Access privileges for unreserved ports

Edit online

Understand the access privileges required for the use of unreserved ports by the Tivoli Enterprise Monitoring Server and OMEGAMON agent started tasks.

During initialization, the Tivoli Enterprise Monitoring Server started task queries the TCP/IP stack for interface information.

When a TCP/IP stack is configured with the statement PORT UNRSV, access to unreserved ports is controlled by job name, protocol, and optional z/OS System Authorization Facility (SAF) resource checking, as described in the following sections.

Note: If statement PORT UNRSV does not exist for a protocol, unreserved-port access is allowed by default.

Controlled by job name

If statement PORT UNRSV exists for a protocol, the stack evaluates the most specific job name match; if no match is found, access is denied.

Controlled by protocol

For User Datagram Protocol (UDP), access control is evaluated at bind time.

For Transmission Control Protocol (TCP), control is evaluated by PORT statement parameters WHENLISTEN (default) or WHENBIND, based on stack configuration.

Controlled by optional SAF resource checking

For the Tivoli Enterprise Monitoring Server and the OMEGAMON agent started tasks, READ access to the applicable SERVAUTH profile is required when the matching PORT UNRSV rule uses the SAF keyword.

Assign READ access to the following SAF resources in the SERVAUTH class:
  • EZB.PORTACCESS.sysname.tcpname.UNRSVUDP
  • EZB.PORTACCESS.sysname.tcpname.UNRSVTCP

    where sysname is the value of the MVS &SYSNAME. system symbol and tcpname is the name of the procedure used to start the TCP stack.

    Note: When port allocation control is configured with OMEGAMON parameters for TCP (IP.PIPE or IP.SPIPE) ports, READ access to EZB.PORTACCESS.sysname.tcpname.UNRSVTCP is not required. For details on controlling allocated ports using OMEGAMON parameters, see Controlling port number assignments.
If proper access the SAF resources is not defined, socket bind or listen processing can fail authorization and issue RACF processing messages, such as the following example: 
ICH408I USER(userid) GROUP(group-name) NAME(user-name)
ICH408I EZB.PORTACCESS.sysname.tcpname.UNRSVUDP CL(SERVAUTH)
ICH408I INSUFFICIENT ACCESS AUTHORITY 
ICH408I FROM EZB.PORTACCESS.*.IPSTACK.UNRSVUDP (G) 
ICH408I ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )