IBM Rational Developer for System z

Host Configuration Quick Start Guide

Version 7.6
GI11-9201-01
Note

Before using this document, read the general information under Documentation notices for IBM Rational Developer for System z.

Second edition (September 2009)

This edition applies to IBM Rational Developer for System z Version 7.6 (program number 5724-T07) and to all subsequent releases and modifications until otherwise indicated in new editions.

Order publications by phone or fax. IBM Software Manufacturing Solutions takes publication orders between 8:30 a.m. and 7:00 p.m. eastern standard time (EST). The phone number is (800) 879-2755. The fax number is (800) 445-9269. Faxes should be sent Attn: Publications, 3rd floor.

You can also order publications through your IBM representative or the IBM branch office serving your locality. Publications are not stocked at the address below.

IBM welcomes your comments. You can send your comments by mail to the following address:

IBM Corporation
Attn: Information Development Department 53NA
Building 501 P.O. Box 12195
Research Triangle Park NC 27709-2195
USA

When you send information to IBM, you grant IBM a nonexclusive right to use or distribute the information in any way it believes appropriate without incurring any obligation to you.

Note to U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Copyright International Business Machines Corporation 2009. All rights reserved. U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Copyright International Business Machines Corporation 2008, 2009.
US Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

Contents

Tables
Figures
About this book
Who should read this book
Planning
Requisites
Requisite products
Required resources
Client user ID
Servers
Deployment and upgrade
Basic customization
Customization setup
PARMLIB changes
Set z/OS UNIX limits in BPXPRMxx
Add started tasks to COMMNDxx
APF authorizations in PROGxx
Requisite LINKLIST and LPA definitions
PROCLIB changes
JES Job Monitor
RSE daemon
Lock daemon
ELAXF* remote build procedures
Security definitions
FEJJCNFG, JES Job Monitor configuration file
rsed.envvars, RSE configuration file
ISPF.conf, ISPF's TSO/ISPF Client Gateway configuration file
Optional customization
(Optional) Common Access Repository Manager (CARMA)
(Optional) Application Deployment Manager
(Optional) SCLM Developer Toolkit
(Optional) DB2 stored procedure
(Optional) CICS bidirectional language support
(Optional) Diagnostic IRZ error messages
(Optional) RSE SSL encryption
(Optional) RSE tracing
(Optional) Host based property groups
(Optional) Host based projects
(Optional) File Manager integration
(Optional) Uneditable characters
(Optional) Using REXEC (or SSH)
(Optional) APPC transaction for the TSO Commands service
(Optional) WORKAREA cleanup
Installation verification
Verify started tasks
JMON, JES, Job Monitor
LOCKD, Lock daemon
RSED, RSE daemon
Verify services
IVP initialization
Port availability
RSE daemon connection
JES Job Monitor connection
Lock daemon connection
ISPF's TSO/ISPF Client Gateway connection
Appendix A. Security considerations
Authentication methods
Connection security
TCP/IP ports
External communication
Using PassTickets
Audit logging
JES security
CICS TS security
SCLM security
Developer for System z configuration files
Security definitions
Define an OMVS segment for Developer for System z users
Define data set profiles
Define the Developer for System z started tasks
Define JES command security
Define RSE as a secure z/OS UNIX server
Define MVS program controlled libraries for RSE
Define application protection for RSE
Define PassTicket support for RSE
Define z/OS UNIX program controlled files for RSE
Verify security settings
Appendix B. Migration considerations
Appendix C. Other information
Operator commands
Troubleshooting configuration problems
Understanding Developer for System z
Tuning considerations
Performance considerations
CICSTS considerations
Customizing the TSO environment
Running multiple instances
Setting up SSL and X.509 authentication
Setting up TCP/IP
Setting up INETD
Setting up APPC
Requisites
Documentation notices for IBM Rational Developer for System z
Copyright license
Trademark acknowledgments
Index

Tables

  1. Required resources
  2. Administrators needed for required tasks
  3. Sample ELAXF* procedures
  4. ELAXF* high-level qualifier checklist
  5. Security setup variables

Figures

  1. JMON - JES JOB MONITOR started task
  2. RSED - RSE daemon started task
  3. LOCKD - Lock daemon started task
  4. FEJJCNFG - JES Job Monitor configuration file
  5. Sample rsed.envars file
  6. Sample rsed.envars file (continued)

About this book

This book discusses the configuration of the IBM Rational Developer for System z functions. It includes brief instructions on how to configure IBM Rational Developer for System z Version 7.6 on your z/OS® host system. For complete details on the configuration of this product, refer to Rational Developer for System z Host Configuration Guide (SC23-7658).

The following names are used in this manual:

For earlier releases, including IBM WebSphere Developer for System z, IBM WebSphere Developer for zSeries, and IBM WebSphere Studio Enterprise Developer, use the configuration information found in the Host Configuration Guide and Program Directories for those releases.

Who should read this book

This document is intended for system programmers installing and configuring IBM Rational Developer for System z Version 7.6, FMID HHOP760, on their z/OS host system.

It lists and briefly documents the different steps needed to do a basic setup of the products. Refer to Rational Developer for System z Host Configuration Guide (SC23-7658) for more details on the listed actions and non-default settings.

To use this book, you need to be familiar with the z/OS UNIX® System Services and MVS™ host systems.

Planning

This section summarizes the host component installation and configuration information in Rational Developer for System z Host Configuration Guide (SC23-7658). Refer to that publication for more details on these subjects:

Requisites

Requisite products

Developer for System z has a list of prerequisite software that must be installed and operational before the product will work. There is also a list of corequisite software to support specific features of Developer for System z. These requisites must be installed and operational at runtime for the corresponding feature to work as designed.

Refer to Rational Developer for System z Host Configuration Guide (SC23-7658) to get a complete list of prerequisites and corequisites for your version of Developer for System z. The key requisites for a basic setup are the following:

Required resources

Basic setup for Developer for System z requires the allocation of the systems resources listed in Table 1.

Table 1. Required resources
Resource Default value
APF authorized data set FEK.SFEKAUTH
started task JMON, RSED, and LOCKD
port for host-confined communication 6715
port for host-confined communication 4036
port for client-host communication 4035
port range for client-host communication any available port is used

Table 2 lists the administrators needed for basic customization tasks.

Table 2. Administrators needed for required tasks
Administrator Task
System Typical system programmer actions are required for all customization tasks
Security
  • Define OMVS segment for Developer for System z users
  • Define data set profiles
  • Define started tasks
  • Define operator command security
  • Define z/OS UNIX server profiles
  • Define application protection for RSE
  • Define PassTicket support
  • Define program controlled data sets
  • Define program controlled z/OS UNIX files
TCP/IP Define new TCP/IP ports
WLM Assign started task goals to the servers and their child processes

Client user ID

The user ID of a Developer for System z user must have the following attributes:

Servers

Developer for System z consists of the following two permanently active servers, which can be started tasks or user jobs. These servers provide the requested services themselves, or start other servers (as z/OS UNIX threads or user jobs) to provide the service:

Refer to Appendix A. Security considerations for more information on TCP/IP port usage and the available mechanisms for secure communication.

Deployment and upgrade

Developer for System z supports installing the products once, followed by copying a minimal set of necessary data sets and directories to other systems for deployment. Running multiple copies (same or different version) of the product(s) on the same system is also supported.

During an upgrade, make backups of all configuration files BEFORE installing the product, as the install might overlay the files.

Basic customization

This chapter summarizes the basic customization information in Rational Developer for System z Host Configuration Guide (SC23-7658). Refer to that publication for more details.

Customization setup

Developer for System z comes with several sample configuration files and sample JCL. To avoid overwriting your customizations when applying maintenance, you should copy all these members and z/OS UNIX files to a different location and to customize the copy.

Some functions of Developer for System z also require the existence of certain directories in z/OS UNIX, which must be created during the customization of the product. To ease the installation effort, a sample job, FEKSETUP, is provided to create the copies and the required directories.

Customize and submit sample member FEKSETUP in data set FEK.SFEKSAMP to create customizable copies of configuration files and configuration JCL, and to create required z/OS UNIX directories. The required customization steps are described within the member.

This job performs the following tasks:

PARMLIB changes

Note that the listed PARMLIB changes are for a basic setup only. More changes are needed if you select to use certain optional functions.

Set z/OS UNIX limits in BPXPRMxx

MAXASSIZE specifies the maximum address space (process) region size. Set MAXASSIZE in SYS1.PARMLIB(BPXPRMxx) to 2G. This is the maximum value allowed.

MAXTHREADS specifies the maximum number of active threads for a single process. Set MAXTHREADS in SYS1.PARMLIB(BPXPRMxx) to 1500 or higher.

MAXTHREADTASKS specifies the maximum number of active MVS tasks for a single process. Set MAXTHREADTASKS in SYS1.PARMLIB(BPXPRMxx) to 1500 or higher.

MAXPROCUSER specifies the maximum number of processes that a single z/OS UNIX user ID can have concurrently active. Set MAXPROCUSER in SYS1.PARMLIB(BPXPRMxx) to 50 or higher.

These values can be checked and set dynamically (until the next IPL) with the following console commands:

Add started tasks to COMMNDxx

Add start commands for the Developer for System z RSE and JMON servers to SYS1.PARMLIB(COMMANDxx) to start them automatically at next system IPL.

Once the servers are defined and configured, they can be started dynamically with the following console commands:

APF authorizations in PROGxx

In order for JES Job Monitor to access JES spool files, module FEJJMON in the FEK.SFEKAUTH load library and the Language Environment® (LE) runtime libraries (CEE.SCEERUN*) must be APF authorized.

In order for ISPF to create the TSO/ISPF Client Gateway, module ISPZTSO in SYS1.LINKLIB must be APF authorized.

APF authorizations are defined in SYS1.PARMLIB(PROGxx), if your site followed IBM® recommendations.

APF authorizations can be set dynamically (until the next IPL) with the following console commands, where volser is the volume on which the data set resides if it is not SMS managed:

Requisite LINKLIST and LPA definitions

The RSE server is a z/OS UNIX process that requires access to MVS load libraries. The following (prerequisite) libraries must be made available, either through STEPLIB or LINKLIST/LPALIB:

LINKLIST data sets are defined in SYS1.PARMLIB(PROGxx), if your site followed IBM recommendations. LPA data sets are defined in SYS1.PARMLIB(LPALSTxx).

If you opt to use STEPLIB, you must define the libraries not available through LINKLIST/LPALIB in the STEPLIB directive of rsed.envvars, the RSE configuration file. Be aware, however, that:

PROCLIB changes

The started task and remote build procedures listed below must reside in a system procedure library defined to your JES subsystem. In the instructions below, the IBM default procedure library, SYS1.PROCLIB, is used.

JES Job Monitor

Customize the sample started task member FEK.#CUST.PROCLIB(JMON), as described within the member, and copy it to SYS1.PROCLIB. As shown in the code sample below, you have to provide the following:

Figure 1. JMON - JES JOB MONITOR started task
//*
//* JES JOB MONITOR
//*
//JMON     PROC PRM=,             * PRM='-TV' TO START TRACING
//            LEPRM='RPTOPTS(ON)', 
//            HLQ=FEK,
//            CFG=FEK.#CUST.PARMLIB(FEJJCNFG)
//*
//JMON     EXEC PGM=FEJJMON,REGION=0M,TIME=NOLIMIT,
//            PARM=('&LEPRM,ENVAR("_CEE_ENVFILE=DD:ENVIRON")/&PRM') 
//STEPLIB  DD DISP=SHR,DSN=&HLQ..SFEKAUTH
//ENVIRON  DD DISP=SHR,DSN=&CFG//SYSPRINT DD SYSOUT=* 
//SYSOUT   DD SYSOUT=* 
//         PEND 
//*

RSE daemon

Customize the sample started task member FEK.#CUST.PROCLIB(JMON), as described within the member, and copy it to SYS1.PROCLIB. As shown in the code sample below, you have to provide the following:

Figure 2. RSED - RSE daemon started task
//*
//* RSE DAEMON
//*
//RSED     PROC IVP='',            * 'IVP' to do an IVP test
//            PORT=4035,
//            HOME='/usr/lpp/rdz',
//            CNFG='/etc/rdz'
//*
//RSE      EXEC PGM=BPXBATSL,REGION=0M,TIME=NOLIMIT,
//            PARM='PGM  &HOME/bin/rsed.sh &IVP &PORT &CNFG'
//STDOUT   DD SYSOUT=*
//STDERR   DD SYSOUT=*
//         PEND
//*

Lock daemon

Customize the sample started task member FEK.#CUST.PROCLIB(LOCKD), as described within the member, and copy it to SYS1.PROCLIB. As shown in the code sample below, you have to provide the following:

Figure 3. LOCKD - Lock daemon started task
//*
//* RSE LOCK DAEMON
//*
//LOCKD    PROC HOME='/usr/lpp/rdz',
//            CNFG='etc/rdz',
//            LOG=1
//*
//LOCKD    EXEC PGM=BPXBATSL,REGION=0M,TIME=NOLIMIT,
              PARM=PGM &HOME./bin/lockd.sh &CNFG &LOG' 
//STDOUT   DD SYSOUT=* 
//STDERR   DD SYSOUT=* 
//         PEND 
//*

ELAXF* remote build procedures

Developer for System z provides sample JCL procedures that can be used for the JCL generation, remote project builds and remote syntax check features of CICS® BMS maps, IMS™ MFS screens and COBOL, PL/I, Assembler and C/C++ programs. These procedures allow installations to apply their own standards, and ensure that developers use the same procedures with the same compiler options and compiler levels.

The sample procedures and their function are listed in Table 3.

Table 3. Sample ELAXF* procedures
Member Purpose
ELAXFADT Sample procedure for assembling and debugging High Level assembler programs.
ELAXFASM Sample procedure for assembling High Level assembler programs.
ELAXFBMS Sample procedure for creating CICS BMS object and corresponding copy, dsect, or include member.
ELAXFCOC Sample procedure for doing COBOL Compiles, Integrated CICS translate and integrated DB2® translate.
ELAXFCOP Sample procedure for doing DB2 preprocess of EXEC SQL statements embedded in COBOL programs.
ELAXFCOT Sample procedure for doing CICS translation for EXEC CICS statements embedded in COBOL programs.
ELAXFCPC Sample procedure for doing C compiles.
ELAXFCPP Sample procedure for doing C++ compiles.
ELAXFCP1 Sample procedure for COBOL compiles with SCM preprocessor statements (-INC and ++INCLUDE).
ELAXFGO Sample procedure for the GO step.
ELAXFLNK Sample procedure for linking C/C++, COBOL. PLI and High Level Assembler programs.
ELAXFMFS Sample procedure for creating IMS MFS screens.
ELAXFPLP Sample procedure for doing DB2 preprocess of EXEC SQL statements embedded in PLI programs.
ELAXFPLT Sample procedure for doing CICS translation of EXEC CICS statements embedded in PLI programs.
ELAXFPL1 Sample procedure for doing PL/I compiles, integrated CICS translate and integrated DB2 translate.
ELAXFPP1 Sample procedure for PL/I compiles with SCM preprocessor statements (-INC and ++INCLUDE).
ELAXFTSO Sample procedure for running/debugging generated DB2 code in TSO mode.
ELAXFUOP Sample procedure for generating the UOPT step when building programs that run in CICS or IMS subsystems.

Customize the sample build procedure members, FEK.#CUST.PROCLIB(ELAXF*), as described within the members, and copy them to SYS1.PROCLIB. You have to provide the correct high-level qualifiers for different product libraries, as described in Table 4.

Table 4. ELAXF* high-level qualifier checklist
Product Default HLQ Value
RD/z FEK
CICS CICSTS32.CICS
DB2 DSN910
IMS IMS
COBOL IGY.V4R1M0
PL/I IBMZ.V3R8M0
C/C++ CBC
LE CEE
system LINKLIB SYS1
system MACLIB SYS1

If the ELAXF* procedures cannot be copied into a system procedure library, ask the Developer for System z users to add a JCLLIB card (right after the JOB card) to the job properties on the client.

//MYJOB    JOB <job parameters>
//PROCS    JCLLIB ORDER=(FEK.#CUST.PROCLIB)

Security definitions

Customize and submit sample member FEKRACF in data set FEK.#CUST.JCL to create the security definitions for Developer for System z. The user submitting this job must have security administrator privileges, such as being RACF SPECIAL. Refer to Appendix A. Security considerations for more details.

Notes:
  1. For those sites that use CA ACF2 TM for z/OS or CA Top Secret® for z/OS, please refer to your product page on the CA support site (https://support.ca.com) and check for the related Developer for System z Knowledge Document. This Knowledge Document has details on the security commands necessary to properly configure Developer for System z.
  2. The sample FEKRACF job holds more than just RACF® commands. The last step of the security definitions consists of making a z/OS UNIX file program controlled. Depending on the policies at your site, this might be a task for the system programmer and not the security administrator.

FEJJCNFG, JES Job Monitor configuration file

JES Job Monitor (JMON) provides all JES-related services. The behavior of JES Job Monitor can be controlled with the definitions in FEJJCNFG.

FEJJCNFG is located in FEK.#CUST.PARMLIB, unless you specified a different location when you customized and submitted job FEK.SFEKSAMP(FEKSETUP). See Customization setup for more details.

Customize the sample JES Job Monitor configuration member FEJJCNFG, as shown in the following code sample:

Figure 4. FEJJCNFG - JES Job Monitor configuration file
HOST_CODEPAGE=IBM-1047
SERV_PORT=6715
TZ=EST5EDT
#_BPXK_SETIBMOPT_TRANSPORT=TCPIP
#APPLID=FEKAPPL
#AUTHMETHOD=SAF
#CODEPAGE=UTF-8
#CONCHAR=$
#CONSOLE_NAME=JMON
#GEN_CONSOLE_NAME=OFF
#LIMIT_COMMANDS=NOLIMIT
#LIMIT_VIEW=USERID
#LISTEN_QUEUE_LENGTH=5
#MAX_DATASETS=32
#MAX_THREADS=200
#TIMEOUT=3600
#TIMEOUT_INTERVAL=1200
#SUBMITMETHOD=TSO
#TSO_TEMPLATE=FEK.#CUST.CNTL(FEJTSO)
HOST_CODEPAGE
The host code page. The default is IBM-1047. Change to match your host code page.
SERV_PORT
The port number for JES Job Monitor host server. The default port is 6715. Change as desired, however BOTH the server and the Developer for System z clients must be configured with the same port number. If you change the server port number, all clients must also change the JES Job Monitor port for this system in the Remote Systems View.
TZ
Time zone selector. The default is EST5EDT. The default time zone is UTC +5 hours (Eastern Standard Time (EST) Eastern Daylight Savings Time (EDT)). Change this to represent your time zone.
_BPXK_SETIBMOPT_TRANSPORT
Specifies the name of the TCP/IP stack to be used. The default is TCPIP. Uncomment and change to the requested TCP/IP stack name, as defined in the TCPIPJOBNAME statement in the related TCPIP.DATA.
Note:
Coding a SYSTCPD DD statement in the JCL does not set the requested stack affinity.

rsed.envvars, RSE configuration file

The RSE lock daemon and the RSE server processes (RSE daemon, RSE thread pool, and RSE server) use the definitions in rsed.envvars. Optional Developer for System z and third-party services can use this configuration file also to define environment variables for their use.

rsed.envvars is located in /etc/rdz/, unless you specified a different location when you customized and submitted job FEK.SFEKSAMP(FEKSETUP). See Customization setup for more details. You can edit the file with the TSO OEDIT command.

See the following sample rsed.envvars file, which must be customized to match your system environment.

Figure 5. Sample rsed.envars file
#=============================================================
# (1) required definitions
JAVA_HOME=/usr/lpp/java/J5.0
RSE_HOME=/usr/lpp/rdz
_RSE_LOCKD_PORT=4036
_RSE_HOST_CODEPAGE=IBM-1047
TZ=EST5EDT
LANG=C
PATH=/bin:/usr/sbin
_CEE_DMPTARG=/tmp
STEPLIB=NONE
#STEPLIB=$STEPLIB:CEE.SCEERUN:CEE.SCEERUN2:CBC.SCLBDLL
_RSE_SAF_CLASS=/usr/include/java_classes/IRRRacf.jar
_RSE_JAVAOPTS=""
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Xms1m -Xmx256m"
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Ddaemon.log=/var/rdz/logs"
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Duser.log=/var/rdz/logs"
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_LOG_DIRECTORY="
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dmaximum.clients=60"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dmaximum.threads=1000"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dminimum.threadpool.process=10"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dmaximum.threadpool.process=100"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dipv6=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dkeep.last.log=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Denable.standard.log=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Denable.port.of.entry=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Denable.certificate.mapping=false"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Denable.audit.log=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Daudit.cycle=30"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Daudit.retention.period=0"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DAPPLID=OMVSAPPL"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDENY_PASSWORD_SAVE=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DHIDE_ZOS_UNIX=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_IDLE_SHUTDOWN_TIMEOUT=3600000"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_TRACING_ON=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_MEMLOGGING_ON=true"
#_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DTSO_SERVER=APPC"
#=============================================================
# (2) required definitions for TSO/ISPF Client Gateway
_CMDSERV_BASE_HOME=/usr/lpp/ispf
_CMDSERV_CONF_HOME=/etc/rdz
_CMDSERV_WORK_HOME=/var/rdz
#STEPLIB=$STEPLIB:ISP.SISPLOAD:ISP.SISPLPA:SYS1.LINKLIB
_RSE_CMDSERV_OPTS=""
#_RSE_CMDSERV_OPTS="$_RSE_CMDSERV_OPTS&ISPPROF=&SYSUID..ISPPROF" 
#============================================================= 
# (3) required definitions for SCLM Developer Toolkit 
_SCLMDT_CONF_HOME=/var/rdz/sclmdt  
#STEPLIB=$STEPLIB:FEK.SFEKAUTH:FEK.SFEKLOAD  
#_SCLMDT_TRANTABLE=FEK.#CUST.LSTRANS.FILE  
#ANT_HOME=/usr/lpp/Apache/Ant/apache-ant-1.7.1  
#=============================================================  
# (4) optional definitions  
#_RSE_PORTRANGE=8108-8118  
#_BPXK_SETIBMOPT_TRANSPORT=TCPIP  
#_FEKFSCMD_TP_NAME_=FEKFRSRV 
#_FEKFSCMD_PARTNER_LU_=lu_name 
#GSK_CRL_SECURITY_LEVEL=HIGH 
#GSK_LDAP_SERVER=ldap_server_url 
#GSK_LDAP_PORT=ldap_server_port 
#GSK_LDAP_USER=ldap_userid 
#GSK_LDAP_PASSWORD=ldap_server_password 
#============================================================= 
Figure 6. Sample rsed.envars file (continued)
# (5) do not change unless directed by IBM support center 
_CEE_RUNOPTS="ALL31(ON) HEAP(32M,32K,ANYWHERE,KEEP,,) TRAP(ON)" 
_BPX_SHAREAS=YES 
_BPX_SPAWN_SCRIPT=YES 
JAVA_PROPAGATE=NO 
RSE_LIB=$RSE_HOME/lib 
PATH=.:$JAVA_HOME/bin:$RSE_HOME/bin:$_CMDSERV_BASE_HOME/bin:$PATH 
LIBPATH=$JAVA_HOME/bin:$JAVA_HOME/bin/classic:$RSE_LIB:$RSE_LIB/icuc 
LIBPATH=.:/usr/lib:$LIBPATH 
CLASSPATH=$RSE_LIB:$RSE_LIB/dstore_core.jar:$RSE_LIB/clientserver.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/dstore_extra_server.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/zosserver.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/dstore_miners.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/universalminers.jar:$RSE_LIB/mvsminers.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/carma.jar:$RSE_LIB/luceneminer.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/mvsluceneminer.jar:$RSE_LIB/cdzminer.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/mvscdzminer.jar:$RSE_LIB/jesminers.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/FAMiner.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/mvsutil.jar:$RSE_LIB/jesutils.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/lucene-core-2.3.2.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/cdtparser.jar 
CLASSPATH=$CLASSPATH:$RSE_LIB/wdzBidi.jar:$RSE_LIB/fmiExtensions.jar 
CLASSPATH=$CLASSPATH:$_RSE_SAF_CLASS 
CLASSPATH=.:$CLASSPATH 
_RSE_CMDSERV_OPTS="&SESSION=SPAWN$_RSE_CMDSERV_OPTS"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DISPF_OPTS='$_RSE_CMDSERV_OPTS'" 
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DA_PLUGIN_PATH=$RSE_LIB"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Xbootclasspath/p:$RSE_LIB/bidiTools.jar"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dfile.encoding=$_RSE_HOST_CODEPAGE" 
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dconsole.encoding=$_RSE_HOST_CODEPAGE"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_SPIRIT_ON=true"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DSPIRIT_EXPIRY_TIME=6" 
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DSPIRIT_INTERVAL_TIME=6"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dcom.ibm.cacheLocalHost=true"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Duser.home=$HOME"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dclient.username=$RSE_USER_ID" 
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dlow.heap.usage.ratio=15"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dmaximum.heap.usage.ratio=40"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_KEEPALIVE_ENABLED=true"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_KEEPALIVE_RESPONSE_TIMEOUT=60000"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -DDSTORE_IO_SOCKET_READ_TIMEOUT=180000"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dlock.daemon.port=$_RSE_LOCKD_PORT"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Dlock.daemon.cleanup.interval=1440"  
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -showversion"  
_RSE_SERVER_CLASS=org.eclipse.dstore.core.server.Server  
_RSE_DAEMON_CLASS=com.ibm.etools.zos.server.RseDaemon  
_RSE_POOL_SERVER_CLASS=com.ibm.etools.zos.server.ThreadPoolProcess  
_RSE_LOCKD_CLASS=com.ibm.ftt.rse.mvs.server.miners.MVSLockDaemon 
_RSE_SERVER_TIMEOUT=120000 
_SCLMDT_BASE_HOME=$RSE_HOME 
_SCLMDT_WORK_HOME=$_CMDSERV_WORK_HOME 
CGI_DTWORK=$_SCLMDT_WORK_HOME 
#============================================================= 
# (6) additional environment variables
JAVA_HOME
Java home directory. The default is /usr/lpp/java/J5.0. Change to match your Java installation.
RSE_HOME
RSE home directory. The default is /usr/lpp/rdz. Change to match your Developer for System z installation.
_RSE_LOCKD_PORT
RSE lock daemon port number. The default is 4036. Can be changed if desired.
_RSE_HOST_CODEPAGE
The host codepage. The default is IBM-1047. Change to match your host codepage.
TZ
Time zone selector. The default is EST5EDT. The default time zone is UTC +5 hours (Eastern Standard Time (EST) Eastern Daylight Savings Time (EDT)). Change to match your time zone.
LANG
Specifies the name of the default locale. The default is C. C specifies the POSIX locale and (for example) Ja_JP specifies the Japanese locale. Change to match your locale.
STEPLIB
Access MVS data sets not in LINKLIST/LPALIB. The default is NONE.

You can bypass the need of having (prerequisite) libraries in LINKLIST/LPALIB by uncommenting and customizing one or more of the following STEPLIB directives:

STEPLIB=$STEPLIB:CEE.SCEERUN:CEE.SCEERUN2:CBC.SCLBDLL
STEPLIB=$STEPLIB:ISP.SISPLOAD:ISP.SISPLPA:SYS1.LINKLIB
STEPLIB=$STEPLIB:FEK.SFEKAUTH:FEK.SFEKLOAD
Note:
  • Using STEPLIB in z/OS UNIX has a negative performance impact.
  • If one STEPLIB library is APF authorized, then all must be authorized. Libraries lose their APF authorization when they are mixed with non-authorized libraries in STEPLIB.
  • Libraries that are designed for LPA placement might require additional program control or APF authorizations if they are accessed through LINKLIST or STEPLIB.
RSE_SAF_CLASS
Specifies the Java interface to your security product. The default is /usr/include/java_classes/IRRRacf.jar. Change to match your security software setup.
Note:
Since z/OS 1.10, /usr/include/java_classes/IRRRacf.jar is part of SAF, which ships with base z/OS, so it is available also to non-RACF customers.
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Ddaemon.log=/var/rdz/logs"
Directory holding the RSE daemon and server logging and RSE audit data. The default is /var/rdz/logs. Change to enforce the desired location. If this directive is commented out, the home direcotry of the user ID assigned to RSE daemon will be used. The home directory is defined in the OMVS security segment of the user ID.
_RSE_JAVAOPTS="$_RSE_JAVAOPTS -Duser.log=/var/rdz/logs"
Directory leading to the user-specific logs. The default is /var/rdz/logs. Change to enforce the desired location. If this directive is commented out, the home directory of the client user ID will be used. The directory path is defined in the OMVS security segment of the user ID.
Note:
The complete path to the user logs is userlog/dstorelog/$LOGNAME/, where userlog is the value of the user.log directive, dstorelog is the value of the DSTORE_LOG_DIRECTORY directive and $LOGNAME is the client's user ID in uppercase.
_CMDSERV_BASE_HOME
Home directory for the ISPF code that provides the TSO/ISPF Client Gateway service. The default is /usr/lpp/ispf. Change to match your ISPF installation.
_CMDSERV_CONF_HOME
ISPF base configuration directory. The default is /etc/rdz. Change to match the location of ISPF.conf, the TSO/ISPF Client Gateway customization file.
_CMDSERV_WORK_HOME
ISPF base work directory. The default is /var/rdz. Change to match the location of the WORKAREA directory used by the TSO/ISPF Client Gateway.
_RSE_PORTRANGE
Specifies the port range that the RSE server can open for communication with a client. Any port can be used by default. This is an optional directive.
_BPXK_SETIBMOPT_TRANSPORT
Specifies the name of the TCP/IP stack to be used. The default is TCPIP. Uncomment and change to the requested TCP/IP stack name, as defined in the TCPIPJOBNAME statement in the related TCPIP.DATA. This is an optional directive.
Note:
Coding a SYSTCPD DD statement in the server JCL does not set the requested stack affinity.

ISPF.conf, ISPF's TSO/ISPF Client Gateway configuration file

ISPF's TSO/ISPF Client Gateway uses the definitions in ISPF.conf to create a valid environment to execute batch TSO and ISPF commands. Developer for System z uses this environment to run some MVS based services.

ISPF.conf is located in /etc/rdz/, unless you specified a different location when you customized and submitted job FEK.SFEKSAMP(FEKSETUP). See Customization setup for more details. You can edit the file with the TSO OEDIT command.

Comment lines start with an asterisk (*). When concatenating data set names, add them on the same line and separate the names with a comma (,).

Besides providing the correct names for the ISPF data sets, you must also add the TSO Commands service data set name, FEK.SFEKPROC, to the SYSPROC or SYSEXEC statement, as shown in the following code sample.

Note:
You can add your own DD-like statements and data set concatenations to customize the TSO environment, thus mimicking a TSO logon procedure.

Optional customization

This section summarizes the CARMA, Application Deployment Manager, SCLM Developer Toolkit, and other customization task information in Rational Developer for System z Host Configuration Guide (SC23-7658). Refer to that publication for more details.

(Optional) Common Access Repository Manager (CARMA)

You will need the assistance of a security administrator and a TCP/IP administrator to complete this customization task, which requires the following resources or special customization tasks:

Common Access Repository Manager (CARMA) is a productivity aid for developers who are creating Repository Access Managers (RAMs). A RAM is an Application Programming Interface (API) for z/OS based Software Configuration Managers (SCMs).

In turn, user-written applications can start a CARMA server which loads the RAMS(s) and provides a standard interface to access the SCM.

(Optional) Application Deployment Manager

You will need assistance of a CICS administrator, a TCP/IP administrator and a security administrator to complete this customization task, which requires the following resources or special customization tasks:

Developer for System z uses certain functions of Application Deployment Manager as a common deployment approach for various components. Optional customization enables more features of Application Deployment Manager and can add the following services to Developer for System z:

(Optional) SCLM Developer Toolkit

You will need assistance of an SCLM administrator and optionally a security administrator to complete this customization task, which requires the following resources and/or special customization tasks:

SCLM Developer Toolkit provides the tools needed to extend the capabilities of SCLM to the client. SCLM (Software Configuration and Library Manager) itself is a host-based source code manager that is shipped as part of ISPF.

The SCLM Developer Toolkit has an Eclipse-based plug-in that interfaces to SCLM and provides for access to all SCLM processes for legacy code development as well as support for full Java and J2EE development on the workstation with synchronization to SCLM on the mainframe including building, assembling, and deployment of the J2EE code from the mainframe.

(Optional) DB2 stored procedure

You will need the assistance of a WLM administrator and a DB2 administrator to complete this customization task , which requires the following resources or special customization tasks:

Developer for System z provides a sample DB2 stored procedure (PL/I and COBOL Stored Procedure Builder) for building COBOL and PL/I Stored Procedures from within the Developer for System z client.

(Optional) CICS bidirectional language support

You will need the assistance of a CICS administrator to complete this customization task, which requires the following resources or special customization tasks:

The Developer for System z Enterprise Service Tools (EST) component supports different formats of Arabic and Hebrew interface messages, as well as bidirectional data presentation and editing in all editors and views. In terminal applications, both left-to-right and right-to-left screens are supported, as well as numeric fields and fields with opposite-to-screen orientation.

Additional bidirectional features and functionality include the following:

Additionally, EST-generated code can support bidi transformation in environments other than CICS SFR (for example, batch applications). You can make the EST generators to include calls to the bidirectional conversion routines by specifying the appropriate bidi transformation options in the EST generation wizards and linking the generated programs with the appropriate bidirectional conversion library, FEK.SFEKLOAD.

(Optional) Diagnostic IRZ error messages

This customization task does not require assistance, but does require the following resources or special customization tasks:

The Developer for System z client has a code generation component called Enterprise Service Tools (EST). In order for code generated by EST to issue diagnostic error messages, all IRZ* and IIRZ* modules in the FEK.SFEKLOAD load library must be made available to the generated code.

(Optional) RSE SSL encryption

You will need assistance of a security administrator to complete this customization task, which requires the following resources or special customization tasks:

External (client-host) communication can be encrypted using SSL. This feature is disabled by default and is controlled by the settings in ssl.properties.

(Optional) RSE tracing

This customization task does not require assistance, special resources, or special customization tasks.

Developer for System z supports different levels of tracing the internal program flow for problem solving purposes. RSE, and some of the services called by RSE, use the settings in rsecomm.properties to know the desired detail level in the output logs.

(Optional) Host based property groups

This customization task does not require assistance, special resources, or special customization tasks.

Developer for System z clients can define property groups which hold default values for various properties (for example, the COBOL compiler options to use when compiling COBOL source code). Developer for System z has some default values built in, but also allows defining custom, system-specific defaults.

(Optional) Host based projects

This customization task does not require assistance, special resources, or special customization tasks.

z/OS Projects can be defined individually through the z/OS Projects perspective on the client or can be defined centrally on the host and propagated to the client on a per user basis. These "host-based projects" look and function exactly like projects defined on the client except that their structure, members, and properties cannot be modified by the client and they are only accessible when connected to the host.

(Optional) File Manager integration

You will need the assistance of a security administrator to complete this customization task, which requires the following resources or special customization tasks:

Developer for System z supports direct access from the client to a limited set of IBM File Manager for z/OS functions. IBM File Manager for z/OS provides comprehensive tools for working with MVS data sets, z/OS UNIX files, DB2, IMS and CICS data. These tools include the familiar browse, edit, copy and print utilities found in ISPF, enhanced to meet the needs of application developers. In the current version of Developer for System z, only browse/edit of MVS data sets (including VSAM KSDS and ESDS) and editing basic MVS data set templates is supported.

Note that the IBM File Manager for z/OS product must be ordered, installed and configured separately. Refer to Rational Developer for System z Host Planning Guide (GI11-8296-00) to know which level of File Manger is required for your version of Developer for System z. The installation and customization of this product is not described in this manual.

(Optional) Uneditable characters

This customization task does not require assistance, special resources, or special customization tasks.

Some characters do not translate well between host code pages (EBCDIC based) and client code pages (ASCII based). The Developer for System z client editor uses the definitions in uchars.settings file to identify these uneditable characters.

(Optional) Using REXEC (or SSH)

This customization task does not require assistance, special resources, or special customization tasks.

REXEC (Remote Execution) is a TCP/IP service to let clients execute a command on the host. SSH (Secure Shell) is a similar service, but here all communication is encrypted using SSL (Secure Socket Layer). Developer for System z uses either service for doing remote (host-based) actions in z/OS UNIX subprojects.

Developer for System z can also be configured to use REXEC (or SSH) to start a RSE server on the host. Note, however, that each connection started this way will result in a separate RSE server, each using a fair amount of system resources. Therefore, this alternate connection method is only viable for a small number of connections.

Also, since the REXEC (or SSH) alternative connection method bypasses the RSE daemon, it does not have access to all host services described in this publication, such as single server processing and audit. Contact IBM support to learn if a specific host service is supported by the REXEC alternate connection method.

(Optional) APPC transaction for the TSO Commands service

You will need assistance of an APPC administrator and a WLM administrator to complete this customization task, which requires the following resources or special customization tasks:

The TSO Commands service can be implemented as an APPC transaction program, FEKFRSRV. This transaction acts as a host server to execute TSO and ISPF commands that are issued from the workstation. APPC is not required on the workstation because the workstation communicates with FEKFRSRV through TCP/IP. Each workstation can have an active connection to multiple hosts at the same time.

(Optional) WORKAREA cleanup

This customization task does not require assistance, special resources, or special customization tasks.

ISPF's TSO/ISPF Client Gateway and the SCLM Developer Toolkit function use the WORKAREA directory to store temporary work files, which are removed before the session is closed. However, temporary output is sometimes left behind, for example, if there is a communication error while processing. For this reason, it is recommended that you clear out the WORKAREA directory from time to time.

Installation verification

Verify started tasks

This chapter summarizes the installation verification information in Rational Developer for System z Host Configuration Guide (SC23-7658). Refer to that publication for more details.

JMON, JES, Job Monitor

Start the JMON started task (or user job). The startup information in DD STDOUT should end with the following message:

JM200I Server initialization complete.

If the job ends with return code 66, then FEK.SFEKAUTH is not APF authorized.

LOCKD, Lock daemon

Start the LOCKD started task (or user job). The lock daemon issues the following console message upon successful startup:

FEK501I Lock daemon started, port=4036, cleanup interval=1440, log level=1

RSED, RSE daemon

Start the RSED started task (or user job) with the IVP=IVP parameter. With this parameter, the server will end after doing some installation verification tests. The output of these tests is available in DD STDOUT. In case of certain errors, data will also be available in DD STDERR.

Verify services

The Developer for System z installation provides several Installation Verification Programs (IVP) for the basic and optional services. The IVP scripts are located in the installation directory, default /usr/lpp/rdz/bin/.

fekfivpa (Optional) TSO Commands service connection using APPC
fekfivpd RSE daemon connection
fekfivpi ISPF's TSO/ISPF Client Gateway connection
fekfivpj JES Job Monitor connection
fekfivpl Lock daemon connection
fekfivpr (Optional) REXEC connection
fekfivps (Optional) SCLMDT connection
fekfivpt TCP/IP address & resolver configuration
fekfivpz (Optional) REXEC/SSH shell script
Note:
The optional IVPs are not described in this publication. Refer to Rational Developer for System z Host Configuration Guide (SC23-7658) for more details.

The tasks described below expect you to be active in z/OS UNIX. This can be done by issuing the TSO command OMVS. Use the exit command to return to TSO.

IVP initialization

All sample commands in this section expect that certain environment variables are set. This way, the IVP scripts are available through the PATH statement and the location of the customized configuration files is known. Use the pwd and cd commands to verify and change your current directory to the directory with the customized configuration files. The ivpinit shell script can then be used to set the RSE environment variables, like in the following sample ($ is the z/OS UNIX prompt):

$ pwd
/u/userid
$ cd /etc/rdz
$ . ./ivpinit
RSE configuration files located in /etc/rdz --default
added /usr/lpp/rdz/bin to PATH

The first "." (dot) in . ./ivpinit is a z/OS UNIX command to run the shell in the current environment, so that the environment variables set in the shell are effective even after exiting the shell. The second one is referring to the current directory.

Note:
If . ./ivpinit is NOT executed before the fekfivp* scripts, the path to these scripts must be specified when calling them, like that in the following sample:
/usr/lpp/rdz/bin/fekfivpr 512 USERID
Also, most fekfivp* scripts will ask for the location of the customized rsed.envvars if . ./ivpinit is not executed first.

Note:
Some IVP tests use the TCP/IP REXX™ socket API, which requires that the TCP/IP load library, default TCPIP.SEZALOAD, is in LINKLIST or STEPLIB. The following commands might be necessary to be able to execute these IVP tests ($ is the z/OS UNIX prompt):

$ EXPORT STEPLIB=$STEPLIB:TCPIP.SEZALOAD

For information on diagnosing RSE connection problems, see "Appendix C, Troubleshooting configuration problems" in Rational Developer for System z Host Configuration Guide (SC23-7658) or the Technotes on the Developer for System z Support Page http://www-306.ibm.com/software/awdtools/rdz/support/.

Port availability

The JES Job Monitor, RSE daemon port, and optionally REXEC or SSH availability can be verified by issuing the netstat command. The result should show the ports used by these services.

RSE daemon connection

Verify the RSE daemon connection by executing the following command. Replace 4035 with the port used by the RSE daemon and USERID by a valid user ID.

fekfivpd 4035 USERID

JES Job Monitor connection

Verify the JES Job Monitor connection by executing the following command. Replace 6715 with the JES Job Monitor port number.

fekfivpj 6715

Lock daemon connection

Verify the lock daemon connection by executing the following command:

fekfivpl

ISPF's TSO/ISPF Client Gateway connection

Verify the connection to ISPF's TSO/ISPF client Gateway by executing the following command:

fekfivpi

Appendix A. Security considerations

This chapter summarizes the security considerations information in Rational Developer for System z Host Configuration Guide (SC23-7658). Refer to that publication for more details.

The security mechanisms used by Developer for System z servers and services rely on the file system it resides in being secure. This implies that only trusted system administrators should be able to update the program libraries and configuration files.

Authentication methods

Developer for System z supports multiple ways to authenticate a user ID provided by a client upon connection.

Connection security

Different levels of communication security are supported by RSE, which controls all communication between the client and Developer for System z services:

TCP/IP ports

External communication

Define the following ports to your firewall protecting the z/OS host, as they are used for client-host communication:

Notes:
  1. Previous clients (version 7.0 and older) communicate directly with the JES Job Monitor server, default port 6715.
  2. During a remote debug session for Cobol, PL/I or Assembler, IBM Debug Tool for z/OS is invoked. This product communicates directly with the client. This communication is initiated on the host, and connects to port 8001 on the client.

Using PassTickets

After logon, PassTickets are used to establish thread security within the server. This feature cannot be disabled. PassTickets are system generated passwords with a lifespan of about 10 minutes. The generated PassTickets are based upon the DES encryption algorithm, the user ID, the application ID, a time and date stamp, and a secret key. This secret key is a 64 bit number (16 hex characters) that must be defined to your security software.

Attention: The client connection request will fail if PassTickets are not set up correctly.

Audit logging

Developer for System z supports audit logging of actions that are managed by the RSE daemon. The audit logs are stored as text files in the daemon log directory, using the CSV (Comma Separated Value) format.

JES security

Developer for System z allows clients access to the JES spool through the JES Job Monitor server. The server provides basic access limitations, which can be extended with the standard spool file protection features of your security product. Actions (Hold, Release, Cancel, and Purge) against spool files are done through the JMON EMCS console, for which conditional permits must be set up.

CICS TS security

Developer for System z allows, through Application Deployment Manager, CICS administrators to control which CICS resource definitions are editable by the developer, their default values, and the display of a CICS resource definition by means of the CICS Resource Definition (CRD) server.

SCLM security

The SCLM Developer Toolkit service offers optional security functionality for the Build, Promote, and Deploy functions.

Developer for System z configuration files

There are several Developer for System z configuration files whose directives impact the security setup.

Security definitions

Customize and submit sample member FEKRACF in data set FEK.#CUST.JCL, which has sample RACF and z/OS UNIX commands to create the basic security definitions for Developer for System z.

Note:
For those sites that use CA ACF2 TM for z/OS or CA Top Secret® for z/OS, please refer to your product page on the CA support site (https://support.ca.com) and check for the related Developer for System z Knowledge Document. This Knowledge Document has details on the security commands necessary to properly configure Developer for System z.

To complete the security setup, the security administrator needs to know the values listed in Table 5. These values were defined during previous steps of the installation and customization of Developer for System z.

Table 5. Security setup variables
Description
  • Default value
  • Where to find the answer
Value
Developer for System z product high level qualifier
  • FEK
  • SMP/E installation
Developer for System z customization high level qualifier
JES Job Monitor started task name
RSE daemon started task name
Lock daemon started task name

Define an OMVS segment for Developer for System z users

A RACF OMVS segment (or equivalent) that specifies a valid non-zero uid, home directory, and shell command must be defined for each user of Developer for System z. Their default group also requires an OMVS segment with a group id.

Define data set profiles

READ access for users and ALTER for system programmers suffices for most Developer for System z data sets.

You should protect FEK.SFEKAUTH against updates since this data set is APF authorized. The same is true for FEK.SFEKLOAD and FEK.SFEKLPA, but here because these data sets are program controlled.

Define the Developer for System z started tasks

The following sample RACF commands create the JMON, RSED, and LOCKD started tasks, with protected user IDs (STCJMON, STCRSE, and STCLOCK,respectively) and group STCGROUP assigned to them. Replace the #group-id and #user-id-* placeholders with valid OMVS IDs.

Notes:
  1. Ensure that the started tasks user IDs are protected by specifying the NOPASSWORD keyword.
  2. Ensure that RSE server has a unique OMVS uid due to the z/OS UNIX related privileges granted to this uid.

Define JES command security

JES Job Monitor issues all JES operator commands requested by a user through an extended MCS (EMCS) console, whose name is controlled with the CONSOLE_NAME directive, as documented in FEJJCNFG, JES Job Monitor configuration file.

The following sample RACF commands give Developer for System z users conditional access to a limited set of JES commands (Hold, Release, Cancel, and Purge). Users only have execution permission if they issue the commands through JES Job monitor. Replace the #console placeholder with the actual console name.

Notes:
  1. Usage of the console is permitted if no MVS.MCSOPER.#console profile is defined
  2. The CONSOLE class must be active for WHEN(CONSOLE(JMON)) to work, but there is no actual profile check in the CONSOLE class for EMCS consoles.
  3. Do not replace JMON with the actual console name in the WHEN(CONSOLE(JMON)) clause. The JMON keyword represents the point-of-entry application, not the console name.
CAUTION:
Defining JES commands with universal access NONE in your security software might impact other applications and operations. Test this before activating it on a production system.

Define RSE as a secure z/OS UNIX server

RSE requires UPDATE access to the BPX.SERVER profile to create/delete the security environment for the client's thread. If this profile is not defined, UID(0) is required for RSE.

Define MVS program controlled libraries for RSE

Servers with authority to BPX.SERVER must run in a clean, program-controlled environment. This implies that all programs called by the RSE server must also be program controlled. For MVS load libraries, program control is managed by your security software.

Note:
Do not use the ** profile if you already have a * profile in the PROGRAM class. It obscures and complicates the search path used by your security software. In this case, you must merge the existing * and the new ** definitions. IBM recommends using the ** profile, as documented in Security Server RACF Security Administrator's Guide (SA22-7683).

Define application protection for RSE

During client logon, RSE daemon verifies that a user is allowed to use the application.

Note:
The client connection request will fail if the profile is not defined, or when the user lacks READ access to the profile.

Define PassTicket support for RSE

The client's password (or other means of identification, such as an X.509 certificate) is only used to verify his identity upon connection. Afterwards, PassTickets are used to maintain thread security. PassTickets are system generated passwords with a lifespan of about 10 minutes. The generated PassTickets are based upon a secret key. This key is a 64 bit number (16 hex characters). Replace in the sample RACF commands below the key16 placeholder with a user-supplied 16 character hex string (characters 0-9 and A-F).

Attention: The client connection request will fail if PassTickets are not set up correctly.

Define z/OS UNIX program controlled files for RSE

Servers with authority to BPX.SERVER must run in a clean, program-controlled environment. This implies that all programs called by RSE server must also be program controlled. For z/OS UNIX files, program control is managed by the extattr command. To execute this command, you need READ access to BPX.FILEATTR.PROGCTL in the FACILITY class, or be UID(0).

Note:

Verify security settings

Use the following sample commands to display the results of your security-related customizations.

Appendix B. Migration considerations

This appendix summarizes the migration information in Rational Developer for System z Host Configuration Guide (SC23-7658). Refer to that publication for more details.

Appendix C. Other information

This appendix summarizes the remaining information in Rational Developer for System z Host Configuration Guide (SC23-7658). Refer to that publication for more details.

Operator commands

This chapter provides an overview of the available operator (or console) commands for Developer for System z.

Troubleshooting configuration problems

This chapter is provided to assist you with some common problems that you may encounter during your configuration of Developer for System z, and has the following sections:

Understanding Developer for System z

The Developer for System z host consists of several components that interact to give the client access to the host services and data. Understanding the design of these components can help you make the correct configuration decisions.

Tuning considerations

RSE (Remote Systems Explorer) is the core of Developer for System z. To manage the connections and workloads from the clients, RSE is composed of a daemon address space, which controls thread pooling address spaces. The daemon acts as a focal point for connection and management purposes, while the thread pools process the client workloads.

This makes RSE a prime target for tuning the Developer for System z setup. However, maintaining hundreds of users, each using 16 or more threads, a certain amount of storage, and possibly one or more address spaces requires proper configuration of both Developer for System z and z/OS.

The following topics are covered in this chapter:

Performance considerations

z/OS is a highly customizable operating system, and (sometimes small) system changes can have a huge impact on the overall performance. This chapter highlights some of the changes that can be made to improve the performance of Developer for System z.

CICSTS considerations

This chapter contains information useful for a CICS Transaction Server administrator.

Customizing the TSO environment

This chapter assists you with mimicking a TSO logon procedure by adding DD statements and data sets to the TSO environment in Developer for System z.

Running multiple instances

There are times that you want multiple instances of Developer for System z active on the same system, for example, when testing an upgrade. However, some resources such as TCP/IP ports cannot be shared, so the defaults are not always applicable. Use the information in this chapter to plan the coexistence of the different instances of Developer for System z, after which you can use this configuration guide to customize them.

Setting up SSL and X.509 authentication

This appendix is provided to assist you with some common problems that you may encounter when setting up Secure Socket Layer (SSL), or during checking or modifying an existing setup. This appendix also provides a sample setup to support users authenticating themselves with an X.509 certificate.

Setting up TCP/IP

This appendix is provided to assist you with some common problems that you may encounter when setting up TCP/IP, or during checking or modifying an existing setup.

Setting up INETD

This appendix is provided to assist you with some common problems that you may encounter when setting up INETD, or during checking or modifying an existing setup. INETD is used by Developer for System z for REXEC/SSH functionality.

Setting up APPC

This appendix is provided to assist you with some common problems that you may encounter when setting up APPC (Advanced Program-to-Program Communication), or during checking or modifying an existing setup.

Requisites

This appendix lists the host prerequisites and corequisites for this version of Developer for System z.

Documentation notices for IBM Rational® Developer for System z

© Copyright IBM Corporation - 2009

U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

IBM Director of Licensing
IBM Corporation
North Castle Drive
Armonk, NY 10504-1785
U.S.A.

For license inquiries regarding double-byte (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to:

Intellectual Property Licensing
Legal and Intellectual Property Law
IBM Japan, Ltd.
3-2-12, Roppongi, Minato-ku, Tokyo 106-8711 Japan

The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law: INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you.

This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice.

Any references in this information to non-IBM Web sites are provided for convenience only and do not in any manner serve as an endorsement of those Web sites. The materials at those Web sites are not part of the materials for this IBM product and use of those Web sites is at your own risk.

IBM may use or distribute any of the information you supply in any way it believes appropriate without incurring any obligation to you.

Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact:

Intellectual Property Dept. for Rational Software
IBM Corporation
3039 Cornwallis Road, PO Box 12195
Research Triangle Park, NC 27709
U.S.A.

I

Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee.

The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us.

Any performance data contained herein was determined in a controlled environment. Therefore, the results obtained in other operating environments may vary significantly. Some measurements may have been made on development-level systems and there is no guarantee that these measurements will be the same on generally available systems. Furthermore, some measurements may have been estimated through extrapolation. Actual results may vary. Users of this document should verify the applicable data for their specific environment.

Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products.

All statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only.

This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to the names and addresses used by an actual business enterprise is entirely coincidental.

Copyright license

This information contains sample application programs in source language, which illustrate programming techniques on various operating platforms. You may copy, modify, and distribute these sample programs in any form without payment to IBM, for the purposes of developing, using, marketing or distributing application programs conforming to the application programming interface for the operating platform for which the sample programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore, cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are provided "AS IS", without warranty of any kind. IBM shall not be liable for any damages arising out of your use of the sample programs.

Trademark acknowledgments

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at www.ibm.com/legal/copytrade.shtml.

Rational are trademarks of International Business Machines Corporation and Rational Software Corporation, in the United States, other countries, or both.

Intel and Pentium are trademarks of Intel Corporation in the United States, or other countries, or both.

Microsoft, Windows, and the Windows logo are trademarks or registered trademarks of Microsoft Corporation in the United States, or other countries, or both.

Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries.

UNIX is a registered trademark of The Open Group in the United States and other countries.

Index

A B C D E F I J L M O P R S T U V Z
A B C D E F I J L M O P R S T U V Z