyour18previouspasswords.Ifyoutryto useaprevious password,youget anerrormessage.PressEnter.

Ifallpasswordsaretypedcorrectlyand yournew passwordisaccepted,youareable tosignonwith yournew password.Ifyournew passwordisnotaccepted,youmight nothavecompliedwith the passwordpolicies forservicetoolsuserIDs.Reviewthesepoliciesandmake sureyoucomplywiththem whenchoosinga servicetoolsuserIDpassword.

ChangingservicetoolsuserIDsand passwordsusingtheQSYCHGDS API:

YoucanusetheChangeServiceToolsUserID(QSYCHGDS)APItochangeyour servicetoolsuserID andpasswordortochangetheservicetoolsuserIDandpasswordforanotheruserifyouhavesufficient privileges.

TheQSYCHGDSAPIcanalso beusefulifyouhaveseveralsystemsandyouneedtomanage service toolsuserIDsacrossallofthosesystems.

ChangeServiceToolsUserID(QSYCHGDS)API

Recovering

or

resetting

QSECOFR

passwords

WhenIBM shipsa system,bothaQSECOFR userprofileanda QSECOFRservicetoolsuser IDare supplied.WhenyouloseyourQSECOFR userprofilepasswordoryourQSECOFRservice toolsuser ID, useoneof thepasswordstoresettheother.

YourQSECOFRservicetoolsuserIDcanhaveadifferentpasswordfromyour QSECOFRuser profile. Servicetoolsuser IDshavedifferentpasswordpoliciesfromuser profiles.

Itissuggestedthatyoucreatemultipleprofilesanduser IDs.Contact yourserviceproviderfor

assistance.Ifyouknoweither ofthesepasswords,thisinformationtellsyouhowtorecoverthepassword youdo notknow.

(29)

“ChangingservicetoolsuserIDsand passwords”onpage20

YouhavevariouswaystochangetheservicetoolsuserIDsand passwords.Youcanusededicated servicetools(DST),or systemservicetools(SST),whichistheStartSST(STRSST)command, orthe ChangeServiceToolsUserID(QSYCHGDS)API.

“RecommendationsformanagingservicetoolsuserIDs” onpage25

Here aretherecommendationstoensurethesecurityofyour servicetoolsuserIDs.

“TroubleshootingservicetoolsuserIDsandpasswords” onpage31

Whenyouhaveproblemswith servicetoolsuserIDsandpasswords,refertothisinformationfor solutions.

ResettingtheQSECOFRuserprofilepassword:

IfyouknowthepasswordfortheQSECOFR servicetoolsuser ID,usethispasswordtoresetthe QSECOFRuser profiletoitsinitialvalue (QSECOFR).

Thisprocedurerequiresyoutoperform aninitialprogramload(IPL)onyour system.Thechangedoes nottakeeffectuntilafter theIPL.ToresettheQSECOFR userprofile,completethefollowingsteps:

1. StartDST.RefertotheinformationaboutaccessingservicetoolsusingDST.

2. EntertheQSECOFR servicetoolsuserIDandpasswordontheDSTSign-Ondisplay.

3. Selectoption5 (WorkwithDSTenvironment)fromtheUse DSTmenu.

4. Selectoption6 (WorkwithServiceToolsSecurityData) fromtheWorkwithDSTEnvironmentmenu.

TheWorkwithServiceToolsSecurityDatamenuisshown.

5. Selectoption1 (Resetoperatingsystemdefaultpassword). TheConfirmResetofSystemDefault

Passworddisplayisdisplayed.

6. PressEntertoconfirmthereset.Aconfirmationmessageisdisplayed tellingyouthatthesystemhas

settheoperatingsystempasswordoverride.

7. ContinuepressingF3(Exit)toreturnto theExitDSTmenu.

8. Selectoption1 (ExitDST).TheIPLorInstalltheSystemmenu isdisplayed.

9. Selectoption1 (PerformanIPL).Thesystemcontinueswith amanual IPL.

10. WhentheIPLcompletes,return thekeylock switchorelectronickeysticktotheAutoposition,if

applicable.

11. Signontoi5/OSasQSECOFR.UsetheCHGPWDcommandtochangetheQSECOFRpasswordtoa

newvalue.Storethenewvalue inasafeplace.

Attention: DonotleavetheQSECOFRpasswordsettothedefault.Thisisa securityexposure because

thisisthevalue includedin everysystemandiscommonlyknown.

ResettingtheQSECOFRservice toolsuserIDandpassword:

IfyouknowthepasswordfortheQSECOFR userprofile,usethispasswordtoresetthepasswordforthe IBM-suppliedservice toolsuser IDthathasservicetoolssecurityprivilege(QSECOFR)tothe

IBM-supplieddefaultvalue.

Security Service tools user IDs and passwords

System

i

Security

Service

tools

user

IDs

and

passwords

Version

5

Release

4

System

i

Security

Service

tools

user

IDs

and

passwords

Version

5

Release

4

Contents

Service

tools

user

IDs

and

passwords

. 1

Appendix.

Notices

.

.

.

.

.

.

.

.

.

. 35

Service

tools

user

IDs

and

passwords

What’s

new

for

V5R4

What’s

new

as

of

April

2007

What’s

new

as

of

September

2007

How

to

see

what’s

new

or

changed

Printable

PDFs

Saving

PDF