How do I secure the ST (SECTRACE) command?

Products

• Cleanup
• Datacom
• DATACOM - AD
• CIS
• COMMON SERVICES FOR Z/OS
• 90S SERVICES
• DATABASE MANAGEMENT SOLUTIONS FOR DB2 FOR Z/OS
• COMMON PRODUCT SERVICES COMPONENT
• Common Services
• CA ECOMETER SERVER COMPONENT FOC
• Easytrieve Report Generator for Common Services
• INFOCAI MAINTENANCE
• IPC
• UNICENTER JCLCHECK COMMON COMPONENT
• Mainframe VM Product Manager
• CHORUS SOFTWARE MANAGER
• CA ON DEMAND PORTAL
• CA Service Desk Manager - Unified Self Service
• PAM CLIENT FOR LINUX ON MAINFRAME
• MAINFRAME CONNECTOR FOR LINUX ON MAINFRAME
• GRAPHICAL MANAGEMENT INTERFACE
• WEB ADMINISTRATOR FOR TOP SECRET
• Xpertware
• Top Secret
• Top Secret - LDAP
• Top Secret - VSE

Issue/Introduction

The client wants to know how to secure the ST (SECTRACE) command?

He was not able to secure it using OPERCMDS.

Should he be able to? Alternatively, is there another resource that he can use to secure the command?

Environment

Release:
Component: AWAGNT

Cause

IBM Z/OS 

Product: CA Top Secret Security for z/OS

 

Resolution

With SDSF you can protect user to enter a system command (/) with: 

SDSF(ISFOPER.SYSTEM) 

But, there is no more granularity for ST command.

 

With SYSVIEW you can protect ST command either with the internal security and/or external one. 

In that case you will receive: 

MVS$014E Not authorized for ST command

 

From console you can't do anything.

There is no way to prevent ST command to be issued and the message to be issued as well. 

If user issue ST by error, he will have to reply CANCEL to get out. 

If customer owned OPERCMDS(TRCE.) only permitted acids could do tracing. 

Just entering ST starts SECTRACE address space, but doesn't do anything.