How to prevent ACF2 users from assigning a different console name(SDSF SET CONSOLE command) other that their default userid?

Products

• ACF2

Issue/Introduction

Currently, users are changing their virtual console names to something different other than their default userid.  This has created some concerns and was also identify as security exposure.  The SDSF SET CONSOLE Command provides the ability to assign an extended console name.  Is there an ACF2 resource which will prevent users from assigning a different console name other that their default userid.   

Environment

Release : 16.0

Component : ACF2 for z/OS

Resolution

For a TSO/E user, the SET CONSOLE command defaults to the userID as the console name, but the user can override the default with the NAME(console-name) operand.

To control the ability to issue the SDSF SET CONSOLE command the Security administrator must ensure that Resource class OPERCMDS rules are in place for the resource MVS.MCSOPER.console-name. By default the default TYPE code for Resource class OPERCMDS is TYPE(OPR). An example rule follows:

$KEY(MVS) TYPE(OPR)
MCSOPER.- UID(*************USER001) SERVICE(READ) PREVENT     
MCSOPER.- UID(*************USER002) SERVICE(READ) ALLOW

The rule will allow USER002 to issue the SET CONSOLE command but not USER001. Note the the rule entry for USER001 is not  needed because by default access would not be allowed(no rule, no access) although site may include the rule for clarity.