Managing command security

Use command security to ensure that only authorized users can issue zRule Execution Server for z/OS commands from the z/OS® console.

About this task

Command security uses the HBRCMD RACF® class to authorize user IDs to issue zRule Execution Server for z/OS commands. However, if the HBRADMIN class includes either of the following resource profiles, command security for the server instance is disabled and the HBRCMD class is ignored:

<HBRSSID_NAME>.NO.SUBSYS.SECURITY
<HBRSSID_NAME>.NO.COMMAND.SECURITY

To manage command security for a single server, set <HBRSSID_NAME> to a subsystem ID in the server group that is specified by the ++HBRSSIDLIST++ JCL variable. To manage command security for multiple servers or for the entire server group, specify a wildcard as the subsystem ID.

Note: In some cases, you might want to disable command security but maintain the other types of security. For more information, see Disabling types of security.

To enable zRule Execution Server for z/OS command security, define a resource profile to the HBRCMD class for each command you want to secure. Then, authorize each user ID individually to issue each command. For example, you must separately authorize a user ID to issue the PAUSE command and the RESUME command.

The following table lists the resource profiles and the commands that they control.

Resource profile	Command
`<HBRSSID_NAME>`.SET.TRACE	SET TRACE
`<HBRSSID_NAME>`.PAUSE	PAUSE
`<HBRSSID_NAME>`.RESUME	RESUME
`<HBRSSID_NAME>`.DUMP	DUMP

If you are managing multiple servers, you can use a wildcard as described previously to specify the subsystem ID, HBRSSID_NAME, in the resource profile referred to in the following procedure.

Procedure

Define to the HBRCMD class each resource profile that is shown in the previous table.
Use the following command:
```
RDEFINE HBRCMD <RESOURCE_PROFILE> UACC(NONE)
```
Authorize each user ID to issue each command.
Use the following RACF command:
```
PERMIT <RESOURCE_PROFILE> CLASS(HBRCMD) ID(<USER_ID>) ACCESS(UPDATE)
```
where <RESOURCE_PROFILE> is a resource profile that is listed in the previous table.
The following example shows how to authorize user ID, SYSPROG1, to issue the SET TRACE command:
```
PERMIT <HBRSSID_NAME>.SET.TRACE CLASS(HBRCMD) ID(SYSPROG1) ACCESS(UPDATE)
```
Refresh the HBRCMD class.
Use the following command:
```
SETROPTS RACLIST(HBRCMD) REFRESH
```