Chapter 10: Server Operations

This chapter contains detailed descriptions of the commands and functions that pertain to RSF servers. This chapter also discusses security and performance considerations for RSF servers.

 

What is an RSF Server?

An AS/400 that answers incoming calls, processing RSF requests from other machines, is an RSF server. The machines making the requests are RSF clients or requesters. The requester is always the initiator of the transaction.

Since a single machine may be receiving and processing requests from remote sites, while at the same time sending its own requests to other sites, it follows that a given machine may be simultaneously acting as a requester and a server.

 


Starting The Server Function

The Start RSF Server Function (STRRSFSRV) command is used to start the RSF server function on your machine. When the server function is started, your machine is ready to answer incoming calls and process RSF requests from remote iSeries and AS/400 machines.

At the time the server function is started, line, controller and device descriptions are created according to the parameters specified for installation defaults. See Setting Product Defaults for more information about changing these defaults.

The prompted version of the STRRSFSRV command is shown below. Click on the image to see command parameter descriptions.

Comment Comment Comment Comment

The parameters for the STRRSFSRV command are described below.

Start SDLC dial-up support

Specify whether to start SDLC dial-up support to enable remote AS/400s to contact your machine over switched telephone connections.

When SDLC dial-up support is started, line, controller and device descriptions are created according to the parameters specified for installation defaults. See Setting Product Defaults for more information about setting the defaults.

The possible values are:

*YES: SDLC dial-up support is started.

*NO: SDLC dial-up support is not started.

Start PPP dial-up support

Specify whether to start PPP dialup support to enable remote machines to contact your machine using TCP/IP over dial-up connections.

When PPP dial-up support is started, line, controller and device descriptions are created according to the parameters specified for installation defaults. See Setting Product Defaults for more information about setting the defaults.

The possible values are:

*YES: PPP dial-up support is started.

*NO: PPP dial-up support is not started.

Start TCP/IP support

Specify whether to start RSF's TCP/IP support to enable remote AS/400s to contact your machine over TCP/IP connections.

When TCP/IP support is started, a monitor job is submitted to job queue QSYSNOMAX using job description RSFTCP. You can change this job description to change some attributes of the monitor job.

The possible values are:

*YES: RSF's TCP/IP support is started.

*NO: RSF's TCP/IP support is not started.

Start broadcast support

Specify whether to start broadcast support to allow your machine to receive RSF broadcast transmissions from other machines.

RSF broadcast transmissions use the multicast protocol. With this type of transmission, a central machine can send data to many other machines simultaneously. Thus, data can be sent to thousands of machines in the time it takes to send to one. Broadcast transmissions are asynchronous, so the sender may not immediately know whether a transmission has been received by all intended recipients. The sender can optionally request that each recipient acknowledge receipt by updating a location list on the sending machine.

When Broadcast support is started, a monitor job is submitted to job queue QSYSNOMAX using job description RSFTCP. You can change this job description to change some attributes of the monitor job.

 The possible values are:

*YES: Broadcast support is started.

*NO: Broadcast support is not started.

Save as new defaults

Indicate whether to change the default values for this command based on
the values entered for other parameters.

The possible values are:

*NO: The default values are not changed.

*YES: The default values are set to the values currently specified.

Subsystem to start

The qualified name of a subsystem that Remote Software Facility should start in conjunction with starting the server function. A subsystem containing the proper communications entries and routing entries must be active in order for Remote Software Facility to be able to service requests from other machines.

This parameter is ignored if *NO is specified for "Start dial-up SDLC support".

The possible values are:

RSF: A subsystem named RSF is started. Subsystem RSF is provided with Remote Software Facility. The subsystem is created the first time you use the STRRSFSRV command and specify RSF for Subsystem to start. You can use the WRKSBSD command to view or change the attributes for subsystem RSF. As shipped, subsystem description RSF contains the necessary communications and routing entries to support the evoking of server jobs on your machine by remote AS/400s sending RSF requests. See Security Considerations For RSF Servers for more information about security considerations for machines acting as RSF servers.

*NONE: No subsystem is started. Use this option if there is already a subsystem active which is configured to handle incoming APPC evoke requests. As shipped from IBM, subsystem QCMN has the proper communications entries and routing entries to handle incoming RSF requests. If subsystem QCMN is active on your system, you probably do not need to start subsystem RSF.

name: The name of a subsystem to start which is configured to handle incoming APPC evoke requests for RSF.

The possible library values are:

*LIBL: The job library list is used to locate the subsystem description.

library name: The name of an existing library which contains the specified subsystem description.

TCP/IP Port to monitor

Specify the number of the port to monitor for incoming RSF TCP/IP requests.

This parameter is ignored if *NO is specified for "Start TCP/IP Support".

The value specified for this parameter must be matched by the value specified for the PORT parameter on RSF server directory entries used by client machines to contact this machine.

The possible values are:

602: A default port of 602 is used.

port-number: Specify a valid port number from 1 to 65534.

Broadcast port to monitor

Specify the number of the port to monitor for incoming RSF broadcast transmissions.

This parameter is ignored if *NO is specified for "Start Broadcast Support" (BROADCAST).

The value specified for this parameter must be matched by the value specified for the BPORT parameter on RSF server directory entries for remote machines sending broadcasts to this machine.

The possible values are:

603: A default port of 603 is used.

port-number: Specify a valid port number from 1 to 65534.

Broadcast group address

Specify the broadcast group IP address to monitor. Only broadcasts sent to the specified IP address on the specified port will be received.

This parameter is ignored if *NO is specified for "Start Broadcast Support" (BROADCAST).

The value specified for this parameter must match the value specified for the GRPADR parameter on RSF server directory entries for remote machines sending broadcasts to this machine.

A valid multicast group address must be in the range of 224.0.0.0 to 232.255.255.255. Addresses from 224.0.0.0 to 224.0.0.255 are intended for intra-network transmissions and therefore, transmissions to these addresses are typically not forwarded by multicast-capable routers. See RFC1700 for a list a list of reserved multicast group addresses.

The possible values are:

group-address: Specify the group address to monitor in the form nnn.nnn.nnn.nnn, where nnn is a number from 0 to 255.

Broadcast interface address

Specify the IP address of the interface on this machine that will be used to receive broadcast transmissions. You can use option 1 on the NETSTAT display to list the available interfaces.

This parameter is ignored if *NO is specified for "Start Broadcast Support" (BROADCAST).

The possible values are:

interface-address: Specify the interface address in the form nnn.nnn.nnn.nnn, where nnn is a number from 0 to 255.

Broadcast message wait

Specify the number of seconds to wait for the next broadcast message before signaling an error.

Broadcast messages may arrive out of order. RSF assembles the messages into the proper order automatically. Between the beginning and end of a broadcast, this parameter determines how long to wait for the next message in the sequence before ending in error.

The possible values are:

300: The default wait time is five minutes.

seconds: Enter the number of seconds to wait for the next message within a broadcast.

Related Commands:

For more information about the following command, prompt the command and press F1 to view the on-line help text:

End Server Function (ENDRSFSRV)

 


Working With the RSF Log

The Work With RSF Log (WRKRSFLOG) command is used to display or print selected RSF log entries. A log entry is generated each time a requester contacts your machine with RSF. Log entries can also be generated each time your machine initiates a request. See Setting Product Defaults for information about changing the logging defaults.

The prompted version of the WRKRSFLOG command is shown below. Click on the image to see command parameter descriptions.

CommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentComment

The parameters for the WRKRSFLOG command are described below.

Starting date

Indicates which transaction dates to include in the entries that are displayed or printed.

The possible values are:

*CURRENT: Transactions from the current date are included.

*FIRST: All transactions from the earliest available date are included.

date: Enter a date in the date format currently in effect for your job. Transactions started on or after the date specified are included.

Ending date

Indicates which transaction dates to include in the entries that are displayed or printed.

The possible values are:

*CURRENT: All transactions started on or before the current date are included.

date: Enter a date in the date format currently in effect for your job. Transactions started on or before the date specified are included.

Starting time

Indicates which transaction times to include in the entries that are displayed or printed.

The possible values are:

*FIRST: All transactions from the earliest available time are included.

time: Enter a time in hours:minutes:seconds format. Transactions started on or after the time specified are included.

Ending time

Indicates which transaction times to include in the entries that are displayed or printed.

The possible values are:

*CURRENT: All transactions started on or before the current time are included.

time: Enter a time in hours:minutes:seconds format. Transactions started on or before the time specified are included.

Package

Indicates which RSF package names should be included in the entries that are displayed or printed.

The possible values are:

*ALL: All packages are included.

generic-name: Enter a generic package specification. An asterisk (*) in the specification will match any string of zero or more characters in the name. An underscore (_) in the specification will match any single character in the name.

Machine serial number

Indicates which serial numbers should be included in the entries that are displayed or printed.

The possible values are:

*ALL: All serial numbers are included.

serial-number: Enter a generic serial number specification. Case is significant. An asterisk (*) in the specification will match any string of zero or more characters in the name. An underscore (_) in the specification will match any single character in the name.

System name

Indicates which system names should be included in the entries that are displayed or printed.

The possible values are:

*ALL: All system names are included.

generic-name: Enter a generic system name specification. Case is significant. An asterisk (*) in the specification will match any string of zero or more characters in the name. An underscore (_) in the specification will match any single character in the name.

Model

Indicates which models should be included in the entries that are displayed or printed.

The possible values are:

*ALL: All models are included.

model-name: Enter a generic model specification. Case is significant. An asterisk (*) in the specification will match any string of zero or more characters in the name. An underscore (_) in the specification will match any single character in the name.

User

Indicates which user IDs should be included in the entries that are displayed or printed. Log entries are included if they were generated by the ID specified

The possible values are:

*ALL: All user IDs are included.

user-ID: Enter a generic user specification. Case is significant. An asterisk (*) in the specification will match any string of zero or more characters in the name. An underscore (_) in the specification will match any single character in the name.

Language code

Indicates which language codes should be included in the entries that are displayed or printed.

The possible values are:

*ALL: All language codes are included.

language-code: Enter a generic language code specification. Case is significant. An asterisk (*) in the specification will match any string of zero or more characters in the name. An underscore (_) in the specification will match any single character in the name.

Request type

Indicates which request types should be included in the entries that are displayed or printed.

The possible values are:

*ALL: All request types are included.

*MSG: Only requests where the requester specified *MSG for "Type of data" are included.

*CVRLTR: Only requests where the requester specified *CVRLTR for "Type of data" are included.

*DATA: Only requests where the requester specified *DATA for "Type of data" are included.

*RETRY: Only retries of previously interrupted requests are included.

Command that generated request

Indicates that requests initiated by a particular command are displayed or printed.

The possible values are:

*ALL: Requests initiated by all RSF commands are included.

name: Only requests generated by the command you specify are included.

Error message ID

Indicates which error message IDs should be included in the entries that are displayed or printed.

The possible values are:

*ALL: All error message IDs, including blank, are included.

*BLANK: Only transactions that ended successfully are included.

*NONBLANK: Only transactions that ended in error are included.

message-ID: Enter a generic message ID specification. Case is significant. An asterisk (*) in the specification will match any string of zero or more characters in the name. An underscore (_) in the specification will match any single character in the name.

Output

Indicates whether the list should be displayed or printed.

The possible values are:

*: Display the list.

*PRINT: Print the list.

Detail

Controls the amount of detail shown when printing the list.

The possible values are:

*BASIC: A subset of the total information is shown for each log entry. Multiple log entries are printed per page.

*FULL: All information is shown for each log entry. One log entry is printed per page.

The display that is presented when you specify OUTPUT(*) on the WRKRSFLOG command is shown below.

The following function keys may be used with this display:

F3: Exit without updating.

F5: Refresh the display.

F12: Cancel.

F21: Present a system command line window.

The fields on the Work with RSF Log display are explained below.

Opt

Enter an option number in the "Opt" column beside a list entry, and press Enter to perform a function on the list entry. You may enter options beside several list entries before pressing Enter. The options for the list entries are processed in turn when you press Enter. The following is a list of options and their functions.

4=Delete: A display is presented allowing you to confirm your choices for delete. When you press Enter a second time, the entries are deleted.

5=Display: Detailed information about the entry is displayed.

8=Error message: Display the text for the error message associated with the log entry.

12=Work with job: Work with the job that generated the log entry.

Package

The name of the RSF package that the log entry pertains to is shown.

Serial #

The serial number of the requesting machine.

Start Date

The date the transaction started.

Start Time

The time the transaction started.

End Time

The time the transaction ended.

Error Message ID

This column indicates whether the transaction ended in error. If this column is blank, the transaction ended normally. Otherwise, the column contains the message ID for the error message that caused the transaction to end in error. The text for all RSF messages can be found in message file RSFMSG in library RSF. To display a message description, key 8 beside the entry and press Enter.

Related Commands:

For more information about the following command, prompt the command and press F1 to view the on-line help text:

Purge RSF Log (PRGRSFLOG)

 


Working With Client Rights

The Work With RSF Requesters (WRKRSFRQS) command is used to work with a list of RSF requesters, or to print a list of RSF requesters.

The entries in the requester directory on your machine determine the rights and restrictions that apply to client machines that contact your machine.

While working with requesters, you can easily add, remove, change, copy, and rename requester directory entries. See Adding Requester Directory Entries for more information.

The prompted version of the WRKRSFRQS command is shown below.

The parameters for the WRKRSFRQS command are described below in the order that they appear on the command prompt.

Requester

Indicate which entries to include in the list.

The possible values are:

*ALL: No entries are excluded based on name.

generic-name: Enter a generic name for the entries to be included in the list. Case is significant. An asterisk (*) in the generic specification will match any string of zero or more characters in the name. An underscore (_) in the generic specification will match any single character in the name.

Text Compare String

Enter characters to compare to entry text to determine which entries should be included in the list. An entry is included in the list if the entry text contains the string specified. Case is not significant.

The possible values are:

*ALL: No entries are excluded based on text.

string: Enter any text string of up to 50 characters.

Output

Indicates whether the list should be displayed or printed.

The possible values are:

*: Display the list.

*PRINT: Print the list.

Detail

Controls the amount of detail shown when printing the list.

The possible values are:

*BASIC: A subset of the total information is shown for each directory entry. Multiple entries are printed per page.

*FULL: All information is shown for each directory entry. One entry is printed per page.

The display that is presented when you specify OUTPUT(*) on the WRKRSFRQS command is shown below.

The following function keys may be used with this display:

F3: Exit without updating.

F5: Refresh the display.

F6: Add a new requester directory entry.

F12: Cancel.

F21: Present a system command line window.

The fields on the Work With RSF Requesters display are explained below.

Position to

Enter a value in the "Position to" field and press Enter to position the list to a specific entry. The cursor is positioned to the first entry in the list that is greater than or equal to the "Position to" value you specify.

Opt

Enter an option number in the "Opt" column beside a list entry, and press Enter to perform a function on the list entry. You may enter options beside several list entries before pressing Enter. The options for the list entries are processed in turn when you press Enter. The following is a list of options and their functions.

2=Change: The CHGRSFRDE command prompt is displayed with the current values for the entry filled in.

3=Copy: A display is presented with which you specify the new names for entries to be copied.

4=Delete: A display is presented allowing you to confirm your choices for delete. When you press Enter a second time, the entries are deleted.

5=Display: Detailed information about the entry is displayed.

7=Rename: A display is presented with which you specify new names for the entries to be renamed.

user-defined-option: You may key a user-defined option. To define new options, select option 9 from the Start PDM (STRPDM) menu.

See the on-line help text for this display for more information about user-defined options.

Requester

The unique requester ID is shown in this column.

Serial #

The serial number associated with the requester is shown in this column.

Text

Text describing the requester is shown. Type over the text and press Enter to change the text.

Related Commands:

The following command is discussed elsewhere in this manual:

Add Requester Directory Entry (ADDRSFRDE)

For more information about the following commands, prompt the command and press F1 to view the on-line help text:

Change Requester Directory Entry (CHGRSFRDE)

Remove Requester Directory Entry (RMVRSFRDE)

Rename Requester Directory Entry (RNMRSFRDE)

 


Requester Directory Entries

The Add Requester Directory Entry (ADDRSFRDE) command is used to add entries to the requester directory on your machine.

The entries in the requester directory determine the rights and restrictions that apply to client machines that contact your machine.

The prompted version of the ADDRSFRDE command is shown below. Click on the image to see command parameter descriptions.

CommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentCommentComment

CommentCommentCommentCommentCommentComment

CommentComment

The parameters for the ADDRSFRDE command are described below in the order that they appear on the command prompt. Default values are underlined.

Requester ID

The name of the requester directory entry to be added. This must be unique within the directory. This is a required parameter.

The possible values are:

name: Enter a valid system name for the new directory entry.

Requester's serial number

The serial number of the requester machine. This must be unique within the directory. This is a required parameter.

The possible values are:

serial number: Enter the requester's machine serial number. The value you enter is stored left adjusted with imbedded blanks removed.

*ANY: This entry applies to any requester that does not have a specific entry for their serial number in the directory.

*NONE: No serial number is specified. This directory entry is only referred to if it is specified on the "Special *CURRENT authority" (CURAUT) parameter of another requester directory entry.

Save file to receive data

The qualified name of a save file to receive packages sent to your machine by this requester. If the save file you specify does not exist, it will be created. If you name an existing save file, be sure that user profile RSFSRV is authorized to the save file. See Security Considerations For RSF Servers for more information about save file authorities.

The possible values are:

*PKG: The name of the package sent by the requester is used for the save file name.

*GEN: A unique name is generated by Remote Software Facility each time a package is sent to your machine by this requester.

name: Enter the name of a save file. If the save file does not exist at the time a request is received, it will be created.

The possible library values are:

QGPL: The save file is located in library QGPL.

*CURLIB: The current library is used to locate the save file.

library name: Enter the name of an existing library which contains, or will contain the save file.

Replace existing save file

Indicate whether an existing save file should be replaced.

The possible values are:

*YES: An existing save file with the name specified is replaced when a package is received.

*NO: The request will end in error if the specified save file exists when the package is received.

Save file authority

Public authority assigned to save files created to receive packages from this requester.

The possible values are:

*USE: All users can read the save files.

*EXCLUDE: All users are excluded from reading or updating the save files.

*ALL: All users have all rights to the save files.

*CHANGE: All users can read and update the save files.

Receive data from requester

Indicate whether you are willing to receive packages and data sent to your machine by the requester.

The possible values are:

*YES: RSF data sent to your machine by this requester will be received.

*NO: The requester will receive an error message if they attempt to send objects to your machine.

Allow pass-through

Indicate whether you want to allow the requester machine to pass-through to your machine.

The possible values are:

*YES: Interactive users at the requester machine can pass-through to your machine with the STRPASRSF command. The requester will be presented with a sign-on display for your machine.

*NO: The requester will receive an error message if they attempt to pass through to your machine.

Allow call-back

Indicate whether you are willing to call the requester machine back.

*NO: The requester will receive an error message if they specify a value other than *NONE for "Call-back phone number" on one of the RSF commands.

*YES: If the requester specifies a value other than *NONE for "Call-back phone number" on one of the RSF. commands, your machine will call the requester machine back at the phone number provided in order to complete the transaction.

Allow remote program calls

Indicate whether you are willing allow the requester to call programs on your machine with the RSFLINK API. See Chapter 9, Calling Remote Programs, for more information about RSFLINK.

The possible values are:

*PARTIAL: The requester is allowed to call any program that does not begin with the letter "Q".

*YES: The requester is allowed to call any program on your machine to which they are authorized.

*NO: All attempts by this requester to call programs on your machine will be rejected.

Allow generic object retrieval

Indicate whether you are willing allow the requester to retrieve generic objects and libraries from your machine with the commands in library RSFTOOLS and RSF Express. See Appendix B for more information about RSFTOOLS. See chapter 10 for more information about RSF Express.

The possible values are:

*YES: Generic object retrieval is allowed.

*NO: Generic object retrieval is not allowed.

Allow spooled file retrieval

Indicate whether you are willing allow the requester to retrieve spooled files from your machine with the RTVSPLFRSF command. See the on-line help text for the Retrieve Spooled File (RTVSPLFRSF) command for more information.

The possible values are:

*YES: Spooled file retrieval is allowed.

*NO: Spooled file retrieval is not allowed.

Allow remote file copy

Indicate whether you are willing allow the requester to copy data base file members from and to your machine. See Remote File Copy for more information.

The possible values are:

*YES: Remote file copy is allowed. The requesters authority to individual files is checked with each copy request.

*NO: Remote file copy is not allowed.

Minimum encryption required

Specify the minimum level of encryption you will allow a client to use when connecting via TCP/IP. If a client attempts to connect via TCP/IP with a less secure encryption level than required, the connection is rejected.

Clients specify the encryption level they are using by setting the ENCRYPT parameter of the server directory entry being referenced. See Adding Server Directory Entries for more information.

The possible values are:

*NONE: No minimum encryption level is required.

*BASIC: The client must connect using either *BASIC or *SSL encryption.

*SSL: The client must connect using *SSL encryption.

Hang up after each request

Indicate whether you are willing to let the requester perform multiple transactions per phone call.

The possible values are:

*YES: The line is disconnected after each transaction, regardless of what the requester specifies for the HANGUP parameter on any of the RSF commands.

*NO: The requester controls when the line is disconnected by the value they specify for the HANGUP parameter. The line is not disconnected at the end of a request if the requester specifies HANGUP(*NO). Otherwise, the line is disconnected.

Special *CURRENT authority

Specify the name of a different requester directory entry to use to check authority for this requester when the requester contacts your machine using *CURRENT for the server ID.

*CURRENT can only be used to contact your machine from a target RSF pass-through session or a program running in another target RSF job.

This parameter allows you to grant the requester machine different access rights to your machine when the job running on the requester machine is itself an RSF server job that was started by a request from your own machine.

For example: Assume requester ABC is allowed to contact your machine but is not allowed to retrieve generic objects or copy remote files. However, you would like to be able to pass-through to ABC and to execute commands in the target pass-through job to retrieve objects and copy files from your own machine. Commands executed in the target RSF pass-through job use *CURRENT for Server ID to refer back to your machine. Therefore, using the CURAUT parameter on this command, you can set up a different set of rights for yourself as a target pass-through user on system ABC, while still restricting access to your machine by other users on ABC.

The possible values are:

*NONE: No special *CURRENT rights are defined. Requests directed to your machine from this requester using *CURRENT for server ID are governed by the rights and restrictions defined in this requester directory entry.

requester-ID: Enter the name of a different requester ID to use to check authority for requests directed to your machine from this requester using *CURRENT for server ID. The requester ID specified does not need to exist at the time this commend is executed. However, if the requester ID cannot be found at run time, a value of *NONE for this parameter is assumed.

Associated Server ID

Specify the name of a server ID to associate with this requester entry. When your machine is contacted using this requester entry, the associated server entry indicates the server ID on your machine that could be used to initiate a request in the opposite direction. 

Associating a server entry with a requester entry can be important if the default RSFSRV profile or password is not used to connect to the server machine, and you want to allow requests to server *CURRENT to be initiated on your machine. Requests directed to server *CURRENT (for SDLC connections) will get profile and password information from the server entry associated with this requester entry. If no server entry is specified, the default profile and password are used. 

The possible values are:

*NONE: No server entry is associated with this requester entry.

server-ID: Enter the name of an existing server ID to associate with this requester. 

Text 'description'

A free-form description of the requester directory entry.

The possible values are:

characters: Enter up to 50 characters of information describing the requester directory entry.

Post-Processing program

The qualified name of a user program to call to process RSF data sent to your machine by this requester with the SNDRSFPKG command. If specified, this program is called after all of the data associated with the package has been received, and only if the data is received successfully. This program can be used to restore objects to the server machine from the save file sent for the package. See Post-Processing Programs for more information.

This value can be overridden by requesters using the RCVPGM parameter of the Send RSF Package (SNDRSFPKG) command if the requester is authorized to remote program calls on your machine. See the "Allow remote program calls" parameter above for more information about authorizing requesters to call programs on your machine. See Sending RSF Packages for more information about the SNDRSFPKG command.

The possible values are:

*SYSVAL: The value specified for installation defaults is used. You can view or change the installation defaults with the CHGRSFDFT command.

*NONE: No program is called when an RSF package is received.

program name: The name of a program to call when an RSF package sent to your machine by this requester with the SNDRSFPKG command is received.

The possible library values are:

*LIBL: The job library list is used to locate the program.

*CURLIB: The current library is used to locate the program.

library name: The name of an existing library which contains the specified program.

End session after data received

Specify whether the communications session with the requester should be ended before any post-processing program is called.

The possible values are:

*NO: If the directory entry specifies that a post-processing program be called to process the received RSF data, and if the requester has specified *NO for the DROP parameter on the SNDRSFPKG command, the session remains active while the post-processing program executes. Status messages reporting the progress of the post-processing program are returned to the requester.

*YES: The session with the requester is ended after the package has been received. If the directory entry specifies that a post-processing program be called, the session is ended before the program is called. The post-processing program is executed asynchronously.

MSGQ for normal transactions

The qualified name of a message queue to receive normal transaction messages. If specified, information and completion messages generated during a successful request from this requester are sent to the message queue.

The possible values are:

*SYSVAL: The value specified for installation defaults is used. You can view or change the installation defaults with the CHGRSFDFT command.

*NONE: Information and completion messages generated from successful transactions are not sent.

name: The name of a message queue to which information and completion messages generated from successful transactions are sent.

The possible library values are:

*LIBL: The job library list is used to locate the message queue.

*CURLIB: The current library is used to locate the message queue.

library name: The name of an existing library which contains the specified message queue.

MSGQ for abnormal transactions

The qualified name of a message queue to receive abnormal transaction messages. If specified, error messages generated during an unsuccessful request from this requester are sent to the message queue.

The possible values are:

*SYSVAL: The value specified for installation defaults is used. You can view or change the installation defaults with the CHGRSFDFT command.

*NONE: Error messages generated from unsuccessful transactions are not sent. Error message IDs will still appear in the RSF log.

name: The name of a message queue to which error messages generated from unsuccessful transactions are sent.

The possible library values are:

*LIBL: The job library list is used to locate the message queue.

*CURLIB: The current library is used to locate the message queue.

library name: The name of an existing library which contains the specified message queue.

MSGQ for requester messages

The qualified name of a message queue to receive ad hoc requester messages. If specified, ad hoc messages sent by this requester using the MSG parameter on one of the RSF commands that initiates a request are sent to the message queue.

The possible values are:

*SYSVAL: The value specified for installation defaults is used. You can view or change the installation defaults with the CHGRSFDFT command.

*NONE: Ad hoc requester messages are not sent. The messages are still logged in the RSF log and can be viewed with the WRKRSFLOG command.

name: The name of a message queue to which ad hoc requester messages are sent.

The possible library values are:

*LIBL: The job library list is used to locate the message queue.

*CURLIB: The current library is used to locate the message queue.

library name: The name of an existing library which contains the specified message queue.

Output queue

The qualified name of an output queue to receive cover letters and spooled files sent by the requester.

The possible values are:

QPRINT: Spooled files are placed on output queue QPRINT.

*JOB: The job default output queue is used.

name: The name of an output queue to which spooled files and cover letters sent.

The possible library values are:

*LIBL: The job library list is used to locate the output queue.

*CURLIB: The current library is used to locate the output queue.

library name: The name of an existing library which contains the specified output queue.

Max spooled file pages allowed

The maximum number of spooled file pages and cover letter records that you will receive from this requester, per request. An attempt by the requester to send more spooled file pages or cover letter records than the maximum allowed will cause the request to end in error.

The possible values are:

*SYSVAL: The value specified for installation defaults is used. You can view or change the installation defaults with the CHGRSFDFT command.

*NOMAX: There is no limit to the number of spooled file pages or cover letter records that will be received.

1-9999997: The maximum number of spooled file pages and cover letter records that you will receive from the requester, per request.

Max save file records allowed

The maximum number of save file records that you will receive from this requester, per request. An attempt by the requester to send more save file records than the maximum allowed will cause the request to end in error.

The possible values are:

*SYSVAL: The value specified for installation defaults is used. You can view or change the installation defaults with the CHGRSFDFT command.

*NOMAX: There is no limit to the number of save file records that will be received.

1-9999997: The maximum number of save file records that you will receive from the requester, per request.

Related Commands:

The following command is discussed elsewhere in this manual:

Work With Requesters (WRKRSFRQS)

For more information about the following commands, prompt the command and press F1 to view the on-line help text:

Change Requester Directory Entry (CHGRSFRDE)

Remove Requester Directory Entry (RMVRSFRDE)

Rename Requester Directory Entry (RNMRSFRDE)

 


Manually Calling Back a Requester Machine

The Call Back Using RSF (CALBCKRSF) command is used to manually call back a requester machine. The SDLC server function must be active on your machine to execute this command. See Starting The Server Function for more information about starting the RSF server function.

Manual call-back is needed if the server line into your AS/400 is not answered directly by the AS/400 but is answered first by a receptionist. In this case, the remote requester site must set up their machine to receive a call-back from your machine by specifying *MANUAL for "Call-back phone number" on one of the RSF commands that initiates a request. Next, the requester site must contact the server location by voice and request a call back. Finally, this command is used at the server site to complete the call-back request.

This command is only used to execute manual call-back requests where the line into your machine is not answered exclusively by the machine. If your machine does have a dedicated line which only the machine answers, then the call-back request can be handled automatically by the RSF software. In this case, the user on the requester machine should specify some value other than *MANUAL for "Call-back phone number" when initiating the request.

The prompted version of the CALBCKRSF command is shown below.

The parameters for the CALBCKRSF command are described below.

Call-back phone number

Enter up to 32 characters for the callback phone number. The number should include all digits necessary to dial the requester machine, including a leading 1 plus area code, and leading 9 for accessing an outside line where necessary.

The possible values are:

phone-number: Enter the phone number to dial to call back the requester machine.

 


Single-System Test Mode

It is useful to be able to test various RSF functions on a single machine, without involving external communications or additional AS/400s. For this reason, Remote Software Facility provides a single-system test mode.

You may wish, for example, to test retrieving RSF packages on your machine before making them generally available to others. Testing package retrieval is especially helpful if you are associating pre-processing programs with your RSF packages.

The configuration objects needed for single system testing were created for you automatically if you followed the recommended installation procedure for this release of RSF.

The following objects are required for SDLC loop-back testing:

The following objects are required for TCP/IP loop-back testing:

If any of the objects listed above have not been created on your machine, you can force them to be created by running the following command:

INZRSF

To use single system test to direct an RSF request back to your own machine:

    1. Make sure the server function has been started. See Starting the Server Function for more information.
       
    2. Specify LOCAL or LOOPBACK for the "Server ID" parameter on any of the RSF commands that initiate a request. The request will be directed back to your own machine.

Security Considerations

In order to start the server function on your machine, user profile RSFSRV must exist. If you followed the recommended installation procedure, this profile has already been created for you See Creating User Profile RSFSRV for more information.

 

User Profile RSFSRV

The target APPC job that is evoked on the server machine to handle incoming RSF requests runs under the RSFSRV profile, as do client TCP/IP jobs. Therefore, you control which objects on your system may be accessed by the RSF server job by granting or revoking object authorities for user profile RSFSRV. This has several implications:

    1. If you create a save file that is meant to be associated with an RSF package on your machine, you should make sure that user profile RSFSRV is authorized to the file. The default on the Create Save File (CRTSAVF) command is to exclude *PUBLIC from access to the file. User profile RSFSRV requires a minimum authority of *USE for save files.
       
    2. If you have sensitive objects on your machine and you want to ensure that these objects cannot be accessed by Remote Software Facility, you should ensure that user profile RSFSRV is not authorized to the objects. To accomplish this, you can check to be sure that RSFSRV and *PUBLIC are not authorized to the objects, or you can explicitly exclude RSFSRV from the objects.
       
    3. Remote Software Facility server communications programs only accesses objects in library RSF, as well as save files and user programs that you specify. Therefore, the RSF software itself provides a layer of functional security when it is evoked normally by RSF clients.

      However a remote user could attempt to write their own APPC or sockets programs which might try to evoke an arbitrary program on your machine under user profile RSFSRV.  Again, your best protection is to control the programs, and other objects that user profile RSFSRV is authorized to access.
       
    4. Only valid RSF server jobs can be started by connecting to the RSF TCP/IP monitor job. All attempts to invoke arbitrary, non-RSF programs through this monitor job are rejected. In addition, the RSF TCP/IP monitor does not require that any other TCP/IP applications be running. So, you can end the ftp, http (web) and other TCP/IP server applications and still use RSF as long as the RSF TCP/IP server is running.
       
    5. If you want Remote Software Facility server jobs to be able to access certain objects on your machine, but you would like to ensure that these objects can only be accessed in the context of a bona fide RSF request, the preferred method of granting access to the objects is with program adopted authority. Rather than granting user profile RSFSRV authority to the objects, create a user pre-processing program that adopts the necessary authority to access the objects. See Pre-Processing Programs for more information.
       
    6. When user profile RSFSRV is created as specified Chapter 3, it has a password that is the same as the user profile name. Knowing the profile name and the password does not allow an interactive user to sign on to your machine as RSFSRV however, because the profile is created specifying *NONE for "Initial program to call", and *SIGNOFF for "Initial menu". The profile is only useful for communications jobs.

      For added security, you can change the password associated with profile RSFSRV.  If this is done, however, you must make the password known to RSF clients and they must specify the correct profile and password for the "Remote signon" parameter on the server directory entry that refers to your machine.  See Server Directory Entries for more information.

 

Remote Program Calls

You control whether remote requesters are allowed to call programs on your machine by manipulating requester directory entries. See Adding Requester Directory Entries for more information.

When remote requesters use the RSFLINK API to call programs on your machine, the object authorities that are in effect are determined by the user profile under which the request is executed. By default, RSFLINK requests run under user profile RSFSRV on the server machine. The requester can specify a different profile by specifying a valid user ID and password for the request. See Calling Remote Programs for more information about the RSFLINK API.

 

Pass Through

Remote Software Facility supports automatic pass-through with the Start Pass Through Using RSF (STRPASRSF) command. When requesters use the STRPASRSF command over an SDLC connection, they will be allowed to pass-through to your machine and be presented with a sign-on display only if you have added an entry to the requester directory on your machine, which explicitly allows pass-through for the requester.

Take the following steps if you want to insure that remote users can not bypass RSF checking and use the IBM command STRPASTHR to directly pass-through to your machine:

  1. Use the CHGSYSVAL command to change the system value for automatic configuration of virtual devices (QAUTOVRT) to 0.
     
  2. Use the delete device description (DLTDEVD) command to delete all of the devices attached to virtual workstation controller QPACTL01. This insures that the only devices that can be used for pass-through are those created automatically by RSF and those created explicitly by a user on your machine.

Note: For TCP/IP connections, RSF uses Telnet to implement display station pass-through. In order for Telnet to work correctly, system value QSUTOVRT must have a value greater than zero and the Telnet server must be started.

 

DDM

Whenever two AS/400s are linked together with SDLC/APPC communications, it may be possible to perform file manipulations and execute commands on the remote machine using Distributed Data Management (DDM). In such a situation, a knowledgeable user could try to use DDM to circumvent RSF security checking and gain direct access to objects on the remote machine.

You can protect your machine from unwarranted DDM requests by creating a DDM access checking program and using the Change Network Attributes (CHGNETA) command to activate the program.

DDM access programs are discussed in the OS/400 DDM Guide.

If you plan to use the Copy File Using RSF (CPYFRSF) command, some DDM access to your machine is required.

A model DDM access program is provided in library RSFTOOLS. The program name is DDMACC. When activated, this program will prohibit all but legitimate RSF DDM access. See Appendix B for more information about RSFTOOLS.

The source for program DDMACC can be found in file RSFTOOLS/QCLSRC. To activate program DDMACC, key the following command:

CHGNETA DDMACC(RSFTOOLS/DDMACC)

 


Performance Considerations

  1. By making changes to subsystem description RSF in library RSF--or to whichever subsystem description you will be using to run RSF server jobs--you can fine tune the way RSF runs SDLC requests.

    As shipped, subsystem RSF has three memory pools defined, numbered 1 through 3. Each of the numbered pools points to *BASE.

    Subsystem RSF also has two routing entries defined. Sequence number 300 is for target APPC jobs. This routing entry uses subsystem memory pool 2. Sequence number 9999 is for the interactive jobs associated with RSF pass through sessions and RSF Express. This routing entry uses subsystem memory pool 3.

    You can improve RSF SDLC performance by assigning a pool other than *BASE to RSF subsystem pools 2 and 3. RSF subsystem pool 1 should always point to *BASE.

    Use the OS/400 Change Subsystem Description (CHGSBSD) command to assign RSF subsystem pool 2 (for APPC batch jobs) to a memory pool other than *BASE. Specify RSF/RSF for "Subsystem description". Specify 2 for "Pool identifier". Specify a shared pool, or specify a numeric value for "Storage size" and "Activity level".

    Use the CHGSBSD command to assign RSF subsystem pool 3 (for interactive jobs) to a memory pool other than *BASE. Specify RSF/RSF for "Subsystem description". Specify 3 for "Pool identifier". Specify a shared pool, or specify a numeric value for "Storage size" and "Activity level".

    See the OS/400 Work Management Guide for more information about subsystems, memory pools and basic system tuning.
     
  2. When connecting via TCP/IP, job descriptions RSFTCP and RSFTCP2 are used to submit RSF monitor and server jobs. You can control the run priority and other attributes of RSF TCP/IP jobs by changing these job descriptions.