Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

RACF - The Basics (v1.2)

1,543 views

Published on

In this presentation Rui will explain what is RACF, what are its components, and how to implement security profiles in the mainframe z/OS system.

Published in: Technology
  • Be the first to comment

RACF - The Basics (v1.2)

  1. 1. Rui Miguel Feio Sharingknowledgewiththeworld RACF Thebasics
  2. 2. Agenda 2The role of users in RACF and how to define access to the mainframe. Users 3What are RACF groups, how do they work and how to use them. Groups 5General resources and how to protect everything else on the mainframe. General 6How to configure RACF and security best practices. Settings 7How to contact Rui and keep in touch. Contact 1What is RACF, what is it for, and how it works. Intro 4Dataset profiles and how to protect the data on the mainframe. Dataset
  3. 3. RACF INTRODUCTION
  4. 4. 04 It’s an IBM External Security Management (ESM) product that provides access control and audit functionalities for the mainframe z/OS and z/VM operating systems. RACF provides the tools to manage user access to critical resources. It protects resources by granting access only to authorised users of the protected resources. RACF retains information about users, resources, and access authorities in special structures called profiles in its database, and it refers to these profiles when deciding which users should be permitted access to protected system resources. ResourceAccessControlFacility (RACF) .
  5. 5. Macros Allows applications to use RACF macros. 7 Logging Logs access to a protected system and protected resources. 5 Administration Simplifies the administration process to meet the security goals of the company. 6 Main Features. 05 Users Identifies and authenticates users using a userid and a password when trying to access the mainframe operating system. 1 Protection Allows the identification, classification and protection of mainframe system resources. 2 Access Facilitates the maintenance of access rights to the protected resources. 3 Control Helps controlling the means of access to protected resources on the mainframe. 4
  6. 6. RACF Profiles. 06 User profiles contain security information about the userids defined to RACF who can access (or not) the resources. User 01 Group profiles contain security information about group attributes and user connections. Group 02 General resource profiles contain security information about all resources other than user, group or dataset. General Resources 03 These profiles contain the necessary information to allow RACF to make a decision as to the access authority allowed for any specific request. What are they for? Dataset profiles contain security information about DASD and tape datasets. Dataset 04
  7. 7. Access to Profiles. 07 Users and groups can be defined in RACF to have different levels of access to dataset profiles and general resource profiles (programs, transactions, commands, etc). Accessing profiles Dataset Profiles General Resource Profiles Users & Groups
  8. 8. Access Levels. 08 Access to the resource is not granted to users and groups. None 1 Users and groups can execute programs from a library, but they cannot read or write into the library. Execute 2 Users and groups can access the resource but they cannot alter its contents. Read 3 Users and groups can change the contents of the resource but they are not authorized to delete it or create a new one. Update 4 Users and groups are granted authority to VSAM datasets (equivalent to the VSAM control password). Control 5 Users and groups have full control over the resource, i.e., they can create a new one, access it, modify it and delete it. Alter 6 From lowest (1) to greatest (6).
  9. 9. Securing the Mainframe. 09 z/OS Application SAF RACF Resource Manager System Component Authorisation Checking 1. A userid is passed from the application or system component to the resource manager. 2. The resource manager maintains the data that the userid wishes to access and calls SAF to perform an authorisation check. In some situations the resource manager may provide its own security 3. SAF passes the userid, the resource the userid wishes to access, and the access type to RACF (External Security Manager). 4. RACF refers to its database in order to make a decision. 5. RACF passes the Information back to SAF and ultimately to the resource manager. 6. The resource manager makes the decision to allow or deny access based on the security information it now has.
  10. 10. Summary. 10 RACF controls and logs access RACF profiles protect resources Users can logon to the mainframe Users can be connected to Groups Users and groups are defined to profiles Access can go from None to Alter What we have covered so far... RACF provides access control and audit functionalities for the mainframe. It uses profiles to describe mainframe resources that it protects: datasets, programs, commands, transactions, etc. Users can logon to the mainframe via userid/password and can be grouped together into Groups to share the same levels of access. This facilitates the security management tasks. In order to access the resources, users and groups need to be defined in the Access Control List (ACL) of the RACF profiles – dataset and general resource. The access that a user or a group can have to a resource varies from None (no access) to Alter (full access).
  11. 11. RACF USERS
  12. 12. What are RACF users? 12 Someone who requires access to resources In RACF users are represented by userids Users must authenticate to gain access User authentication is done by userid/pass Userids can be used by people (personal) Userids can be used by system resourcesDesigned by Freepik
  13. 13. Naming Convention. 13 The userid name has to be one to eight characters in length. Userid length 1 Any combination of alphanumeric and $, # or @. Characters 2 Has to be unique. The userid cannot match an existing userid or group name. Userid 3 Users with the ability to logon to the mainframe system cannot exceed 7 characters in length. TSO users length 4 TSO userids cannot begin with a numeric character. TSO useridcharacters 5
  14. 14. Base Segment. 14 BASE Segment Userid User Name Owner Default Group User Attributes Password
  15. 15. Other Segments. 15 Optional User Segments TSO CICS OMVSCSDATA …
  16. 16. Attributes – System Wide. 16 Attribute Description SPECIAL A user can issue all RACF commands. This attribute gives the user full control over all RACF profiles in the RACF database. AUDITOR Given to users who are responsible to auditing RACF security controls and functions. OPERATIONS A user has full access authorisation to all RACF-protected resources in specific classes: DATASET, DASDVOL, GDASDVOL, PSFMPL, TAPEVOL, VMBATCH, VMCMD, VMMDISK, VMNODE and VMRDR. PROTECTED Used mainly for started tasks to prevent a userid from being revoked. RESTRICTED Prevents a user from accessing protected resources REVOKE Prevents a user from accessing the system. CLAUTH Allows the user to define profiles in the class where user has CLAUTH
  17. 17. Attributes – Group Level. 17 Attribute Description SPECIAL (Group Special) This attribute gives the user full control over all RACF profiles within the scope of the group. AUDITOR (Group Auditor) User authority is limited to RACF profiles within the scope of the group. Given to users who are responsible to auditing RACF security controls and functions. OPERATIONS (Group Operations) A user has full access authorisation to all RACF-protected resources in specific classes: DATASET, DASDVOL, GDASDVOL, PSFMPL, TAPEVOL, VMBATCH, VMCMD, VMMDISK, VMNODE and VMRDR. User authority is limited to RACF profiles within the scope of the group. REVOKE Prevents a user from accessing the profiles within the scope of the group. • The "scope of the group” is determined by the group ownership structure • Group ownership can only occur between a superior group and its subgroups • The scope will continue as long as "groups own groups” • The scope ends when a group is owned by a user id
  18. 18. RACF Commands. 18 Command Description Example ADDUSER (AU) Add a user profile AU userid NAME(‘user_name’) DFLTGRP(grp_name) OWNER(owner) PASS(password) ALTUSER (ALU) Modify a user profile ALU userid PASSWORD(password) LISTUSER (LU) List a user profile LU userid DELUSER (DU) Delete a user profile DU userid
  19. 19. RACF GROUPS
  20. 20. What are RACF groups? 20 Collection of users with common access Groups can have users connected to them Groups facilitate user management Groups can have subgroups Each Group has an owner (user or group) Groups should be owned by another Group Why are Groups so important? By adding a user to a group, we give that user access to all of the resources to which the group has access. Likewise, by removing a user from a group, we prevent the user from accessing those resources. Some of the benefits of using RACF groups include: • Reducing the effort to maintain access lists • Avoiding the need to refresh in-storage profiles • Providing a form of timed PERMIT • Minimising the length of access lists
  21. 21. Naming Convention. 21 The group name has to be one to eight characters in length. Name length 1 Any combination of alphanumeric and $, # or @. Characters 2 Has to be unique. The group name cannot match an existing userid or other group name. Group 3 The group name cannot begin with a numeric character. Numerics 4
  22. 22. Group Tree. 22 SYS1 HR STAFF HIRE FINANCE IT SECURITY SYSTEMS SHARED EXTERNAL ZOS MVS JUNIOR SENIOR CICS CIC01 CIC02 DB2 DB201 DB202 HELPDESK AUDIT OFFSHORE INDIA AFRICA AMERICA
  23. 23. Owner and SupGroup. 23 The owner of a group can define new users (providing it has got CLAUTH for the USER class), can modify, list, and delete the group profile, can connect and remove users from the group, and can define, delete, and list the names of the subgroups. The same applies for users connected to the group with Group Special attribute. Owner The Superior Group defines the parent group. The initial point where all groups derive from is SYS1. Supgroup Determinesadministration Determinesstructure But bear in mind… When creating a RACF group, always remember that: • If you don’t specify the OWNER your userid becomes the OWNER of the group • If you don’t specify the SUPGROUP, your userid’s current connect group becomes the superior group. • If the OWNER is a group, this group will also become the SUPGROUP.
  24. 24. Naming Convention. 24 The group name has to be one to eight characters in length. Name length 1 Any combination of alphanumeric and $, # or @. Characters 2 Has to be unique. The group name cannot match an existing userid or other group name. Group 3 #CIO $WIN $MVS @ZVM @ZOS ZOS01 CICS CICS01 CICS02 ZOS02 IMS ZOS03 WAS ZOS04 DB2 DB201 DB202 $AS400 $LINUX @SUSE @REDHAT
  25. 25. Base Segment. 25 BASE Segment Group Name Owner Superior Group Installation Data Connected Users Subgroups
  26. 26. Other Segments. 26 Optional Group Segments DFP OMVS CSDATATME OVM
  27. 27. Universal Groups. 27 Regular, normal RACF groups can only have up to 5,957 connected users. Limitation of regular groups 1 RACF Universal groups allow more than 5,957 to be connected. UniversalGroups 2 To create a RACF Universal group you just need to use the UNIVERSAL parameter with the add Group command: AG group OW(owner) SUP(supgroup) UNIVERSAL Setup an Universalgroup 3 With Universal groups, the LISTGRP command will only list users with authority higher than USE or with the attributes SPECIAL, OPERATIONS or AUDITOR. Downside 4 To view all members of a RACF Universal group, you will need to use the Database Unload Utility (IRRDBU00). List all users 5
  28. 28. Group Attributes. 28 Attribute Description USER Allows the user to access resources to which the group is authorised CREATE Allows the user to create RACF dataset profiles for the group CONNECT Allows the user to connect other users to the group JOIN Allows the user to add new subgroups or users to the group, as well as assign group authorities to the new members • The "scope of the group” is determined by the group ownership structure • Group ownership can only occur between a superior group and its subgroups • The scope will continue as long as "groups own groups” • The scope ends when a group is owned by a user id
  29. 29. RACF Commands. 29 Command Description Example ADDGROUP (AG) Add a group profile AG group OWNER(owner) SUPGRP(grp_name) ALTGROUP (ALG) Modify a group profile ALG group OWNER(owner) SUPGRP(grp_name) LISTGRP (LG) List a group profile LG group DELGROUP (DG) Delete a group profile DG group CONNECT (CO) Connect a user to a RACF group CO user GROUP(group) OWNER(owner) REMOVE (RE) Remove a user from a RACF group RE userid GROUP(group)
  30. 30. RACF DATSET PROFILES
  31. 31. What are they? 31 RACF dataset profiles protect datasets HLQ of profile must match user or group Must be owned by a user or a group PROTECTALL requires dataset profiles Why are RACF Dataset profiles so important? Dataset profiles allow the security administrator to define who can read the content of a dataset, who can edit it, and who can create or delete a dataset. In essence, it’s the way to protect datasets on the mainframe using RACF. If RACF option PROTECTALL is enabled, datasets can only be accessed if there’s a dataset profile in place in RACF.
  32. 32. Categories. 32 Protects one data set that has unique security requirements. If the data set is deleted, the profile is deleted. Avoid using them. TSSS.EXRT222.OUTPUT VOL123 Discrete 1 Can protect one or many data sets whose data set name matches profile name. Uses "generic" characters % and *. TSSS.%%%%%%%.* Generic 2 Can protect one or more data sets with the same data set name. The profile is not deleted if the data set is deleted. TSSS.EXRT222.OUTPUT Fully-qualifiedgeneric 3 Similar to generic profiles but can also use the ** as a generic character. Implemented to provide comparable capability provided for General Resources. TSSS.*.** Enhanced generic 4 Generic profiles are the standard (use GEN with the RACF commands)
  33. 33. Naming Convention. 33 A dataset profile can have two or more naming qualifiers. Number of qualifiers 1 Each qualifier must be separated by a period. Qualifiers separation 2 Any combination of alphanumeric and $, # or @. Characters 3 The first character of each qualifier cannot be a numeric. No numerics at the start 4 Dataset profiles can have wildcards (%, *, **) Wildcards 5
  34. 34. Generic Profiles. 34 Profile Dataset Name HLQ.DATA.* HLQ.DATA HLQ.D%TA.FILE HLQ.DATA.FILE HLQ.D*.FILE HLQ.DATA.FILE.STUFF HLQ.* HLQ.MY.FILE HLQ.*.** HLQ.YOUR.FILE HLQ.**.FILE HLQ.MASTER.FILE HLQ.BACKUP.FILE RACF uses the most specific Generic Profile when determining which profile protects a dataset. SR MASK(hlq.) will display the search order RACF will use 1. To see which of two generic profiles is more specific, compare the profile names, character by character. 2. Where they first differ, if one has a discrete character and the other has a generic character, the one with the discrete character wins. 3. If both have a generic character where they differ, then: • If one has a % and the other has a * or **, the one with % wins. • If one has a * and the other has a **, the one with * wins.
  35. 35. Access Levels. 35 Level Description NONE User/Group is not allowed to access the dataset EXECUTE User/Group is allowed to execute a program from the dataset, but not to Read, Copy or Modify the dataset READ User/Group is allowed to Read and Copy the dataset UPDATE User/Group is allowed to Read, Copy and Modify the dataset CONTROL (VSAM data sets) User/Group is allowed to perform improved control interval processing. This is control-interval access (access to individual VSAM data blocks), and the ability to Retrieve, Update, Insert, or Delete records in the data set ALTER User/Group has full authority over the dataset (Read, Update, Create, Delete, Rename, Allocate)
  36. 36. Access Control List. 36 • Standard Access Control List: – Grants User/Group some level of access • Conditional Access Control List: – Grants User/Group some level of access based on a condition: – WHEN using a certain PROGRAM – WHEN user is logged onto a certain TERMINAL – WHEN user is logged onto a certain CONSOLE – WHEN job submitted from a certain JESINPUT – WHEN user enters system from certain LU (APPCPORT) – WHEN user enters system from certain IP address (SERVAUTH)
  37. 37. UACC and ID(*). 37 Level Description ID(*) Defines the default access level to all RACF defined users UACC (Universal Access) Defines the default access level to all users and groups defined or not in RACF UACC value is a required field when defining a new dataset profile
  38. 38. Access. 38 Condition Description Own Profile • Userid/Group has full admin control over profile (including Access List) • Does not allow access to dataset itself Don’t Own Profile • GAT allows access to dataset • Userid = dataset HLQ • Userid/Group is in ACL • ID(*) allows access • UACC allows access • OPERATIONS attribute • WARNING Mode • Each dataset profile defined to RACF requires a RACF-defined user or group as the owner of the profile. • The owner (if a user) has full control over the profile, including the access list. If the owner of the dataset profile is a group, users with group-SPECIAL in that group have full control over the profile. • Ownership of dataset profiles is assigned when the profiles are defined to RACF. Note that ownership of a dataset profile does not mean that the owner can automatically access that data set. • To access a data set, the owner must still be authorized in the profile's access list, unless the high-level qualifier of the profile name is the owner's user ID.
  39. 39. RACF Commands. 39 Command Description Example ADDSD (AD) Add a dataset profile AD ‘ds_profile’ UACC(uacc_level) OW(owner) ALTDSD (ALD) Modify a dataset profile ALD ‘ds_profile’ UACC(uacc_level) OW(owner) LISTDSD (LD) List a dataset profile LD DATASET(‘ds_profile’) DELDSD (DD) Delete a dataset profile DD ‘ds_profile’ PERMIT (PE) Define, modify or delete ACL entries on a dataset profile PE ‘dsprofile’ GEN ID(group) AC(access)
  40. 40. RACF GENERAL RESOURSE PROFILES
  41. 41. What are they? 41 Protect all resources other than Datasets General Resources grouped by Classes Must be owned by a user or a group Why are RACF General Resource profiles so important? General resource profiles protect all resources other than datasets on the mainframe, for example: CICS transactions, TCP/IP ports, MVS commands, JES2 commands, ISPF panels, DB2 subsystems, etc.
  42. 42. Need to Know. 42 • Classes must be activated: – SETROPTS CLASSACT(class_name) – But… we need to define the profiles before activating it • Classes can be RACLISTed to improve performance: – SETROPTS RACLIST(class_name) • Dynamic refreshing of in-storage profiles: – SETROPTS RACLIST(class_name) REFRESH – When… adding, modifying, or deleting RACLISTed profiles
  43. 43. Profile Types. 43 Discrete Profiles Generic Profiles Generic characters %, *, **, and & can be used Generic characters can be used in any qualifier
  44. 44. Access Control List. 44 • Standard Access Control List: – Grants User/Group some level of access • Conditional Access Control List: – Grants User/Group some level of access based on a condition: – WHEN user is logged onto a certain TERMINAL – WHEN user is logged onto a certain CONSOLE – WHEN job submitted from a certain JESINPUT – WHEN user enters system from certain LU (APPCPORT) – WHEN user enters systemid (SYSID)
  45. 45. UACC and ID(*). 45 Level Description ID(*) Defines the default access level to all RACF defined users UACC (Universal Access) Defines the default access level to all users and groups defined or not in RACF UACC value is a required field when defining a new Generic profile
  46. 46. RACF Commands. 46 Command Description Examples RDEFINE (RDEF) Add a Generic Resource profile RDEF class_name profile_name ADDMEM(member) RALTER (RALT) Modify a Generic Resource profile RALT class_name profile_name UACC(acc_level) RLIST (RL) List a Generic Resource profile RL class_name profile_name ALL RDELETE (RDEL) Delete a Generic Resource profile RDEL class_name profile_name PERMIT (PE) Define, modify or delete ACL entries on a Generic Resource profile PE gr_profile CL(class) ID(grp_name) AC(access_level)
  47. 47. RACF SETTINGS
  48. 48. What is SETROPS? 48 Where RACF is configured (settings) Accessible by System Special users Accessible by System Auditor users Why is SETROPS so important? SETROPS contains the default settings for the RACF environment. These values can be modified by system special userids. System auditor userids have the ability to visualise the entire SETROPS configuration.
  49. 49. Need to Know. 49 • SPECIAL users can set global controls • AUDITOR users can set tracking options • Need to Refresh after updating: – Generic – Global – RACLIST – WHEN(PROGRAM) • An SMF record is written for every SETROPTS
  50. 50. Parameters – Examples. 50 Parameter Description CLASSACT Specifies classes for which RACF protection will be in effect RACLIST Discrete and Generic profiles for the General Resource classes specified will be copied into storage and shared by all users LOGOPTIONS Audit selected access attempts to resources whether they are RACF protected or not PROTECTALL Creation of or access to unprotected data sets is not allowed INTERVAL (Pasword) Maximum number of days a user's password is valid MINCHANGE (Password) Number of days that must pass between a user’s password changes MIXEDCASE (Password) Support for mixed-case passwords
  51. 51. RACF Commands. 51 Command Description Examples SETROPTS parameter Modify SETROPTS values SETROPTS PASSWORD(REVOKE(5) RULE1(LENGTH(6:8) ALPHA(1,6) ALPHANUM(2:5)) RULE2(LENGTH(7) ALPHA(1,7) ALPHANUM(2:6)) RULE3(LENGTH(8) ALPHA(1,8) ALPHANUM(2:7))) SETROPS LIST List RACF settings SETROPS LIST SETROPS REFRESH Refresh in-storage profile for a specific CLASS SETROPTS GENERIC(class_name) REFRESH
  52. 52. CONTACTS
  53. 53. Contacts. 53 ruif@rmfconsulting.com +44 (0)7570 911459 l t f Phone & email Social Media https://twitter.com/rfeio https://www.facebook.com/RuiMiguelFeio https://www.linkedin.com/in/rfeio g https://plus.google.com/+RuiMiguelFeio Other Presentations s http://www.slideshare.net/rmfeio http://www.RuiFeio.com Website

×