All ACF2 Logonids have been suspended due to PASSLMT(0) set in GSO PSWD record ACF01013
Article ID: 139642
Updated On:
Products
Issue/Introduction
When logging on users would receive two violations and then their account would be suspended.
GSO PSWD PASSLMT option was changed from two to 0 to stop pass limit checking.
The next day no one could log on.
Message ACF01013 LOGONID lid SUSPENDED BECAUSE OF PASSWORD VIOLATIONS was issued for every logon.
How can a site recover from this?
Environment
Release : 16.0
Component : CA ACF2 for z/OS
Cause
Per Control(GSO) PSWD Field Descriptions..
If the GSO(PSWD) PASSLMT(0) is specified, all user logonids are suspended the next time they try to logon, regardless of whether they have any invalid access attempts.
Resolution
Here are the instructions to start ACF2 on a non-existent sysid so that the passlmt value can be changed to 2 instead of zero.
1) From operator console issue command P ACF2
2) From operator console issue command S ACF2,PARM='SYSID(xxxx)' xxxx is non-existent sysid.
3) there will be about 20 of the following messages..
ACF79518 WARNING: NO RECORD(S) FOUND FOR GSO AUTHEXIT
ACF79530 NO GSO RECORD FOUND FOR: AUTOERAS SYSID: XXXX
*0006 ACF79534 CONFIRM USE OF DEFAULT VALUES FOR: AUTOERAS SYSID: XXXX
REPLY R nn,U to each request.
4) once ACF2 is initialized successfully...
ACF8A900 ACF2 INITIALIZATION COMPLETE - CA ACF2 REL 16
LOGON TO TSO
5) go into ACF command and issued the following....
SET CONTROL(GSO),SYSID(yyyy) yyyy is your initial sysid
CHANGE PSWD PASSLMT(5)
END
Make sure the PSWD record is displayed showing the correct original sysid
6) from operator console issue command P ACF2
7) from operator console issue command S ACF2
This should then start acf2 with the original sysid.
Your system should be back to normal with passlmt(5).
Additional Information
PASSLMT(0) is a special setting that can be used in case of a security lockdown.
If a site believes someone is trying to hack their system, PASSLMT(0) can be set to stop anyone from logging on to the system.
Use this parameter with strict caution.
Feedback
