XCOM for z/OS using encrypted passwords from Linux, Unix, Windows (LUW)

Products

• XCOM Data Transport - z/OS
• XCOM Data Transport - Linux PC
• XCOM Data Transport - Windows

Issue/Introduction

Need guidance with coding/entering into the XCOM for z/OS SYSIN01 DD the encrypted password (hash) created by the XCOM for Linux XCOMENCR utility.
Currently, a transfer using the encrypted password fails while a transfer using the plain text Linux password is successful. 
When using the encrypted Linux password on z/OS, there is a misleading network error, and no message is reported like:
XCOMU0287E Error setting remote user id

There are also no errors in the Linux xcom.log or any other error in files /var/log/secure or /var/log/messages.
What are the correct steps to be followed on the z/OS side to use an encrypted Linux password?


In another scenario for a z/OS to Windows transfer using the plain text Windows password is successful, but the encrypted Windows password gives error:
XCOMN0287E Error setting remote user id

Environment

XCOM™ Data Transport® for z/OS
XCOM™ Data Transport® for UNIX/Linux
XCOM™ Data Transport® for Windows

Resolution

Table of Contents

• Linux
• Windows
• Notes

Linux

In the XCOM for z/OS SYSIN01, the encrypted PASSWORD parameter can have a maximum length of 70 bytes/characters.
Therefore to use the Linux encrypted password on z/OS requires these steps to change it:

1. Remove any space characters.
2. Remove the trailing 00.
3. Change lowercase letters to uppercase letters (CAPS).
4. For Example,
   If the XCOMENCR on Linux generates:
   PASSWORD.ENCRYPTED=5e 79 44 67 e4 e0 cc de c8 f6 9a 6e 63 9c 66 8d 72 8c 5b 79 65 7e 67 89 84 8d 57 7e 70 80 49 8a 80 9f 58 00
   Then this value needs to be used on z/OS:
   PASSWORD=5E794467E4E0CCDEC8F69A6E639C668D728C5B79657E6789848D577E7080498A809F58

Windows

The same advice is true for Windows but the encrypted password will be longer than 70 bytes.

1. Remove any space characters.
2. Take the first 70 bytes/characters.
3. Change lowercase letters to uppercase letters (CAPS).

Notes

• XCOM for z/OS parameters e.g. PASSWORD do not use the ".ENCRYPTED" notation like LUW platforms to identify the encrypted value parameters.
  
  
• Original LUW passwords that are longer than 31 bytes cannot currently be used in encrypted form on z/OS.
  For example, to encrypt a 32 byte password plus 4 byte key would require 36 bytes, in hex notation 72 characters. XCOM for z/OS encrypted password is limited to 70 characters so specifying a 32 byte encrypted password is not possible with z/OS at this time.
  The enhancement for z/OS to support encrypted LUW passwords > 31 bytes is now part of the XCOM Engineering backlog as part of an overall task to improve the consistency of XCOM platform support of encrypted passwords.

Additional Information

1. Since XCOM for z/OS needs to distinguish between passphrases and encrypted passwords, both of which could be long, any contents of the PASSWORD field which reaches out to the 70th character is considered to be an encrypted password. If you need to enter a plain text passphrase that is longer than 69 bytes, line continuation must be used where the plus sign and blank ("+ ") terminate the line. The passphrase can then continue on the next line, starting between columns 2 and 16 inclusive.
   Examples:
   a. Below is treated as plain text and reads both lines for value:
   PASSWORD='I am a 100-byte length passphrase used in XCOM team testing. I am '+ 
     'not lengthy to remember for anyone'
   b. Below is treated as an encrypted value:
   PASSWORD=5E794467E4E0CCDEC8F69A6E639C668D728C5B79657E6789848D577E7080498A809F58
   
   
2. Linux/Unix USERIDs are case-sensitive. On z/OS the exact case of the USERID needs to be used as well as the CAPS OFF command to ensure the case is not changed automatically while saving the data set member.
   
   
3. XCOM™ Data Transport® for z/OS 12.0 > Using > The Batch Interface > SYSIN01 Parameters