SETROPTS administration
The following tables define SETROPTS field names and their usage. All field names relate directly to SETROPTS keywords. Although the fields are alphabetized in the following table, there is no defined order in which the fields are returned when using the extract function. See z/OS Security Server RACF Command Language Reference for questions pertaining to field usage and data. Note that within the command image generated internally, RACF® truncates long keywords to 12 characters.
Boolean fields are identified in the field name column. Unless otherwise noted, a field is a character field by default.
When SETROPTS extract returns the fields which contain a list of classes (CLASSACT, CLASSTAT, GENCMD, GENERIC, GENLIST, GLOBAL, RACLIST, AUDIT, LOGALWYS, LOGNEVER, LOGSUCC, LOGFAIL, AND LOGDEFLT), each class name (including the final one) will be padded with blanks to eight characters, and followed by a single blank. Therefore, you can determine the number of classes by dividing the total field length by nine.
| Field name | Flag byte value | SETROPTS keyword reference |
|---|---|---|
| ADDCREAT (boolean) | 'Y' | ADDCREATOR |
| 'N' | NOADDCREATOR | |
| ADSP (boolean) | 'Y' | ADSP |
| 'N' | NOADSP | |
| APPLAUDT (boolean) | 'Y' | APPLAUDIT |
| 'N' | NOAPPLAUDIT | |
| AUDIT | 'A' | AUDIT (xx ...) |
| 'D' | NOAUDIT (xx ...) | |
| CATDSNS | 'Y' | CATDSNS ( xx ) |
| 'N' | NOCATDSNS | |
| CLASSACT | 'A' | CLASSACT (xx ...) |
| 'D' | NOCLASSACT (xx ...) | |
| CLASSTAT | 'A' | STATISTICS (xx ...) |
| 'D' | NOSTATISTICS (xx ...) | |
| CMDVIOL (boolean) | 'Y' | CMDVIOL |
| 'N' | NOCMDVIOL | |
| COMPMODE (boolean) | 'Y' | COMPATMODE |
| 'N' | NOCOMPATMODE | |
| EGN (boolean) | 'Y' | EGN |
| 'N' | NOEGN | |
| ERASE (boolean) | 'Y' | ERASE |
| 'N' | NOERASE | |
| ERASEALL (boolean) | 'Y' | ERASE (ALL) |
| ERASESEC | 'Y' | ERASE (SECLEVEL ( xx ) ) |
| 'N' | ERASE (NOSECLEVEL) | |
| GENCMD | 'A' | GENCMD (xx ...) |
| 'D' | NOGENCMD (xx ...) | |
| GENERIC | 'A' | GENERIC (xx ...) |
| 'D' | NOGENERIC (xx ...) | |
| GENLIST | 'A' | GENLIST (xx ...) |
| 'D' | NOGENLIST (xx ...) | |
| GENOWNER (boolean) | 'Y' | GENERICOWNER |
| 'N' | NOGENERICOWNER | |
| GLOBAL | 'A' | GLOBAL (xx ...) |
| 'D' | NOGLOBAL (xx ...) | |
| GRPLIST (boolean) | 'Y' | GRPLIST |
| 'N' | NOGRPLIST | |
| HISTORY | 'Y' | PASSWORD (HISTORY ( xx )) |
| 'N' | PASSWORD (NOHISTORY) | |
| INACTIVE | 'Y' | INACTIVE (xx) |
| 'N' | NOINACTIVE (xx) | |
| INITSTAT (boolean) | 'Y' | INITSTATS |
| 'N' | NOINITSTATS | |
| INTERVAL | 'Y' | PASSWORD (INTERVAL ( xx )) |
| JESBATCH (boolean) | 'Y' | JES (BATCHALLRACF) |
| 'N' | JES (NOBATCHALLRACF) | |
| JESEARLY (boolean) | 'Y' | JES (EARLYVERIFY) |
| 'N' | JES (NOEARLYVERIFY) | |
 NOTE: Early
verification is always done, even if the SETROPTS command has been issued with JES(NOEARLYVERIFY)
specified. See the z/OS Security Server RACF Security Administrator's Guide: JES user ID early verification in z/OS Security Server RACF Security Administrator's Guide. |
||
| JESNJE | 'Y' | JES (NJEUSERID( xx ) ) |
| JESUNDEF | 'Y' | JES (UNDEFINEDUSER( xx ) ) |
| JESXBM (boolean) | 'Y' | JES (XBMALLRACF) |
| 'N' | JES (NOXBMALLRACF) | |
| KERBLVL | 'Y' | KERBLVL(xx) |
| LIST (boolean) | 'Y' | LIST |
| NOTE: The LIST field is not returned by ADMN_UNL_SETR or ADMN_XTR_SETR. | ||
| LOGALWYS | 'Y' | LOGOPTIONS (ALWAYS (xx ...)) |
| LOGDEFLT | 'Y' | LOGOPTIONS (DEFAULT (xx ...)) |
| LOGFAIL | 'Y' | LOGOPTIONS (FAILURES (xx ...)) |
| LOGNEVER | 'Y' | LOGOPTIONS (NEVER (xx ...)) |
| LOGSUCC | 'Y' | LOGOPTIONS (SUCCESSES (xx ...)) |
| MINCHANG | 'Y' | PASSWORD (MINCHANG(xx)) |
| MIXDCASE (boolean) | 'Y' | PASSWORD (MIXEDCASE) |
| 'N' | PASSWORD (NOMIXEDCASE) | |
| MLACTIVE | 'Y' | MLACTIVE ( xx ) |
| 'N' | NOMLACTIVE | |
| MLFS | 'Y' | MLFSOBJ(xx) |
| MLIPC | 'Y' | MLIPCOBJ(xx) |
| MLNAMES (boolean) | 'Y' | MLNAMES |
| 'N' | NOMLNAMES | |
| MLQUIET (boolean) | 'Y' | MLQUIET |
| 'N' | NOMLQUIET | |
| MLS | 'Y' | MLS ( xx ) |
| 'N' | NOMLS | |
| MLSTABLE (boolean) | 'Y' | MLSTABLE |
| 'N' | NOMLSTABLE | |
| MODEL (boolean) | 'N' | NOMODEL |
| MODGDG (boolean) | 'Y' | MODEL (GDG) |
| 'N' | MODEL (NOGDG) | |
| MODGROUP (boolean) | 'Y' | MODEL (GROUP) |
| 'N' | MODEL (NOGROUP) | |
| MODUSER (boolean) | 'Y' | MODEL (USER) |
| 'N' | MODEL (NOUSER) | |
| OPERAUDT (boolean) | 'Y' | OPERAUDT |
| 'N' | NOOPERAUDT | |
| PHRINT |
'Y' |
PASSWORD (PHRASEINT(xx)) |
| PREFIX | 'Y' | PREFIX ( xx ) |
| 'N' | NOPREFIX | |
| PRIMLANG | 'Y' | LANGUAGE (PRIMARY ( xx ) ) |
| PROTALL | 'Y' | PROTECTALL ( xx ) |
| 'N' | NOPROTECTALL | |
| PWDALG | 'Y' | PASSWORD (ALGORITHM ( xx )) |
| 'N' | PASSWORD (NOALGORITHM) | |
| PWDSPEC (boolean) | 'Y' | PASSWORD (SPECIALCHARS) |
| 'N' | PASSWORD (NOSPECIALCHARS) | |
| RACLIST | 'A' | RACLIST (xx ...) |
| 'D' | NORACLIST (xx ...) | |
| REALDSN (boolean) | 'Y' | REALDSN |
| 'N' | NOREALDSN | |
| REFRESH (boolean) | 'Y' | REFRESH |
| NOTE: The REFRESH field is not returned by ADMN_UNL_SETR or ADMN_XTR_SETR. | ||
| RETPD | 'Y' | RETPD ( xx ) |
| REVOKE | 'Y' | PASSWORD (REVOKE ( xx )) |
| 'N' | PASSWORD (NOREVOKE) | |
| RULES (boolean) | 'N' | PASSWORD (NORULES) |
| NOTE: Specifying RULES with the 'N' flag results in the cancellation of all password syntax rules, regardless of any RULEn fields also specified. | ||
| RULE1 | 'Y' | PASSWORD (RULE1 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE1) | |
| RULE2 | 'Y' | PASSWORD (RULE2 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE2) | |
| RULE3 | 'Y' | PASSWORD (RULE3 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE3) | |
| RULE4 | 'Y' | PASSWORD (RULE4 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE4) | |
| RULE5 | 'Y' | PASSWORD (RULE5 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE5) | |
| RULE6 | 'Y' | PASSWORD (RULE6 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE6) | |
| RULE7 | 'Y' | PASSWORD (RULE7 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE7) | |
| RULE8 | 'Y' | PASSWORD (RULE8 (LENGTH (m1:m2) content-keyword (position))) |
| 'N' | PASSWORD (NORULE8) | |
NOTE: When specifying the 'Y' flag,
the date supplied in the RULEn field consists of a length field and a character sequence, separated
by a blank. The length field can be either a single numeric value, or two numeric values separated
by a colon (:) to denote a minimum and maximum length. The character sequence conforms to the format
of the output of the SETROPTS LIST command. It is a string of 1 to 8 characters, where each position
of the string contains a character that indicates the valid characters that can occupy that
position:
For example, if the RULE1 field is specified with field data of "3:6 A*NV*A", the resulting SETROPTS PASSWORD keyword would be RULE1(LENGTH(3:6) ALPHA(1 6) NUMERIC(3) VOWEL(4)). See the z/OS Security Server RACF Command Language Reference for details on SETROPTS. |
||
| RVARSWPW | 'Y' | RVARY ( SWITCH ( xx )) |
| NOTE: For ADMN_XTR_SETR, the value returned for this field is not the actual password, but one of two predefined values. A value of "DEFAULT" indicates that the default password in in effect, while a value of "INSTLN" indicates that an installation-defined password is in effect. | ||
| RVARSTPW | 'Y' | RVARY ( STATUS ( xx ) ) |
| NOTE: For ADMN_XTR_SETR, the value returned for this field is not the actual password, but one of two predefined values. A value of "DEFAULT" indicates that the default password in in effect, while a value of "INSTLN" indicates that an installation-defined password is in effect. | ||
| SAUDIT (boolean) | 'Y' | SAUDIT |
| 'N' | NOSAUDIT | |
| SECLABCT (boolean) | 'Y' | SECLABELCONTROL |
| 'N' | NOSECLABELCONTROL | |
| SECLANG | 'Y' | LANGUAGE (SECONDARY ( xx ) ) |
| SESSINT | 'Y' | SESSIONINTERVAL ( xx ) |
| 'N' | NOSESSIONINTERVAL | |
| SLABAUDT (boolean) | 'Y' | SECLABELAUDIT |
| 'N' | NOSECLABELAUDIT | |
| SLBYSYS (boolean) | 'Y' | SECLBYSYSTEM |
| 'N' | NOSECLBYSYSTEM | |
| SLEVAUDT | 'Y' | SECLEVELAUDIT (xx) |
| 'N' | NOSECLEVELAUDIT | |
| TAPEDSN (boolean) | 'Y' | TAPEDSN |
| 'N' | NOTAPEDSN | |
| TERMINAL | 'Y' | TERMINAL(xx) |
| WARNING | 'Y' | PASSWORD (WARNING ( xx )) |
| 'N' | PASSWORD (NOWARNING) | |
| WHENPROG (boolean) | 'Y' | WHEN (PROGRAM) |
| 'N' | NOWHEN (PROGRAM) | |