SSHD with CO:z SFTP and SCEERUN2 when LNKAUTH=APFTAB

[DClassic53]

I've been working on migrating from LNKAUTH=LNKLST to LNKAUTH=APFTAB on one of my standalone LPARs and was getting failures when starting up SSHD:

IEA995I SYMPTOM DUMP OUTPUT 498
USER COMPLETION CODE=4093 REASON CODE=000003EB
TIME=14.30.07 SEQ=00020 CPU=0000 ASID=0040
PSW AT TIME OF ERROR 078D1000 800088E6 ILC 2 INTC 0D
ACTIVE LOAD MODULE ADDRESS=00007000 OFFSET=000018E6
NAME=CEEBINIT
DATA AT PSW 000088E0 - 00181610 0A0DA7F4 001C1811

Problem was finally resolved when I added SCEERUN2 to the APF table (it was already in LNKLST). In reviewing my IBM doc on z/OS 2.1 and Ported Tools as well as what I see in Dovetail's doc, I have not seen where SCEERUN2 needs to be APF, but it solved my problem.

Are my poor old eyes missing some doc? Or is this possibly something introduced via IBM maintenance that I missed in a HOLDSYSTEM REASON(DOC)?

[dovetail]

Sorry, but I haven't seen this before.
Since this is purely an IBM OpenSSH problem, best to open a PMR to IBM for clarification. Please post a answer if you find out.

[DClassic53]

I did open an SR with IBM and received the following response:

Greetings David,
It appears the requirement comes indirectly from LE services. In the LE Vendor Interfaces under the section "Creating Preinitialized Environments for Authorized Programs", it indicates:

• Define SCEERUN2 and SCEERUN to be APF-authorized, and place them in the application's TASKLIB or STEPLIB/JOBLIB concatenation.

SSHD is a Authorized program and would then require the SCEERUN and SCEERUN2 libraries to be APF authorized. However, we do not echo that little tidbit in our documentation. I am bringing this to the attention of our documentation folks. In short, SCEERUN2 (and SCEERUN) should be APF authorized.

So now you know what I know!

[dovetail]

This is very curious. SSHD has always been APF authorized, so the SCEERUN2 DLL (which is the XPLINK C runtime library) would have always needed to be APF authorized.

The answer from IBM doesn't really tell us why what you did caused SCEERUN2 *not* to be APF authorized.

[DClassic53]

In my shop things were good because it was always APF authorized (when SCEERUN2 was in LNKLST and we had LNKAUTH=LNKLST in IEASYSxx.) The problem we encountered did not occur until we changed to LNKAUTH=APFTAB and SCEERUN2 was not in our PROGxx member for APF list. Once we updated the PROGxx for APF to include SCEERUN2 things got back to normal.

[dovetail]

I see. Thanks for clarifying.