All ACF2 Logonids have been suspended due to PASSLMT(0) set in GSO PSWD record ACF01013
search cancel

All ACF2 Logonids have been suspended due to PASSLMT(0) set in GSO PSWD record ACF01013

book

Article ID: 139642

calendar_today

Updated On:

Products

ACF2 ACF2 - DB2 Option ACF2 for zVM ACF2 - z/OS ACF2 - MISC

Issue/Introduction

When logging on users would receive two violations and then their account would be suspended.
GSO PSWD PASSLMT option was changed from two to 0 to stop pass limit checking.
The next day no one could log on.
Message ACF01013 LOGONID lid SUSPENDED BECAUSE OF PASSWORD VIOLATIONS was issued for every logon.

How can a site recover from this?

Environment

Release : 16.0

Component : CA ACF2 for z/OS

Cause

Per Control(GSO) PSWD Field Descriptions..


If the GSO(PSWD) PASSLMT(0) is specified, all user logonids are suspended the next time they try to logon, regardless of whether they have any invalid access attempts.

Resolution

Here are the instructions to start ACF2 on a non-existent sysid so that the passlmt value can be changed to 2 instead of zero.

1) From operator console issue command P ACF2
2) From operator console issue command S ACF2,PARM='SYSID(xxxx)'   xxxx is non-existent sysid.
3) there will be about 20 of the following messages..
     ACF79518 WARNING: NO RECORD(S) FOUND FOR GSO AUTHEXIT                 
     ACF79530 NO GSO RECORD FOUND FOR: AUTOERAS SYSID: XXXX             
     *0006 ACF79534 CONFIRM USE OF DEFAULT VALUES FOR: AUTOERAS SYSID: XXXX
      REPLY R nn,U to each request.
4) once ACF2 is initialized successfully...
    ACF8A900 ACF2 INITIALIZATION COMPLETE - CA ACF2  REL 16
    LOGON TO TSO

5) go into ACF command and issued the following....
     SET CONTROL(GSO),SYSID(yyyy)           yyyy is your initial sysid
     CHANGE PSWD PASSLMT(5)
    END
     Make sure the PSWD record is displayed showing the correct original sysid

6) from operator console issue command P ACF2
7) from operator console issue command S ACF2 

This should then start acf2 with the original sysid.

Your system should be back to normal with passlmt(5).

Additional Information

PASSLMT(0) is a special setting that can be used in case of a security lockdown.

If a site believes someone is trying to hack their system, PASSLMT(0) can be set to stop anyone from logging on to the system. 

Use this parameter with strict caution.