How to restrict all users to access command line in as400?

<h2 style="text-align: left;"><span style="font-size: large;">How to restrict all users to access command line in as400?</span></h2><h3 style="text-align: left;"><span style="font-size: large;">Restricting All Users From Using the Command Line</span></h3><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Troubleshooting</b></span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Problem</b></span></p><p><span style="font-size: large;">This article includes information on restricting users from being able to type commands on the command line.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Resolving The Problem</b></span></p><p><span style="font-size: large;">To limit users from using the command line, do the following for each user profile:</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">1. Issue the <b>CHGUSRPRF</b> command (<F4>) to prompt the command, then select <F10> for additional parameters.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">2. Change the Limit Capabilities to <b>*YES</b>. This will prevent users from using the command line.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">Users will still be authorized to some commands; however, they will only be able to use those commands from a menu. Every command has an "Allow Limited User" parameter. By default, this is set to *NO. The following commands are an exception and are shipped with *YES. These commands are SIGNOFF, SNDMSG, DSPMSG, DSPJOB, DSPJOBLOG, STRPCO, and WRKMSG. To view what the 'Allow Limited User parameter is set to for a specific command, use the DSPCMD command and enter the command in question.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">Note: The limited capabilities apply only to the i5 OS command line. If limited capabilities for the user profile is set to *YES and Allow Limited User is set to *NO for the command, but the user is still able to run the command, they may be using a third-party command line. You should try CALL QCMD to get to the i5 OS command line and issue the command again.</span></p><p><span style="font-size: large;"><br /></span></p><h3 style="text-align: left;"><span style="font-size: large;">How to limit user profile to access command line?</span></h3><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;"><b>Limit Capability</b> :- LMTCPB parameter tells the OS400 two things. First, it tells the OS400, if the user can make changes to ITLPGM, ITLMNU and current library values. Secondly, it says the OS400 if the user has access to command line.</span></p><p><span style="font-size: large;">When it is set to *NO, the user can make changes to ITLPGM, ITLMNU , current library and ATTN key values and also it can use the command line to run AS400 commands.</span></p><p><span style="font-size: large;"><br /></span></p><p></p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7iZoBzmaAjsCkR7pthR2IUQzoRByKyoN3rDSPxqRTgXbCNV5aIBmkXTdNLL_C9Av1Dv2GU2_JKVVORMlUoW0X3E9ebggBffkHinaYvTLsAEFWoay7RDcbFR42wbqGuoS1woVqYov3rN8/s959/How+to+restrict+all+users+to+access+command+line+in+as400..PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="285" data-original-width="959" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7iZoBzmaAjsCkR7pthR2IUQzoRByKyoN3rDSPxqRTgXbCNV5aIBmkXTdNLL_C9Av1Dv2GU2_JKVVORMlUoW0X3E9ebggBffkHinaYvTLsAEFWoay7RDcbFR42wbqGuoS1woVqYov3rN8/s16000/How+to+restrict+all+users+to+access+command+line+in+as400..PNG" /></a></div><br /><span style="font-size: large;"><br /></span><p></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">When it is set to *PARTIAL, the USER cannot make any changes to ITLPGM, ITLMNU, current library and ATTN key value but it has access to command line and can run AS400 commands.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">When it is set to *YES, the user has neither access to make any changes to ITLPGM, ITLMNU and current library nor it can access command line.</span></p><p><span style="font-size: large;"><br /></span></p><p><span style="font-size: large;">These three parameters ITLPGM, ITLMNU and LMTCPB have ability to restrict users. For example, for the server users who do not require to access the green screen 5250 emulator, can have ITLPGM as *NONE, ITLMNU as *SIGNOFF and LMTCPB as *YES. They can still access AS400 from other server which are connected to AS400. However, if the same user tries to access the AS400 from 5250 emulator, it will immediately bring the user to signoff screen thus restricting access to AS400 and command line.</span></p>

How to restrict all users to access command line in as400?

How to restrict all users to access command line in as400?Restricting All Users From Using the Command LineTroubleshootingProblemThis article includes information on restricting users from being able …

Read more »

OS/400 CL Programming : Using the QCMDEXC Program AS 400 CL Commands examples

<div dir="ltr" style="text-align: left;" trbidi="on"><h1 style="text-align: left;">OS/400 CL Programming : Using the QCMDEXC Program AS 400 CL Commands examples </h1><div><br /></div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7z5GNjrRYzOM5nMFG4rAnoPRoGV2cY5ygI_fgwKUTTSvgI3EJ998ZVz0VdxIJi8dGK-ODd69pWIkleXY2swkcqgbbl6o5E6M_GuC7wLZBP01YXIra_iBQQoQDo1uvDb6OlKiabRHqvsA/s1600/control+language.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="213" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7z5GNjrRYzOM5nMFG4rAnoPRoGV2cY5ygI_fgwKUTTSvgI3EJ998ZVz0VdxIJi8dGK-ODd69pWIkleXY2swkcqgbbl6o5E6M_GuC7wLZBP01YXIra_iBQQoQDo1uvDb6OlKiabRHqvsA/s1600/control+language.jpg" width="320" /></a></div><div><br /></div><div><br /></div><br /><br /><h3><span style="font-size: large;">Using the QCMDEXC Program</span></h3><span style="font-size: large;">QCMDEXC is an IBM-supplied program that runs a single command. It is used to run a command from within a high-level language (HLL) program or from within a CL procedure or program where it is not known at compile time what command is to be run or what parameters are to be used. The QCMDEXC program is called from within your HLL or CL procedure or program and the command it runs is passed to it as a parameter on the CALL command. <br /><br /></span><pre><span style="font-size: large;"> CL or HLL program QCMDEXC<br /> /---------------------------\ /------------------\<br /> | . | | |<br /> | . | /--� | PGM(PARM1 PARM2) | <br /> | . | | | . |<br /> | CALL QCMDEXC(PARM1 PARM2) |----/ | . |<br /> | . | | . |<br /> | . | �-------| RETURN | <br /> | . | | |<br /> \---------------------------/ \------------------/<br /></span></pre><span style="font-size: large;">After the command runs, control returns to your HLL or CL procedure or program. <br />The command is run as if it were not in a program. Therefore, variables cannot be used on the command; values cannot be returned by the command to CL variables; and commands that can only be used in CL procedures or programs cannot be run by the QCMDEXC program. The format of the call to the QCMDEXC program is the following: <br /><br /><br /></span><pre><span style="font-size: large;">CALL PGM(QCMDEXC) PARM(command command-length)<br /></span></pre><span style="font-size: large;">The command you wish to run is entered as a character string on the first parameter. If the command contains blanks, it must be enclosed in apostrophes. The maximum length of the character string is 6000 characters ; delimiters (the apostrophes enclosing the string) are never counted as part of the string. The length specified as the second value on the PARM parameter is the length of the character string passed as the command. Length must be a packed decimal value of length 15 with 5 decimal positions . <br />Thus, if you wish to replace a library list, the call to the QCMDEXC program would look like this: <br /><br /><br /></span><pre><span style="font-size: large;">CALL PGM(QCMDEXC) PARM('CHGLIBL LIBL(QGPL NEWLIB QTEMP)' 31)<br /></span></pre><span style="font-size: large;">This statement could be coded into the HLL or CL program, and when the program runs, the library list would be replaced. Used this way, however, the QCMDEXC program does not provide run-time flexibility. That is accomplished by substituting variables for the constants in the parameter list, and specifying the values for the variables in the call to the HLL or CL program. <br />For instance: <br /><br /></span><pre><span style="font-size: large;">CALL PGM(PGMA) PARM('CHGLIBL...' 3000)<br /> |<br /> |<br /> | /-----------------------------------------\<br /> \---�| PGM PARM(&STRING &LENGTH) /* PGMA */ |<br /> | DCL &STRING *CHAR LEN(3000) | <br /> | DCL &LENGTH *DEC LEN(15 5) |<br /> | . | <br /> | . | /----� QCMDEXC <br /> | . | | /-------------\<br /> | CALL PGM(QCMDEXC) PARM(&STRING &LENGTH)-+--/ | . | <br /> | . �-------------------------------------+---\ | . | <br /> | . | | | . | <br /> | . | | | CHGLIBL... |<br /> | END | | | . | <br /> \-----------------------------------------/ | | . | <br /> \-+-. | <br /> \-------------/<br /></span></pre><span style="font-size: large;">The command length, which is passed to the QCMDEXC program on the second parameter, is the maximum length of the command string being passed. If the command string is passed as a quoted string, the command length is exactly the length of the quoted string. If the command string is passed in a variable, the command length is the length of the CL variable. It is not necessary to reduce the command length to the actual length of the command string in the variable, although it is permissible to do so. <br />The same command could be run using the following CALL command from the CL procedure or program because numeric literals are passed as packed decimal values of length 15 with 5 decimal positions: <br /><br /></span><pre><span style="font-size: large;">CALL QCMDEXC (&STRING 3000)<br /></span></pre><span style="font-size: large;">Not all commands can be run using the QCMDEXC program. The command passed on a call to the QCMDEXC program must be valid within the current environment (interactive or batch) in which the call is being made. The command cannot be one of the following: <br />o       An input stream control command (BCHJOB, ENDBCHJOB, and DATA) <br />o       A command that can be used only in a CL program <br /><br /><br />To find the environment in which the command can be run, look at the syntax diagram for the command. The small box in the upper right corner of the diagram indicates the environment in which the command can be run. For example, JOB: I indicates that the command can be run interactively; JOB: B indicates that the command can be run in a batch job; Exec indicates that the command can be run with QCMDEXC. <br />You can precede the CL command with a question mark (?) to request prompting, or use selective prompting, when you call QCMDEXC in an interactive job. <br />If an error is detected while a command is being processed through the QCMDEXC program, an escape message is sent. You can monitor for this escape message in your CL procedure or program using the Monitor Message (MONMSG) command.<br /><br />If a syntax error is detected, message CPF0006 is sent. If an error is detected during the processing of a command, any escape message sent by the command is returned by the QCMDEXC program. You monitor for messages from commands run through the QCMDEXC program in the same way you monitor for messages from commands contained in CL procedures and programs. </span><br /> <br /><br /></div>

OS/400 CL Programming : Using the QCMDEXC Program AS 400 CL Commands examples

OS/400 CL Programming : Using the QCMDEXC Program AS 400 CL Commands examples Using the QCMDEXC ProgramQCMDEXC is an IBM-supplied program that runs a single command. It is used to run a command from…

Read more »

AS/400-iSeries Concepts and Terminology

<div dir="ltr" style="text-align: left;" trbidi="on"><h1 style="text-align: center;"><b>AS/400-iSeries Concepts and Terminology </b></h1><div class="MsoNormal" style="text-align: center;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimUkGJOyyz1I_HXROnf0RlDMvsby93p8srh_tdrioNvz6u98IgJuRa3dbqrW5F5PYLE12tfrAnNPKMoOT98v2xlJwiqsiFu62RHiVQoM7s9md8GRwG4KmeCfqJysO5ALfTlf19_MDSoN0/s1600/AS400-iSeries.png" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEimUkGJOyyz1I_HXROnf0RlDMvsby93p8srh_tdrioNvz6u98IgJuRa3dbqrW5F5PYLE12tfrAnNPKMoOT98v2xlJwiqsiFu62RHiVQoM7s9md8GRwG4KmeCfqJysO5ALfTlf19_MDSoN0/s1600/AS400-iSeries.png" /></a></div><div class="MsoNormal" style="text-align: center;"><b><br /></b></div><div class="MsoNormal" style="text-align: center;"><b><u><br /></u></b></div><div class="MsoNormal"> <span style="font-size: large;">The purpose of this post is to give a high level overview of the AS400-iSeries and some of the components, features, terminology, and definitions.</span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">AS/400 Architecture</span></h3><div class="MsoNormal"><span style="font-size: large;">The AS/400 is a very complex integrated system that includes hardware, software, security, a database and other components. The AS/400 Advanced Architecture is unique in that it is extremely adaptable and can easily incorporate new technologies. This is important in today’s fast changing computer marketplace. The AS/400 is designed to separate the software and hardware so changes in one have little effect in the other. This is accomplished through the Machine Interface (MI) which is a software programming interface between the application, the operating system and hardware. The MI is a complete Application Programming Interface (API) set that all applications must use in order to get to the to the hardware. This is how the AS400 achieves the software independence. </span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">OS/400 Operating System</span></h3><div class="MsoNormal"><span style="font-size: large;">The Operating System for the AS/400 is called OS/400. The OS/400 resides above the MI. This allows the operating system to be independent from the hardware.  Most operating system components handle functions such as memory, process, program, and I/O management. On the AS/400 these lower level functions are handled by the Licensed Internal Code (LIC) which is the operating system software below the MI. The LIC protects application programs and OS/400 from hardware changes. Thus again, keeping the software separate from the hardware. </span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">Integrated File System</span></h3><div class="MsoNormal"><span style="font-size: large;">The AS/400 contains an integrated file system (IFS). This means applications written on other file systems, PC, Unix, etc., can access data stored on the AS/400.  The IFS integrates all file systems on the AS/400 with one interface and one set of rules. How the AS/400 developers accomplished this was to use a single root, like a PC file system, and put all other file systems under it.  From a Windows client the AS/400 would appear as a network drive. Under that drive you would have PC-like subdirectories for all the file systems the AS/400 supports. Currently there is support for PC file systems, Unix file systems, OS/400 libraries, and others.  The IFS provides access to the data. The data must be in compatible format for the requesting application. </span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">DB2/400 Database – The Integrated Database</span></h3><div class="MsoNormal"><span style="font-size: large;">The AS400 contains a relational database called DB2/400. DB2/400 is integrated into the AS/400 partly above the MI and partly in the LIC. Conventional databases are separate software components that reside on top of the operating system. Since DB2/400 is integrated throughout the entire system it can achieve a higher level of efficiency because it is tightly integrated with the components with which it communicates. The database management system (DBMS) is a framework for storing and retrieving data. A DBMS must have an interface so users can access and manipulate the data. There are two interfaces to the AS/400: The Data Description Specifications (DDS) and Structured Query Language (SQL).  The DDS, or the native interface, was carried over from the IBM System/38. It has a look and feel similar to IBM’s Information Management System (IMS). The second interface for the AS/400 is SQL. This is the industry standard for relational databases and is an optional product that you must purchase separately. </span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">Data Warehousing</span></h3><div class="MsoNormal"><span style="font-size: large;">DB2/400 supports data warehousing. The four main components that DB2/400 utilizes for data warehousing are:  transformation and propagation tools to load the data warehouse, the data warehouse database server, analysis and end-user tools, and tools to manage the information about the data warehouse. </span></div><span style="font-size: large;">Transformation and propagation tools are used to move and manipulate data into a form more appropriate for the warehouse. It transforms operational data into informational data. <br />IBM introduced special models of the AS/400 that are able to handle the types of workloads use in data warehousing applications. These database servers utilize parallel processing and multidimensional databases. The AS/400 uses parallel I/O processing (IOP). This allows parallel processing at the I/O level for a single job.  By doing this it helps increase I/O processing time. The AS/400 also can take a single query and break it down to independent queries and these are run in parallel across the multiple processors in the system. This can increase performance for the original query. <br />Most relational databases are organized as two-dimensional tables.  A multidimensional databases has one or more additional dimensions. DB2/400 can create a three-dimensional data structure. These structures have three axis’s and look like a three dimensional spreadsheet. <br />The DB2/400 uses business intelligence tools to analyse the data in the data warehouse. These include: Decision support (DSS) tools, executive information systems (EIS), and data mining tools. DSS tools allow the user to create questions, in the form of queries, to get answers to the questions. They enable the user to create ad hoc queries and build reports. EIS’s combine DSS tools with some extended analysis capabilities. Data mining tools allow for the discovery of information with little or no direction from the user. The system searches through the data to determine patterns or associations. </span></div><div dir="ltr" style="text-align: left;" trbidi="on"><span style="font-size: large;"><br /></span><h3><span style="font-size: large;">Objects</span></h3><div class="MsoNormal"><span style="font-size: large;">The AS/400 is sometimes described as an object based system because objects are a fundamental part of the design of the system. Almost everything in the AS/400 is an object. These include data files, user profiles, job queues, message queues, print queues, compiled programs, word processing documents, menus, etc. On the AS/400 objects are categorized by type, which allow the user to specify what type of objects are required for a given task. There are OS/400 objects and MI system objects. Some OS/400 objects map one to one with MI system objects, but other have a one to many mapping. This is because some OS/400 objects need to map to multiple MI system objects. All OS/400 objects map to at least one MI system object. The object is assigned an owner when it is created. The owner is either the user or the group profile that created the object. When the object is created, the owner is given all the object and data authorities to that object. </span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">Libraries</span></h3><div class="MsoNormal"><span style="font-size: large;">A library is an OS/400 object that is used to find other OS/400 objects in the database. <br />The library is organized as a single-level hierarchy, unlike the directory structure found on PCs which have a multilevel hierarchy. To find an OS/400 system object you need the name of the library and the name of the object.  The AS/400 identifies objects by their qualified name, which takes the form of LIBRARY/OBJECT.   For example, to find the object MONEY in the library PAYROLL you would reference this as PAYROLL/MONEY. Two or more objects can have the same name but they must be different types of objects. For example you could have a program named TEST and a data space named TEST, but not two programs named TEST. An object can exist in only one library. A library cannot reference other libraries except for the library called QSYS. This is the only library that can access other libraries. </span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">Physical Files</span></h3><div class="MsoNormal"><span style="font-size: large;">A physical file holds the actual data. The physical file record has a fixed set of fields. Each field can have variable lengths. A physical file has two parts. The first part contains the file attributes and field descriptions. The file attributes include the file’s name, owner, size, number of records in the file, key fields, and other attributes.  The field descriptions hold the attributes for each field in the record. The second part of a physical file contains the data. </span></div><div class="MsoNormal"><span style="font-size: large;"><br /></span></div><h3><span style="font-size: large;">Logical files</span></h3><div class="MsoNormal"><span style="font-size: large;">Logical files allow a user to access data in a format that is different from the way it is stored in one or more physical files. The logical file contains no data records. It contains the corresponding record number of the data record in the physical file. The logical file will contain the index to the physical file. Logical files provide the path to the physical file. There are four types of logical files. The first is the simple logical file. This maps data from a single physical file to another logical record definition. The second is the multiple-format logical file.  This logical file allows access to several physical files. The third type of logical file is the join logical file. The join logical file defines a single record definition that is built from two or more physical files, tables, logical files, or views. The total number of physical files and tables cannot exceed 32. The forth type of logical file is the SQL view. These are similar to join logical files but SQL view logical files locate the access path at run time by use of the Query Definition Template and are not maintained by each join. </span></div><h3><span style="font-size: large;"><br /></span></h3><h3><span style="font-size: large;">Collections</span></h3><div class="MsoNormal"><span style="font-size: large;">A collection is a grouping of related SQL objects. This is the SQL name for a library in the native interface. </span></div><h3><span style="font-size: large;"><br /></span></h3><h3><span style="font-size: large;">DirectConnect Related Issues</span></h3><div class="MsoNormal"><span style="font-size: large;">NULLID Collection – The AS400 Access Service (ACS) requires certain files on the AS/400. It looks for these files in a collection called NULLID. The collection must be created before installing the service. The NULLID collection contains the service package which the system creates when the ACS submits the first request to the AS/400. It also contains a package for each AS/400 stored procedure the user creates. Finally, the NULLID collection contains the SYSPROCS and SYSPROCCOL catalog stored procedures table. </span></div><span style="font-size: large;">The script cspas4.sql creates the tables SYSPROCS and SYSPROCCOL in the NULLID collection. If you are going to use Catalog Stored Procedures against the AS/400 you will need to run this script. <br /> </span><span style="font-family: "Times New Roman","serif"; mso-ansi-language: EN-US; mso-bidi-language: AR-SA; mso-fareast-font-family: "Times New Roman"; mso-fareast-language: EN-US;"><span style="font-size: large;">In your DirectConnect configuration the TPName for the AS400 must be the value \x7F6DB. This is the transaction program name for the DRDA Application Server on the AS/400. <br /></span><!--[if !supportLineBreakNewLine]--><br /><!--[endif]--></span></div>

AS/400-iSeries Concepts and Terminology

AS/400-iSeries Concepts and Terminology  The purpose of this post is to give a high level overview of the AS400-iSeries and some of the components, features, terminology, and definitions.AS/400 Archit…

Read more »