Hello Michael,
my guess is that the source file needs to be FIXED 80.
I wrote a small EXEC to convert such LRECL V files to LRECL F.
Don't have access to my VM machine at the moment,
but it goes like this:
two filedefs, INPUT with LRECL V, output with LRECL FIXED 80,
MOVEFILE INPUT OUTPUT
then rename to result to original
You could look at my Stanford Pascal Compiler sites, maybe you
find the EXEC there:
HTH
kind regards
Bernd
Am 13.03.2022 um 10:01 schrieb Michael
Grom:
toggle quoted message
Show quoted text
Dear Group,
I was watching moshix' M94 video (Part 2 on how to use VSAM on
VM/370 from COBOL + PL/I using VSAMIO) and thought I give COBOL
a try, first, without?
the VSAM example. So I prepped a very small program and tried
to compile. Before that, I linked to COBOL 191 and accessed the
mini disk as B.?
cobol mycob
SYSTEM/360 COBOL COMPILER? ? ? ? ? CB545 V2 LVL78
OPEN ERROR CODE '03' ON 'SYSIN '.
?
Ready; T=0.01/0.04 08:48:47
That was kind of unexpected to me. As Ren¨¦ Ferland explained,
the Cobol compiler is significantly older than the system itself
and was lifted from a previous version of MVS. Hence the use of
VSAMIO which brings VSAM capability to these old compilers.
However, the problem seems to start much earlier, at least with
my?
VM/370 CE 1.1 installation.
query cplevel
SYSTEM 4381-A
VM/370 Community Edition Version? 1 Release? 1.1 03/10/22
08:54:40
?
Ready; T=0.01/0.01 08:56:28
update: I created the source file with "ee" without any further
specification, quite naively. A dir * cobol yields
Filename Filetype Fm? Format? ? Recs Blocks? ? Date? ? ?Time?
?Label
MYCOB? ? COBOL? ? A1? V? ? 32? ? ?10? ? ? 1? 03/12/22? ?16:29?
CMS191
Could it be the old compiler chokes because of the file
attributes V and lrecl=32??
Is there a way to specify that beforehand or to change the
record attributes later??
kind regards
Michael
|
Dear Group,
I was watching moshix' M94 video (Part 2 on how to use VSAM on VM/370 from COBOL + PL/I using VSAMIO) and thought I give COBOL a try, first, without?
the VSAM example. So I prepped a very small program and tried to compile. Before that, I linked to COBOL 191 and accessed the mini disk as B.?
cobol mycob
SYSTEM/360 COBOL COMPILER? ? ? ? ? CB545 V2 LVL78
OPEN ERROR CODE '03' ON 'SYSIN '.
?
Ready; T=0.01/0.04 08:48:47
That was kind of unexpected to me. As Ren¨¦ Ferland explained, the Cobol compiler is significantly older than the system itself and was lifted from a previous version of MVS. Hence the use of VSAMIO which brings VSAM capability to these old compilers. However, the problem seems to start much earlier, at least with my?
VM/370 CE 1.1 installation.
query cplevel
SYSTEM 4381-A
VM/370 Community Edition Version? 1 Release? 1.1 03/10/22 08:54:40
?
Ready; T=0.01/0.01 08:56:28
update: I created the source file with "ee" without any further specification, quite naively. A dir * cobol yields
Filename Filetype Fm? Format? ? Recs Blocks? ? Date? ? ?Time? ?Label
MYCOB? ? COBOL? ? A1? V? ? 32? ? ?10? ? ? 1? 03/12/22? ?16:29? CMS191
Could it be the old compiler chokes because of the file attributes V and lrecl=32??
Is there a way to specify that beforehand or to change the record attributes later??
kind regards
Michael
|
Re: Using Hercules version specific config file parameters with VM370CE
Thanks, Dave.
In VMCE 1.1.1, I added the VM50U0 and VM50U1 as user pack volume serial numbers. Those packs are empty in the distribution, and those names (or anything of that name pattern - VM50Ux) will never be used to distribute VMCE content.?¸é±ð²Ô¨¦, I suggest you use those names for your private?data minidisks. When a new VM release comes out, just copy those disk volumes to the new release, over top of the empty ones we supply and update the USER DIRECT file appropriately. Also copy any shadow files for those?User volumes.
Bob
|
Re: Using Hercules version specific config file parameters with VM370CE
¸é±ð²Ô¨¦, ? There isn¡¯t a ¡°command¡± as such. You can use the standalone Format Allocate program. Its available as IPL FMT on the ¡°S¡± disk. Make sure the disk you want to label is detached from SYSTEM attached to your VM. Punch IPL FMT it to your reader (NOH and IPL it, e.g. ? purge r????????????????????????????????????????????? ?NO? FILES PURGED??????????????????????????????????? Ready; T=0.01/0.01 14:47:34????????????????????????? spool pun *??????????????? ?????????????????????????? Ready; T=0.01/0.01 14:47:42????????????????????????? punch ipl fmt s (noh???????????????????????????????? PUN FILE 0617? TO? MAINT??? COPY 01 NOHOLD?????????? Ready; T=0.01/0.03 14:47:56????????????????????????? ipl c??????? ???????????????????????????????????????? VM/370 FORMAT/ALLOCATE PROGRAM RELEASE 6???????????? ENTER FORMAT OR ALLOCATE:??????????????????????????? format?????????????????????????????????????????????? FORMAT FUNCTION SELECTED???????????????????????????? ENTER DEVICE ADDRESS (CUU):????????????????????????? 131????????????????????????????????????????????????? ENTER DEVICE TYPE:????????????????????????????????? 3350??????????????????????????????????????????????? ENTER START CYLINDER (XXX OR XXXX) OR "LABEL":????? label????????????????????????? ????????????????????? ENTER DEVICE LABEL: TTEST ? ??????????????????????????????? ? ? Dave ? ? ?
toggle quoted message
Show quoted text
From: [email protected] <[email protected]> On Behalf Of rvjansen@...
Sent: 12 March 2022 14:23
To: [email protected]
Subject: Re: [h390-vm] Using Hercules version specific config file parameters with VM370CE? Well ¡ skip that. I varied the wrong address online. (Still interested in the answer tho). ¸é±ð²Ô¨¦.
? Hi Bob, to prepare for the release of VM370CE 1.1.2 I am getting rid of some sixpack version I am running, and one has a dasd that I allocated for a user; unfortunately it is called VM50-7, which the CE already has. I put it on another address, and when attaching it with: /attach 6a9 to system as vm51-7 (I thought to be clever and just attach it with another name and change it to that in the USER DIRECT) /13:53:19 DASD 6A9 VOLID VM50-7 DOES NOT MATCH So I am doubting now to vmarc the content of its minidisks and reformat, or to relabel it, which seems quicker. Is there a command to relabel it? ?
On 12 Mar 2022, at 14:04, Bob Bolch <Bob@...> wrote: ? Hi Gary, I have 1.1.2 on the brain, since we are trying to get it out as soon as we can. The current release is 1.1.1. We want to get at least a few more of the bugs at fixed before release if we can. Everything?takes a lot longer to fix now, than it did in 1978! ? Hi Bob,
Bob Bolch wrote:
> Starting with the Community Edition Version 1 Release 1.2 (the current?
> release),
Is that a typo, or is 1.1.2 set to be released shortly?
Regards,
Gary
?
?
|
Re: Using Hercules version specific config file parameters with VM370CE
Well ¡ skip that. I varied the wrong address online.
(Still interested in the answer tho).
toggle quoted message
Show quoted text
Hi Bob,
to prepare for the release of VM370CE 1.1.2 I am getting rid of some sixpack version I am running, and one has a dasd that I allocated for a user; unfortunately it is called VM50-7, which the CE already has. I put it on another address, and when attaching it with:
/attach 6a9 to system as vm51-7
(I thought to be clever and just attach it with another name and change it to that in the USER DIRECT)
VM tells me that:
/13:53:19 DASD 6A9 VOLID VM50-7 DOES NOT MATCH
So I am doubting now to vmarc the content of its minidisks and reformat, or to relabel it, which seems quicker. Is there a command to relabel it?
Many thanks in advance,
Best regards,
¸é±ð²Ô¨¦.
On 12 Mar 2022, at 14:04, Bob Bolch < Bob@...> wrote:
Hi Gary, Ooops :-)? I have 1.1.2 on the brain, since we are trying to get it out as soon as we can. The current release is 1.1.1. We want to get at least a few more of the bugs at
fixed before release if we can. Everything?takes a lot longer to fix now, than it did in 1978! Bob? Hi Bob,
Bob Bolch wrote:
> Starting with the Community Edition Version 1 Release 1.2 (the current?
> release),
Is that a typo, or is 1.1.2 set to be released shortly?
Regards,
Gary
|
Re: Using Hercules version specific config file parameters with VM370CE
Hi Bob,
to prepare for the release of VM370CE 1.1.2 I am getting rid of some sixpack version I am running, and one has a dasd that I allocated for a user; unfortunately it is called VM50-7, which the CE already has. I put it on another address, and when attaching it with:
/attach 6a9 to system as vm51-7
(I thought to be clever and just attach it with another name and change it to that in the USER DIRECT)
VM tells me that:
/13:53:19 DASD 6A9 VOLID VM50-7 DOES NOT MATCH
So I am doubting now to vmarc the content of its minidisks and reformat, or to relabel it, which seems quicker. Is there a command to relabel it?
Many thanks in advance,
Best regards,
¸é±ð²Ô¨¦.
toggle quoted message
Show quoted text
On 12 Mar 2022, at 14:04, Bob Bolch < Bob@...> wrote:
Hi Gary, Ooops :-)? I have 1.1.2 on the brain, since we are trying to get it out as soon as we can. The current release is 1.1.1. We want to get at least a few more of the bugs at
fixed before release if we can. Everything?takes a lot longer to fix now, than it did in 1978! Bob? Hi Bob,
Bob Bolch wrote:
> Starting with the Community Edition Version 1 Release 1.2 (the current?
> release),
Is that a typo, or is 1.1.2 set to be released shortly?
Regards,
Gary
|
Re: Using Hercules version specific config file parameters with VM370CE
Hi Gary, Ooops :-)? I have 1.1.2 on the brain, since we are trying to get it out as soon as we can. The current release is 1.1.1. We want to get at least a few more of the bugs at
fixed before release if we can. Everything?takes a lot longer to fix now, than it did in 1978! Bob?
Hi Bob,
Bob Bolch wrote:
> Starting with the Community Edition Version 1 Release 1.2 (the current
> release),
Is that a typo, or is 1.1.2 set to be released shortly?
Regards,
Gary
|
Re: Using Hercules version specific config file parameters with VM370CE
Bob and Rene, Thank you guys for helping me understand. I see now the reasoning for the readme's and the value they add to be included. I am the user that was a former computer operator in the 80s who likes to "tinker" and learn. So my experience is more along the novice level and while I want to learn Rexx, the VM370 specifics like "nolog" are lost on me. I am guessing now that "nolog" means cannot log on. I will read more of the documentation to learn. I am grateful that you guys are taking your time to share your knowledge and experience so that others, like me can learn. Peace, Jaime On Sat, 12 Mar 2022 03:52:40 -0800, "Bob Bolch" <Bob@...> wrote: On Sat, Mar 12, 2022 at 02:17 AM, rvjansen@... wrote:
Hi Jamie,
Thanks to Ren¨¦ for explaining the way the readme files build on the
previous
versions of VM/370.
I believe the target VM/370 user for these distributions is either the
general user who wants
to learns about mainframe computing in the 1970s, or the system
programmer who
used VM/370 in that era, and really liked working on it. The new user can become familiar with
how things worked, using the CMSUSER uer ID. The primary documentation is here:
[1] and the
enhancements to the
system (like REXX or full screen editting) are mostly based on changes
that were incorporated
into later versions of VM by IBM. Some of the later IBM documentation can suplement the
HELP file documentation.
Starting with the Community Edition Version 1 Release 1.2 (the current
release), we
set up an issue reporting area at [2]
Most people just bring up issues on this mailing list and I enter the
issues,
so I can keep track.
In the old days, each IBM manual started with an explanation of changes
since the last release.
That is why the readme files have been retained for the Sixpack/VMCE
releases for the last
decade.
This is a completely volunteer effort, so there are always things that
can be improved.
Best regards,
Bob
Links:
------
[1]
[2]
[3] /g/h390-vm/message/4071
[4]
mailto: [email protected]?subject=Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE [5]
mailto:Bob@...?subject=Private:%20Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE [6] /mt/88093602/4526575
[7] /g/h390-vm/post
[8] /g/h390-vm/editsub/4526575
[9] mailto:[email protected]
[10] /g/h390-vm/leave/11166232/4526575/1317415517/xyzzy
|
Re: Using Hercules version specific config file parameters with VM370CE
Hi Bob, Bob Bolch wrote: Starting with the Community Edition Version 1 Release 1.2 (the current release), Is that a typo, or is 1.1.2 set to be released shortly? Regards, Gary
|
Re: Using Hercules version specific config file parameters with VM370CE
On Sat, Mar 12, 2022 at 02:17 AM, rvjansen@... wrote:
Hi Jamie,
Thanks to Ren¨¦ for explaining the way the readme files build on the previous
versions of VM/370.?
I believe the target VM/370 user for these distributions is either the general user who wants
to learns about mainframe computing in the 1970s, or the system programmer who
used VM/370 in that era, and really liked working on it. The new user can become familiar with
how things worked, using the CMSUSER uer ID. The primary documentation is here:
? and the enhancements to the
system (like REXX or full screen editting) are mostly based on changes that were incorporated
into later versions of VM by IBM. Some of the later IBM documentation can suplement the?
HELP file documentation.
Starting with the Community Edition Version 1 Release 1.2 (the current release), we
set up an issue reporting area at???
Most people just bring up issues on this mailing list and I enter the issues,
so I can keep track.?
In the old days, each IBM manual started with an explanation of changes since the last release.
That is why the readme files have been retained for the Sixpack/VMCE releases for the last
decade.
This is a completely volunteer effort, so there are always things that can be improved.
Best regards,
Bob
|
Re: Using Hercules version specific config file parameters with VM370CE
Hi Jaime,
as these subsequent releases build on older work, you see different readme¡¯s belonging to those older releases all in the same directory; this is not unusual for these efforts. Most of the time is spent working on technical improvements, and, for example, on the online help. The fact that the BREXX user is ¡¯nolog¡¯ is clearly indicated in bullet 14 of readme-vmce-1_1_1.txt.
It is imaginable to write a manual for this distribution, and I encourage you to do so. I admit that for new users to a particular system the basics are always a bit hard to find. I know, because I like playing with Multics, CDC NOS/BE, Music/SP and others in addition to MVS (z/OS) which I worked on most of my career. The trick is always to read all the readme¡¯s in reverse chronological order.
Even if we have one big readme/manual, it needs to have all this older info. This is because when people use subsequent versions, they need to see what has changed, but also how it was, and why it became to be. Also, don¡¯t forget to download the relevant product documentation from bitsavers.
Best regards,
¸é±ð²Ô¨¦.
toggle quoted message
Show quoted text
On 12 Mar 2022, at 05:38, Jaime Carpenter <j.carpenter@...> wrote:
Hi Bob,
I am a new user to the VM370CE world, so I was looking for the userids to
logon. I looked in the readme files. The one with userids is
readme-1_2.txt. This readme stated that there was a BREXX userid, when I
tried it that is where I got the not in CP Directory message.
The multiple readme files, at first were confusing because they are a mix
of Sixpack, TK4-, vm370ce and others. If this is not going to be called
"Sixpack" then it seems to me that those readme files could be removed and
some of the info put into the VM370CE readme. Also, those sixpack readmes
mention "Please report any issues on the "[email protected]" mailing list."
I think that is no longer valid.
Thanks,
Jaime Carpenter
On Fri, 11 Mar 2022 12:45:56 -0500, "Bob Bolch" <Bob@...> wrote:
Please elaborate on the "packaging issue for the readme files", so it can
be fixed. The current source code for BREXX and GCC runtime library files
for CMS, are on the MAINTC user ID in VMCE.
Thanks!
Bob Bolch
Links:
------
[1] /g/h390-vm/message/4066
[2]
mailto:[email protected]?subject=Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE
[3]
mailto:Bob@...?subject=Private:%20Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE
[4] /mt/88093602/4526575
[5] /g/h390-vm/post
[6] /g/h390-vm/editsub/4526575
[7] mailto:[email protected]
[8] /g/h390-vm/leave/11166232/4526575/1317415517/xyzzy
|
Re: Using Hercules version specific config file parameters with VM370CE
Hi Bob, I am a new user to the VM370CE world, so I was looking for the userids to logon. I looked in the readme files. The one with userids is readme-1_2.txt. This readme stated that there was a BREXX userid, when I tried it that is where I got the not in CP Directory message. The multiple readme files, at first were confusing because they are a mix of Sixpack, TK4-, vm370ce and others. If this is not going to be called "Sixpack" then it seems to me that those readme files could be removed and some of the info put into the VM370CE readme. Also, those sixpack readmes mention "Please report any issues on the " [email protected]" mailing list." I think that is no longer valid. Thanks, Jaime Carpenter On Fri, 11 Mar 2022 12:45:56 -0500, "Bob Bolch" <Bob@...> wrote: Please elaborate on the "packaging issue for the readme files", so it can be fixed. The current source code for BREXX and GCC runtime library files for CMS, are on the MAINTC user ID in VMCE.?
Thanks!
Bob Bolch
Links:
------
[1] /g/h390-vm/message/4066
[2]
mailto: [email protected]?subject=Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE [3]
mailto:Bob@...?subject=Private:%20Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE [4] /mt/88093602/4526575
[5] /g/h390-vm/post
[6] /g/h390-vm/editsub/4526575
[7] mailto:[email protected]
[8] /g/h390-vm/leave/11166232/4526575/1317415517/xyzzy
|
Re: Using Hercules version specific config file parameters with VM370CE
Jaime,
Well if its in the readme it should be there, and the link also needs the user to exist.
I know Bob has moved stuff round so it may have gon. From his E-Mail looks like its now on MAINTC
Dave
toggle quoted message
Show quoted text
-----Original Message-----
From: [email protected] <[email protected]> On Behalf Of Jaime
Carpenter
Sent: 11 March 2022 17:14
To: [email protected]
Subject: Re: [h390-vm] Using Hercules version specific config file parameters
with VM370CE
I am using VM/370 Community Edition V1R1.1
I am new so I did not know about linking to another disk. I was looking for
the BREXX user.
Thanks
On Fri, 11 Mar 2022 16:46:26 -0000, "Dave Wade" <dave.g4ugm@...>
wrote:
J
Which versi¨®n of CE?
Its not usually useful to logon to BREXX, you can link the disk:-
link brexx 191 199 rr
Ready; T=0.01/0.01 11:43:05
access 199 x
X (199) R/O
Ready; T=0.01/0.01 11:43:10
Then
FSLIST * * X
Will show you the files. Not sure there is anything relevant to users
on ther¡.
Dave
G4UGM
FROM: [email protected] ON BEHALF OF j.carpenter@...
SENT: 11 March 2022 16:33
TO: [email protected]
SUBJECT: Re: [h390-vm] Using Hercules version specific config file
parameters with VM370CE
Gentlemen,
I am grateful for the amazing work on VM370CE and also SDL yperion and
Hercules. I reached this forum because I am running a Raspberry Pi and
Herc 3.13. I also had the IPL issue and I read through and understand
about the CONF file and ARCHMODE. I can now IPL. I noticed that the
read me files mention the BREXX user and when I try to logon, it says
it is not in the CP Directory. I mention this here because if it is
not included, then it is also a packaging issue with the readme files.
I use HercGUI on RPi along with Hercules 3.13 because those are the
packages provided. I am a newby here, so if my comments are off topic,
please let me know. Thanks
Links:
------
[1] /g/h390-vm/message/4065
[2]
mailto:[email protected]?subject=Re:%20Re%3A%20%5Bh390-
vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20pa
rameters%20with%20VM370CE
[3]
mailto:dave.g4ugm@...?subject=Private:%20Re:%20Re%3A%20%5B
h390-
vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20pa
rameters%20with%20VM370CE
[4] /mt/88093602/4526575
[5] /g/h390-vm/post
[6] /g/h390-vm/editsub/4526575
[7] mailto:[email protected]
[8]
/g/h390-vm/leave/11166232/4526575/1317415517/xyzzy
|
Re: Using Hercules version specific config file parameters with VM370CE
I am using VM/370 Community Edition V1R1.1 I am new so I did not know about linking to another disk. I was looking for the BREXX user. Thanks On Fri, 11 Mar 2022 16:46:26 -0000, "Dave Wade" <dave.g4ugm@...> wrote: J
Which versi¨®n of CE?
Its not usually useful to logon to BREXX, you can link the disk:-
link brexx 191 199 rr???????????
Ready; T=0.01/0.01 11:43:05?????
access 199 x????????????????????
X (199) R/O?????????????????????
Ready; T=0.01/0.01 11:43:10??
Then
FSLIST * * X
Will show you the files. Not sure there is anything relevant to users on
³Ù³ó±ð°ù¡.??
Dave
G4UGM
????????????????????????????????
FROM: [email protected] ON BEHALF OF j.carpenter@...
SENT: 11 March 2022 16:33
TO: [email protected]
SUBJECT: Re: [h390-vm] Using Hercules version specific config file
parameters with VM370CE
Gentlemen,
I am grateful for the amazing work on VM370CE and also SDL yperion and
Hercules. I reached this forum because I am running a Raspberry Pi and
Herc 3.13. I also had the IPL issue and I read through and understand
about the CONF file and ARCHMODE. I can now IPL. I noticed that the read
me files mention the BREXX user and when I try to logon, it says it is
not in the CP Directory. I mention this here because if it is not
included, then it is also a packaging issue with the readme files. I use
HercGUI on RPi along with Hercules 3.13 because those are the packages
provided. I am a newby here, so if my comments are off topic, please let
me know. Thanks
Links:
------
[1] /g/h390-vm/message/4065
[2]
mailto: [email protected]?subject=Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE [3]
mailto:dave.g4ugm@...?subject=Private:%20Re:%20Re%3A%20%5Bh390-vm%5D%20Using%20Hercules%20version%20specific%20config%20file%20parameters%20with%20VM370CE [4] /mt/88093602/4526575
[5] /g/h390-vm/post
[6] /g/h390-vm/editsub/4526575
[7] mailto:[email protected]
[8] /g/h390-vm/leave/11166232/4526575/1317415517/xyzzy
|
Re: Using Hercules version specific config file parameters with VM370CE
Please elaborate on the "packaging issue for the readme files", so it can be fixed. The current source code for BREXX and GCC runtime library files for CMS, are on the MAINTC user ID in VMCE.?
|
Re: Using Hercules version specific config file parameters with VM370CE
J Which versi¨®n of CE? Its not usually useful to logon to BREXX, you can link the disk:- ? link brexx 191 199 rr??????????? Ready; T=0.01/0.01 11:43:05????? access 199 x???????????????????? X (199) R/O????????????????????? Ready; T=0.01/0.01 11:43:10?? ? Then ? FSLIST * * X ? Will show you the files. Not sure there is anything relevant to users on ³Ù³ó±ð°ù¡.?? ? Dave G4UGM ???????????????????????????????? ?
toggle quoted message
Show quoted text
From: [email protected] <[email protected]> On Behalf Of j.carpenter@...
Sent: 11 March 2022 16:33
To: [email protected]
Subject: Re: [h390-vm] Using Hercules version specific config file parameters with VM370CE? Gentlemen,
I am grateful for the amazing work on VM370CE and also SDL yperion and Hercules.? I reached this forum because I am running a Raspberry Pi and Herc 3.13.? I also had the IPL issue and I read through and understand about the CONF file and ARCHMODE.? I can now IPL.? I noticed that the read me files mention the BREXX user and when I try to logon, it says it is not in the CP Directory.? I mention this here because if it is not included, then it is also a packaging issue with the readme files. I use HercGUI on RPi along with Hercules 3.13 because those are the packages provided. I am a newby here, so if my comments are off topic, please let me know.? Thanks
|
Re: Using Hercules version specific config file parameters with VM370CE
Gentlemen,
I am grateful for the amazing work on VM370CE and also SDL yperion and Hercules.? I reached this forum because I am running a Raspberry Pi and Herc 3.13.? I also had the IPL issue and I read through and understand about the CONF file and ARCHMODE.? I can now IPL.? I noticed that the read me files mention the BREXX user and when I try to logon, it says it is not in the CP Directory.? I mention this here because if it is not included, then it is also a packaging issue with the readme files. I use HercGUI on RPi along with Hercules 3.13 because those are the packages provided. I am a newby here, so if my comments are off topic, please let me know.? Thanks
|
Re: Protecting telnet 3270 sessions
Michael, So you mean you also use it for authentication. Why not just say that? Its fine. Personally I would just create a Linux VM for isolation¡ Dave ?
toggle quoted message
Show quoted text
From: [email protected] <[email protected]> On Behalf Of Michael Grom
Sent: 11 March 2022 11:57
To: [email protected]
Subject: Re: [h390-vm] Protecting telnet 3270 sessions? Hi Dave, simply, I don't want uninvited visitors in any of my systems, be them actual or vintage. In my own network at home, behind router and firewall, unencrypted comms or terminal sessions is not much of an issue. As soon as your server is in the internet (cloud offering, virtual server) or accessible through the internet, that's a different story. We also cannot rule out that the vintage OS together with hercules can be a vector to attack the underlying host. So yes, speaking of data protection, the system(s) I run is only a big playground. No personal or business data.?
No need to update hercules, that's where ssh tunnel (Gregg) or stunnel4 (my proposal) comes in, based on the following assumption a) the host system is guarded with a proper IPTABLES setup, only allowing for the desired TLS and/or SSH destination ports (and source ports, if establishing a link to another computer)
b) binding to the local interface (127.0.0.1) is safe. No packets can travel from the loopback interface to a network interface connected to the external world. An attacker would already have to be inside the system and be able to trace such comms.?
c) stunnel or ssh offer a bridge / TLS termination. Encrypted comms is coming in from the outside, passes through the firewall and is accepted and decrypted by the ssh or stunnel and relayed to the destination port (opened by hercules) on the loopback interface.?
d) 2-Way SSL is used to prevent from unauthorized and unwanted connection by arbitrary clients. If the client cert is invalid or unknown, the SSL handshake fails.?
If you want to allow external users to the system, you would have to establish either certificate issueing or signing. A user who wants to access your VM or MVS would have to submit a certificate signing request, you sign it with your CA and return the signed certificate to the user (which is only useful together with the private key the user must keep for himself).?
I think I should prep some slides that visualise the setup in mind (and which I, more or less, run on my own). It's all free stuff, so no cost attached. In the meantime, my setup is as follows: Macintosh (the machine where x3270 4.x fails to establish a ssl connection for some odd reason, instead, x3270 talks to a stunnel acting as a client to the server) /opt/homebrew/etc/stunnel/stunnel.conf output = /opt/homebrew/var/log/stunnel.log [x3270] cert = /opt/homebrew/etc/stunneL/kontor2.crt key? = /opt/homebrew/etc/stunnel/kontor.key CAfile = /opt/homebrew/etc/stunnel/chain.pem client = yes accept = 127.0.0.1:43270 connect = vmd33672.contaboserver.net:43270 [x3271] cert = /opt/homebrew/etc/stunneL/kontor2.crt key? = /opt/homebrew/etc/stunnel/kontor.key CAfile = /opt/homebrew/etc/stunnel/chain.pem client = yes accept = 127.0.0.1:53270 ? connect = vmd33672.contaboserver.net:53270
My Linux server (a cloud offering) ? output = /var/log/stunnel4/stunnel.log
# the VM System listening at port 3271 [x3271] accept = 53270 connect= 3271 verifyChain=yes verifyPeer = no cert = /etc/stunnel/vmd33672-server.pem CAfile = /etc/stunnel/chain2.pem
# the MVS system, listening at port 3270
[x3270] accept = 43270 connect= 3270 verifyChain = yes verifyPeer = no cert = /etc/stunnel/vmd33672-server.pem ? CAfile = /etc/stunnel/chain2.pem
# the http interfaces of the two hercules instances to make it operable from the outside. Also with 2-Way TLS as we have no user management here. [herchttp] accept = 4888 connect= 8088 verifyChain = yes verifyPeer = no cert = /etc/stunnel/vmd33672-server.pem CAfile = /etc/stunnel/chain2.pem ? [herchttp-2] accept = 5888 connect= 8082 verifyChain = yes verifyPeer = no cert = /etc/stunnel/vmd33672-server.pem CAfile = /etc/stunnel/chain2.pem
When I connect to my vmd33672 from one of my linux boxes, I do not need to use stunnel on the client side, the x3270 call is
? #!/bin/bash ? x3270 -model 3279-2 -accepthostname vmd33672.contaboserver.net -cafile ~/chain.pem? -certfile ~/kontor2.crt -keyfile ~/kontor.key? L:vmd33672.contaboserver.net:43270
Tracing failed SSL handshakes can be a daunting task, so don't give up. If one detail goes wrong, the entire handshake fails. Can be anything from chain, algorithm, key size, certificate validity, common name not matching name resolution etcpp.?
Relevant IPTABLES ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:43270 ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:53270 ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:4888 ? ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:5888
kind regards
Michael
?
|
Re: Protecting telnet 3270 sessions
Hi Dave,
simply, I don't want uninvited visitors in any of my systems, be them actual or vintage. In my own network at home, behind router and firewall, unencrypted comms or terminal sessions is not much of an issue. As soon as your server is in the internet (cloud offering, virtual server) or accessible through the internet, that's a different story. We also cannot rule out that the vintage OS together with hercules can be a vector to attack the underlying host. So yes, speaking of data protection, the system(s) I run is only a big playground. No personal or business data.?
No need to update hercules, that's where ssh tunnel (Gregg) or stunnel4 (my proposal) comes in, based on the following assumption
a) the host system is guarded with a proper IPTABLES setup, only allowing for the desired TLS and/or SSH destination ports (and source ports, if establishing a link to another computer)
b) binding to the local interface (127.0.0.1) is safe. No packets can travel from the loopback interface to a network interface connected to the external world. An attacker would already have to be inside the system and be able to trace such comms.?
c) stunnel or ssh offer a bridge / TLS termination. Encrypted comms is coming in from the outside, passes through the firewall and is accepted and decrypted by the ssh or stunnel and relayed to the destination port (opened by hercules) on the loopback interface.?
d) 2-Way SSL is used to prevent from unauthorized and unwanted connection by arbitrary clients. If the client cert is invalid or unknown, the SSL handshake fails.?
If you want to allow external users to the system, you would have to establish either certificate issueing or signing. A user who wants to access your VM or MVS would have to submit a certificate signing request, you sign it with your CA and return the signed certificate to the user (which is only useful together with the private key the user must keep for himself).?
I think I should prep some slides that visualise the setup in mind (and which I, more or less, run on my own). It's all free stuff, so no cost attached. In the meantime, my setup is as follows:
Macintosh (the machine where x3270 4.x fails to establish a ssl connection for some odd reason, instead, x3270 talks to a stunnel acting as a client to the server)
/opt/homebrew/etc/stunnel/stunnel.conf
output = /opt/homebrew/var/log/stunnel.log
[x3270]
cert = /opt/homebrew/etc/stunneL/kontor2.crt
key? = /opt/homebrew/etc/stunnel/kontor.key
CAfile = /opt/homebrew/etc/stunnel/chain.pem
client = yes
accept = 127.0.0.1:43270
connect = vmd33672.contaboserver.net:43270
[x3271]
cert = /opt/homebrew/etc/stunneL/kontor2.crt
key? = /opt/homebrew/etc/stunnel/kontor.key
CAfile = /opt/homebrew/etc/stunnel/chain.pem
client = yes
accept = 127.0.0.1:53270
?
connect = vmd33672.contaboserver.net:53270
My Linux server (a cloud offering)
?
output = /var/log/stunnel4/stunnel.log
# the VM System listening at port 3271
[x3271]
accept = 53270
connect= 3271
verifyChain=yes
verifyPeer = no
cert = /etc/stunnel/vmd33672-server.pem
CAfile = /etc/stunnel/chain2.pem
# the MVS system, listening at port 3270
[x3270]
accept = 43270
connect= 3270
verifyChain = yes
verifyPeer = no
cert = /etc/stunnel/vmd33672-server.pem
?
CAfile = /etc/stunnel/chain2.pem
# the http interfaces of the two hercules instances to make it operable from the outside. Also with 2-Way TLS as we have no user management here.
[herchttp]
accept = 4888
connect= 8088
verifyChain = yes
verifyPeer = no
cert = /etc/stunnel/vmd33672-server.pem
CAfile = /etc/stunnel/chain2.pem
?
[herchttp-2]
accept = 5888
connect= 8082
verifyChain = yes
verifyPeer = no
cert = /etc/stunnel/vmd33672-server.pem
CAfile = /etc/stunnel/chain2.pem
When I connect to my vmd33672 from one of my linux boxes, I do not need to use stunnel on the client side, the x3270 call is
?
#!/bin/bash
?
x3270 -model 3279-2 -accepthostname vmd33672.contaboserver.net -cafile ~/chain.pem? -certfile ~/kontor2.crt -keyfile ~/kontor.key? L:vmd33672.contaboserver.net:43270
Tracing failed SSL handshakes can be a daunting task, so don't give up. If one detail goes wrong, the entire handshake fails. Can be anything from chain, algorithm, key size, certificate validity, common name not matching name resolution etcpp.?
Relevant IPTABLES
ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:43270
ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:53270
ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:4888
?
ACCEPT ? ? tcp? --? anywhere ? ? ? ? ? ? anywhere ? ? ? ? ? ? tcp dpt:5888
kind regards
Michael
?
|
Re: Protecting telnet 3270 sessions
Michael, VM/370 knows nothing about TN3270 or IP. All it sees is a local 3270 session. If you wanted a secure session into VM you would actually need to update Hercules. Can someone tell me why you would encrypt 3270 coms into a legacy Hercules instance? What is some one going to learn from snooping on the traffic? ?A password for a 50 year old OS running in an isolated environment? Dave ? ?
toggle quoted message
Show quoted text
From: [email protected] <[email protected]> On Behalf Of Michael Grom
Sent: 11 March 2022 07:28
To: [email protected]
Subject: Re: [h390-vm] Protecting telnet 3270 sessions? Dear ¸é±ð²Ô¨¦, dear Gregg, of course I will share my setup with the community asap. Just give me some time to prep things. For using stunnel4, one needs X.509 certificates which can be easily produced with "easy RSA". But more on this later.? @Gregg: A ssh tunnel is a viable option, however, it needs a user identy / account on the server side. If you don't want users of the mainframe system to be users of the hosting linux / unix / whatever system, I reckon that stunnel is the easier way.?
For sure we know that hercules and the hosted mainframe OSes? like VM/370 and MVS can't deal with TLS. This is where the server nature of stunnel4 comes to help. The inbound TLS connection is proxied unecrypted to the 3270 (or other comms) ports.? Usually, x3270 can deal with SSL connections, but on the Macintosh, the x3270 seems to be utterly broken or I haven't figured out how it works on a Mac with the system keystore etc. I use stunnel4 on the Mac as a client, that is, my x3270 connects to let's say localhost:53270 plain text, stunnel connects to vmd33672.contaboserver.net:53270 with 2-way TLS and the server stunnel proxies the data to hercules, in this case VM/370 with hercules listening on 3271 (3270 taken by MVS).?
I'll prep something with instructions on easy RSA how to create client, server and ca and intermediate certs and how to setup the stunnel for both client and server. This can be replicated to other TCP/IP comms as well (thinking of HNET for example).?
kind regards
Michael
|
Michael Grom
