RACF: Useful RACF commands

LISTUSER command

This command lists all the RACF groups connected to a TSO id

Example:-

TSO LISTUSER TXUXXXF 

Output of the command is below.

  REVOKE DATE=NONE   RESUME DATE=NONE                                          

  LAST-ACCESS=11.357/10:42:13                                                  

  CLASS AUTHORIZATIONS=NONE                                                     

  INSTALLATION-DATA=PPP-PPP-PPPP/TXUXXXF /999999999/INCERT0906/CONSULT         

                      801101955/                                               

  NO-MODEL-NAME                                                                

  LOGON ALLOWED   (DAYS)          (TIME)                                       

  ---------------------------------------------                                

  ANYDAY                          ANYTIME                                      

   GROUP=$XHXUX03  AUTH=USE      CONNECT-OWNER=@XXXXUSR  CONNECT-DATE=06.269   

     CONNECTS= 1,598  UACC=NONE     LAST-CONNECT=11.357/10:42:13               

     CONNECT ATTRIBUTES=NONE                                                   

     REVOKE DATE=NONE   RESUME DATE=NONE                                       

   GROUP=$XHXDXV   AUTH=USE      CONNECT-OWNER=@MXTXUSR  CONNECT-DATE=06.269   

     CONNECTS=    00  UACC=NONE     LAST-CONNECT=UNKNOWN                       

     CONNECT ATTRIBUTES=NONE                                                    

     REVOKE DATE=NONE   RESUME DATE=NONE                                       

LISTDSD command

This command tells you what kind of access you have to a dataset.

Example:-

TSO LISTDSD DATASET('DS8001.TED.USEFUL.JCLLIB') ALL GENERIC

Output of the command is below and it specifies that the dataset is protected by generic dataset profile DS8001.TED.** and the user has ALTER access to the dataset.

INFORMATION FOR DATASET DS8001.TED.** (G)          

                                                   

LEVEL  OWNER    UNIVERSAL ACCESS   WARNING   ERASE 

-----  -------- ----------------   -------   ----- 

 00    DS8001          NONE          NO      NO    

                                                    

AUDITING                                           

--------                                           

FAILURES(READ)                                     

                                                   

NOTIFY                                              

--------                                           

NO USER TO BE NOTIFIED                             

                                                   

YOUR ACCESS  CREATION GROUP  DATASET TYPE          

-----------  --------------  ------------          

   ALTER        $X650001       NON-VSAM            

RACF: Find what kind of access you have to a dataset

Most installation have security reports which reports on dataset access violations by users. In client sites, one has to be extremely careful not to receive such violations, as someone from the higher management would be questioned as to why a particular violation happened. In most cases, we do not know if we have or do not have access to a particular dataset. We usually try to browse the dataset and when we get an ICH408I  message or system abend S913, we realize that we do not have access to the dataset. But this would be too late and we would have left our fingerprints in system logs and/or SMF.

The below simple REXX, which canbe used to verify if you have access to a particular dataset. It issues LISTDSD TSO command against the dataset and lets the user know if he/she has access to the dataset. Additionally, it also lets him/her know what kind of access he/she has and as a bonus, it provides the information about the RACF profile which protects the dataset (This is applicable only if the user has some access to the dataset).Note: This REXX caters to only RACF as a security product. If your site uses Top-Secret or ACF2, this REXX will not work.

/* Rexx */                                                             

/*- Find access to a dataset. -*/                                       

 say 'Enter dataset name'                                              

 PULL idsn                                                             

 idsn = strip(idsn)                                                    

 idsn="'"||strip(idsn,'B',"'")||"'"                                    

 access='NONE'                                                         

 x=outtrap('var1.')                                                    

 "listdsd da("idsn") auth"                                              

 x=outtrap('off')                                                      

 If var1.0 > 1 Then                                                    

    access=word(var1.17,1)                                             

 Else Do                                                               

   drop var1.                                                          

   x=outtrap('var1.')                                                  

   "listdsd da("idsn") gen auth"                                        

   x=outtrap('off')                                                    

   If var1.0>1 Then                                                

      access=word(var1.17,1)                                       

 End                                                                

 if access == 'NONE' then                                          

    msg="User has '"||access||"' to the dataset " idsn             

 else                                                               

   msg="User has '"||access||"' to the dataset " idsn "Profile ",  

 "'"||word(var1.1,4)||"' "||word(var1.1,5)                         

 say msg                                                           

 Exit                                                               

RACF: How to verify what are the groups connected to TSO uder id in RACF

Follow the below instructions to find out what are all the RACF groups attached to your TSO id.

1. Select “4 USER PROFILES AND YOUR OWN PASSWORD” in RACF main menu

2. In the next screen select “DISPLAY Display profile contents” and type your user id in “USER ===> your user id”.

3. In the next screen, select “TSO”. The next screen will display the desired result.

RACF: How to give universal READ access for your datasets

1.Type "RACF" in command prompt
2.Select option 1 (DATA SET PROFILES) from "RACF - SERVICES OPTION MENU "
3.Select option 2 (change) in "RACF - DATA SET PROFILE SERVICES"
4.Type "userid.**" in "PROFILE NAME ===>" in screen "RACF - DATA SET PROFILE SERVICES - CHANGE" and press enter
  For example, PROFILE NAME ===> 'TSXAUX1.**'
5.Type READ in "UACC  ===>" in screen "RACF - CHANGE DATA SET PROFILE" and press enter.

After this, everyone will have read access for your datasets.