Limiting the use of the CONSOLE and CONSPROF commands

The CONSOLE command allows users to issue MVS™ system and subsystem commands and obtain responses to those commands. By default, users cannot use the CONSOLE command.

You can grant users access to the CONSOLE command using one of the following methods:

RACF® RDEFINE and PERMIT commands.
Use the RACF RDEFINE command to define CONSOLE as a RACF resource belonging to the TSOAUTH RACF class. Then grant selected users access to the CONSOLE resource using the RACF PERMIT command.
Logon pre-prompt exit IKJEFLD or IKJEFLD1.
CONSOLE exit IKJCNXAC and CONSPROF exit IKJCNXCI. IKJCNXAC grants users CONSOLE command authority for the duration of the console session. IKJCNXCI grants users CONSOLE command authority for the duration of the CONSPROF command.
Note: Because each of these exits can give users only temporary CONSOLE command authority, it is suggested that you use both exits to authorize users.

The CONSPROF command allows users to set up a console profile to tailor the processing of the CONSOLE command. Users require CONSOLE command authority to use the CONSPROF command. Granting users CONSOLE command authority using RACF commands or the LOGON pre-prompt exit automatically allows them to use the CONSPROF command.

For information about writing CONSOLE and CONSPROF exit routines, see Customizing the CONSOLE and CONSPROF commands.