Table of Contents

z/OS Security Server RACF Security Administrator's Guide

Previous topic | Next topic | Contents | Contact z/OS | Library | PDF

Contents (exploded view)

z/OS Security Server RACF Security Administrator's Guide
SA23-2289-00

How RACF meets security needs

Using ID(*) on the access list

RACF profiles

Multilevel security

Characteristics of a multilevel-secure environment

Administering security

RACF group and user structure

Defining users and groups

Protecting resources

Using RACF installation exits to customize RACF

Tools for the security administrator

Using RACF utilities

Organizing for RACF implementation

Responsibilities of the implementation team

Allowing a warning period

Establishing ownership structures

Defining groups and users

Defining RACF groups

Types of groups

Group profiles

Group ownership and levels of group authority

The group terminal option

User profiles

User attributes at the group level

The scope of authority for the users with group-level attributes

Time-of-day and day-of-week checking for users and terminals

Defining protected user IDs

Restrictions for using protected user IDs with z/VM systems

Defining restricted user IDs

Assigning password phrases

Using password phrases with shared downlevel systems

Classifying users and data

Security classification of users and data

Effect on RACF authorization checking

Understanding security levels and security categories

Understanding security labels

Steps for controlling the write-down privilege

Planning considerations for security labels

Specifying RACF options

Allowing mixed-case passwords (PASSWORD option)

Migration considerations for mixed-case passwords

GRPLIST considerations for z/OS UNIX

Steps for specifying daily logon statistics

Considerations for using daily logon statistics

Bypassing resource statistics collection

SETROPTS options to activate in-storage profile processing

SETROPTS GENLIST processing

SETROPTS RACLIST processing

SETROPTS REFRESH option for special cases

SETROPTS options for special purposes

SETROPTS options related to security labels

SETROPTS options for automatic control of access list authority

Assigning RACF user IDs to started procedures

Protecting data sets on DASD and tape

Protecting data sets

Rules for defining data set profiles

Rules for generic data set profile names

Automatic profile modeling for data sets

Protecting DASD data sets

Access authorities for DASD data sets

Suggestions for assigning access authorities to DASD data sets

Protecting tape volumes

Protecting general resources

Defining profiles for general resources

Limiting the size of your access lists

Conditional access lists for general resource profiles

Setting up the global access checking table

Creating resource group profiles

How is WARNING mode merged for conflicting multiple profiles?

Considerations for resource group profiles

Using RACF variables in profile names (RACFVARS class)

How RACF uses the RACFVARS member list

Using RACFVARS with mixed-case classes

Combining the SETROPTS TERMINAL command with TERMINAL profiles

Protecting consoles

Using security labels to control consoles

Using the secured signon function

Determining PTKTDATA profile names

Protecting the secured signon application keys

Example of defining a PTKTDATA class profile

Bypassing PassTicket replay protection

Enabling the use of PassTickets

Using RACF to control access to program dumps

Using non-RACF methods to control access to program dumps

The RACGLIST class

Administering the use of operator commands

Controlling the use of remote sharing functions

Controlling access to the RACLINK command

Controlling automatic direction of commands

Sample automatic command direction profiles

Controlling automatic direction of passwords

Sample automatic password direction profiles

Controlling automatic direction of application updates

Sample automatic direction of application updates

User verification during APPC transactions

Conversation security options

Administering application user identities

System considerations

Mapping profiles in the NOTELINK and NDSLINK classes

Authorizing applications to use identity mapping

Considerations for application user names

Storing encryption keys using the KEYSMSTR class

Steps for storing a key in a KEYSMSTR profile

Defining delegated resources

Steps for authorizing daemons to use delegated resources

Administering the dynamic class descriptor table (CDT)

Overview of the class descriptor table

Restrictions for applications and vendor products

Using the dynamic CDT

Profiles in the CDT class

Adding a dynamic class with a unique POSIT value

Steps for adding a dynamic class with a unique POSIT value

Adding a dynamic class that shares a POSIT value

Changing a POSIT value for a dynamic class

Steps for changing a POSIT value of an existing dynamic class

Steps for changing a dynamic class to disallow generic profiles

Deleting a class from the dynamic CDT

Steps for deleting a dynamic CDT class

Steps to re-enable a previously defined dynamic class

Protecting programs

Simple program protection in BASIC or ENHANCED mode

When a controlled program has an alias name

Protecting program libraries

How protection works for programs and PADS

Examples of defining load modules as controlled programs

Program signing and verification

Overview of program signing and verification

Enabling a user to sign a program

Overview of enabling a user to sign a program

Task roadmap for enabling a user to sign a program

Enabling RACF to verify signed programs

Overview of enabling RACF to verify signed programs

Format of the APPLDATA value

Operating considerations

Coordinating profile updates

RACF commands for flushing a VLF cache

Getting started with RACF (after first installing RACF)

Failsoft processing with tape data sets

Considerations for RACF databases

Working with the RACF database

Using the RACF database unload utility (IRRDBU00)

Using IRRDBU00 with universal groups

Running the database unload utility

Allowable parameters

Using the database unload utility output effectively

Creating a RACFVARS member report

Comparing LISTUSER and LISTGRP output with IRRDBU00

Database unload utility output samples

Using the RACF remove ID (IRRRID00) utility

IRRRID00 job control statements

Running IRRRID00 with an empty SYSIN

Creating commands to remove IDs

Running IRRRID00 with data in SYSIN

Using IRRRID00 output

The RACF remote sharing facility (RRSF)

The RRSF network

RRSF nodes

Establishing user ID associations in the RRSF network

User ID associations

Defining user ID associations

Defining user ID associations for your own user ID

Defining user ID associations for other users

Managed user ID associations

Command direction

Automatic direction

Interactions among automatic direction functions and password synchronization

RRSF considerations for mixed-case passwords

Using automatic direction of commands

Using automatic direction of application updates

RRSF considerations for distributed identity filters

Using automatic password direction

Synchronizing database profiles

Establishing RACF security for RRSF TCP/IP connections

Task roadmap for establishing RACF security for RRSF TCP/IP connections

Before you begin

Administer profiles in the SERVAUTH class to enable RRSF to use TCP/IP node connections

Steps for administering SERVAUTH class profiles to enable RRSF to use TCP/IP node connections

Implementing an RRSF trust policy

Steps for using the same, self-signed certificate for all RRSF nodes

Using an internal CA to sign a server certificate for each RRSF node

Steps for using an internal CA to sign a server certificate for each RRSF node

Considerations when using an external CA

Providing security for JES

Using protected user IDs for batch jobs

How RACF validates users

Controlling the use of job names

Authorizing the use of input sources

Authorizing network jobs and SYSOUT (NJE)

Authorizing inbound work

Authorizing outbound work

Using security labels to control writers

Controlling access to spool data

How RACF affects jobs dumped from and restored to spool (JES3 only)

Authorizing console access

RACF and Storage Management Subsystem (SMS)

Refreshing profiles for SETROPTS RACLIST processing for MGMTCLAS and STORCLAS

DFP segment in RACF profiles

DFP segment in user and group profiles

Choosing different default values for DFP constructs

Authorization checking for protected SMS classes

Controlling access to the DFP segment

Creating the access list for field-level access checking

Controlling the use of other SMS resources

RACF and TSO/E

RACF and z/OS UNIX

Controlling the use of shared UNIX identities

Enabling automatic assignment of unique UNIX identities

Automatically assigning unique IDs using RACF commands

Setting up the BPX.NEXT.USER profile

Automatically assigning unique IDs through UNIX services

Steps for automatically assigning unique IDs through UNIX services

RRSF considerations for automatic ID assignment

Special RRSF considerations for automatic unique IDs

z/OS UNIX performance considerations

Activating the UNIXMAP class

How to initially populate the UNIXMAP class

Using UNIXMAP class profiles to map UIDs and GIDs

Using UNIXPRIV class profiles to manage z/OS UNIX privileges

Using the CHOWN.UNRESTRICTED profile

Configuring the group owner for new UNIX files

Using the FILE.GROUPOWNER.SETGID profile

Steps for setting up the FILE.GROUPOWNER.SETGID profile

Protecting file system resources

Administering ACLs

Controlling access to file system resources for restricted users

Steps for controlling access to file system resources for restricted users

Overriding SUPERUSER.FILESYS authority with ACLs

Steps for overriding SUPERUSER.FILESYS authority with ACLs

Restricting access to a zFS file system

Steps for restricting access to a zFS file system

Restricting access to all zFS file systems

z/OS UNIX application considerations

Application authorization service

Restrictions of RACF client ACEE support

Auditing z/OS UNIX security events

RACF and digital certificates

Overview of digital certificates

Public key algorithms

Certificate formats

Using certificates with z/OS client/server applications

Enabling client login using certificates

Certificate mapping

Using RACF to manage digital certificates

Size considerations for public and private keys

Using the RACDCERT command to administer certificates

Examples of controlling the use of the RACDCERT command

Examples of deleting digital certificates

DIGTCERT general resource profiles

RACF and key rings

Example using the z/OS FTP client with TLS

RACF and z/OS PKCS #11 tokens

Creating and populating PKCS #11 tokens

Steps for creating and populating tokens

Certificate name filtering

Types of certificate name filters

Subject's and issuer's name filter

Example

Activating additional criteria

Steps for migrating a certificate and its ICSF private key in the PKDS

Renewing a certificate with the same private key

Renewing (rekeying) a certificate with a new private key

Supplied digital certificates

Steps to begin using a supplied CA certificate

Implementation scenarios

Controlling applications that invoke callable services

Authorizing applications

initACEE (IRRSIA00) callable service

Permitting access to the IRR.RTICKETSERV resource

RACF and the z/OS LDAP server

Password and password phrase enveloping

Overview of enveloping

Setting up enveloping

Steps for generating a certificate and private key for the RACF address space

Steps for disabling enveloping and deleting existing envelopes

Planning considerations for heterogeneous password synchronization

Defining and using custom fields

Profiles in the CFIELD class

CFIELD profile names

Steps for defining a custom field and its attributes

Activating a custom field

Steps for activating a custom field

Adding data to a custom field

Steps for adding data to a custom field

Authorizing users to define custom fields

Steps for authorizing users to define custom fields

Authorizing users to update data in a custom field

Changing attributes of an existing custom field

When you need to change the data type

Steps for changing the data type

When you need to change the MAXLENGTH of a numeric field

Steps for changing the MAXLENGTH of a numeric field

Removing a custom field

Steps for removing a custom field

Common errors when defining and using custom fields

RRSF considerations for custom fields

Authorizing help desk functions

Delegating the authority to list user information

Delegating the authority to list user information in any user profile

Steps for delegating the authority to list user information in any user profile

Steps for delegating the authority to list user information by owner

Delegating the authority to list user information by group tree

Excluding selected user profiles

Steps for excluding selected user profiles

Delegating the authority to reset passwords and password phrases

Steps for delegating the authority to reset the password for any user

Steps for delegating the authority to reset passwords by owner

Delegating the authority to reset passwords by group tree

Excluding selected users

Steps for excluding selected users

Distributed identity filters

Overview of distributed identity filters

Adding a default RACMAP filter

Restrictions for UTF-8 data values

Defining a filter for a non-LDAP user name

Steps for defining a filter for a non-LDAP user name

Results for defining a filter for a non-LDAP user name

Defining a filter for an X.500 user identity

Steps for defining a filter for a full X.500 DN

Results for defining a filter for a full X.500 DN

Steps for defining a filter using selected RDNs

Results for defining a filter using selected RDNs

Deleting a distributed identity filter

Steps for deleting a distributed identity filter

Supplied RACF resource classes

Summary of RACF commands and authorities

Relationships among the SECLABEL class, SETROPTS MLS(FAILURES), SETROPTS MLACTIVE(FAILURES) and SETROPTS MLQUIET

Problems with user ID authentication

Go to the next page

Notices | Terms of use | Support | Contact z/OS | zFavorites

Copyright IBM Corporation 1990, 2014