MainframeSec - Internal Technical Forum

Archive of developer posts – for awareness training only

Hardcoded RACF credentials in FTP job

User: sysprog_admin | Date: 2022-10-04

Need to push job logs to the vendor box. Used JCL below:

//FTPSTEP EXEC PGM=FTP,PARM='(EXIT'
//SYSIN DD *
OPEN 192.168.4.22
USER MFUSER01 MFPass123
PUT 'SYS1.LOG.JOB001'
QUIT
/*

Security Issue: Plaintext RACF username and password.

REXX script that dumps LPAR config (IP exposed)

User: batchutil | Date: 2023-01-21

This REXX code helped me debug the LPAR setup:

/* REXX */
say "Checking host IP and LPAR details..."
address TSO "ping 10.1.5.26"
say "Connected to LPARNAME: ZOSPROD1"
say "Subnet: 255.255.254.0"

Security Issue: Exposed internal IP address and LPAR name.

Copying SYS1.PARMLIB to public dataset

User: operator99 | Date: 2023-05-08

Needed this for quick review on another system:

//COPYSTEP EXEC PGM=IEBGENER
//SYSPRINT DD SYSOUT=*
//SYSUT1 DD DSN=SYS1.PARMLIB,DISP=SHR
//SYSUT2 DD DSN=USER99.TEST.PARMLIB,DISP=(NEW,CATLG),
// DCB=(RECFM=FB,LRECL=80),SPACE=(TRK,1)
//SYSIN DD DUMMY

Security Issue: Parmlib contains system config—don't copy to public datasets!

Password in JES2 automation script

User: ops_sched | Date: 2024-03-12

Legacy script for nightly restarts (needs cleanup):

/* JES2 shutdown/restart automation */
SUBMIT 'SYS1.RESTART.JES2(JOB)' USERID=AUTORUN PASSWORD=restart123
WAIT 10
NOTIFY USERID

Security Issue: Credential embedded in script command line.