What does CA Roscoe SET PRIV ON Do and What Should it be Used For?

Products

• Roscoe

Issue/Introduction

Should the SET PRIV ON command be secured?

 

Environment

Release:
Component: ROSCOE

Resolution

The SET PRIV ON command must be issued before entering any privileged commands. Even if a user has authority to any privileged commands, they will not be able to enter privileged commands before typing SET PRIV ON first. The SET PRIV ON command needs to be entered only once during each session.  The SET PRIV ON command may be put in the users signon proc to have it executed every time they sign on so they do no have to enter it.

SET PRIV ON has no effect if the user issuing it does not have authority to any privileged commands. They will not get any error message, but it will not let them do anything either.

A user is privileged if the ability to use any privileged commands is set in USER ABLE TO USE PRIVILEGED CMDS (Y/N): area of their UPS profile. This is configured with UPSMNT60 for each of 6 areas - OPER, RPS, ETSO, LIB, ACCT, UPS. The default is N for each area. (not privileged).

If the user entering SET PRIV ON already has authority to any privileged commands, then they will be placed in a privileged mode where they can enter the privileged commands they have authority for (and any other commands). They will be in this mode until they sign off.

The command does not need to be secured, because it does not confer any privileges to those who do not already have them. It is even safe to put it in the global signon proc, because it does not grant any extra authority to do anything. It only allows a user authorized to specific privileged commands to issue them.

 

Additional Information

See Section 4.3 Executing UPSMNTnn in the CA Roscoe r6 System Reference Guide for more information about privileged users and their authority.