SEARUG NEWS By George Fogg

Well....so much for having quarterly meetings. During the summer I was so busy preparing for the RACF 95 conference and SHARE, and doing other unspeakable things, that attending to SEARUG needs was put on the back burner. My apologies to all.

October Meeting Notice!!

NEXT MEETING Wednesday, October 11th 1995

Site: US West Communications, Inc.

Host: Mike Ray (206) 451-5727
Also contact Jorge Castelazo for questions at (206) 451-5646

Address: 500 - 108th Avenue NE Bellevue, WA

Directions: Meeting in Bronze colored glass building on the east side of 108th Avenue NE in Bellevue between NE 4th and NE 6th St. Parking access for the pay lot is off 110th Avenue NE and is on the east side of building. Meeting room is at the south end of the second floor. (To get there, take the NE 4th exit off of I-405 in Bellevue and head West up the hill to 110th Avenue NE. Turn right on 110th. The parking lot is on the left side of the block. The building entrance is to the west across the parking lot).

AGENDA:

1:00 PM -- RACF 2.2 User Experiences at Boeing by George Fogg

2:30 PM -- BREAK

2:45 PM -- Using SMF, RACF Database unload utilities and DB2 for Auditingpresented by Jorge Castelazo of US WEST

4:30 PM -- Go have a BEER!

Mailing list and membership Information

Lupe Peru of SEAFIRST Bank will now handle all the mailing list requirements. Call her If you have a change of address or new membership. Her phone number is 358-8762.

What's the New News

• The RACF 95 Conference in Orlando was the big thing since our last meeting. IBM came and not only announced RACF 2.2 but provided several breakout sessions on what's included. Dan DumSuden of IBM gave several excellent presentations on RACF 2.2 function and features. I heard several: Ahas, Woos, "it's about time", and "we can use that" murmurs from the audience as Tom was describing the new features.

• The SHARE Conference, which was also held in Orlando, had more and more breakout sessions on Open Edition, DCE, RACF, POSIX, and Kerbos than I've seen in the past. You will see that RACF will play a big role in these areas. RACF already plays a big role if you have MVS 5.2, Open Edition, and RACF 2.1. I'm sure we'll be discussing these topics in future SEARUG meetings since my current employer is involved in client/server activities and have tested some of the Open Edition and POSIX functions.

SECURITY EDUCATION AVAILABLE

The Henderson Group Education

"THE HENDERSON GROUP" is in the business of Security education. They offer many courses in MVS and UNIX security. Two of their new ones are: Comprehensive MVS Security and Comprehensive UNIX Security during October and December of this year. Please call (301) 229-7187 for details on these and other courses available.

IBM Education

IBM courses available in the near future are:

H3992 - Implementing RACF Security for CICS/ESA

H4020 - Migrating to RACF Version 2 (Including RACF 2.2) In Seattle on 4/2/96

Z2187 -RACF for the Security Administrator (Scheduled by the IBM Learning Center)

H3927 - Effective RACF Administration

H3918 - MVS/ESA RACF Security Topics

Call IBM-TEACH: 1-800-426-8322 for schedules and details

PRODUCTS OF INTEREST

RACF 2.2

Come to the next meeting, I will tell you all about the major features and user experiences with the new RACF 2.2 release.

BookManager Update

On-line books for RACF has been updated to a MARCH 95 Third edition. I highly praised on-line books in the last newsletter and suggest that every shop get a copy. The order information is: IBM On-line Library Productivity Edition: RACF Information Collection March 1995, , SK2T-2180-02. Thirty four books have been added and 30 books updated in this new edition. There's probability a new Edition for RACF 2.2 already to be released as you get this newsletter.

HIPER APARS UPDATE FOR SEPTEMBER 1995

Hiper APARS are documented problems of extreme magnitude that they are defined in a special category on IBMLink. I treat them as a flashing red light, telling me that IBM or a customer has found a problem that can cause major trouble. Hipers can be open or closed. Hiper APARS that are closed have a fix available from IBM (A fix is also known as a PTF. Some APARS may have more than one PTF to fix one or more modules in error).

Hipers for RACF 1.9.2 since the last newsletter in April 95

• OY59511 Status: CLOSED - Trusted Procedure Receives ICH408I Security Violation.

Hipers for RACF 2.1.0 since the last newsletter in April 95

• OW10674 Status: CLOSED - ABEND130 when running IRRUT200 copying a live dataset
• OW04054 Status: CLOSED - System hangs when starting multiple Initiators
• OW15012 Status: CLOSED - Cleanup of APAR rollup... (Problems in the RACF Panels)

QUESTIONS and ANSWERS

Q: I want to give a userid CLAUTH authority to a RACF Class. What authority does this user really get when I do this?

A: One usually gets CLAUTH or also known as "Class Authority" to define profiles in a given General Resource class. But that's not all the user gets. Sure, the user can create profiles in a General Resource Class and this authority can even be limited by using the Setropts "genericowner" option, but then--the user can also :

• That user can now give the same CLAUTH authority to another user ID if that user owns the other user ID. As an example, if the user has CLAUTH to the FACILITY class and happens to be the owner of 50 userids then that user could propagate that CLAUTH authority to 50 other userids that you may not want to have that same CLAUTH authority.

• The CLAUTH authority to a given class also gives that user CLAUTH to all other classes with the same POSIT value. As an example, if you give a user CLAUTH to the CICS general resource class TCICSTRN then that user also has CLAUTH authority to GCICSTRN, TICISTRN, PCICSTRN, QCICSTRN, etc.. or about 18 IBM defined CICS general resource classes.

• The CLAUTH user can issue the SETROPTS GENERIC or GLOBAL REFRESH for the class the user has CLAUTH to.

• Issue the "SETROPTS RACLIST(class_name) REFRESH " to the class the user has CLAUTH authority to.

• You won't find this rule in the manuals --You give a user CLAUTH to a general resource class that is a grouping class but is not currently active. That user cannot create any profiles in that class until it becomes active. As an example, the DASDVOL class is a grouping class. If a CLAUTH(DASDVOL) user tries to RDEFINE profiles in this class and the class is not active then the user will receive the message:
  
  "ICH10301I XXXXXX AND REMAING ENTITIES NOT DEFINED TO RACF"

Only system special users can define profiles in a non-active grouping class.

• If the user has CLAUTH(user) authority then that user can define new userids if that CLAUTH user owns or has group-JOIN authority to the new user's default group.

See the RACF Systems Administrators Guide for more details on CLAUTH authority.

Some of these points about CLAUTH may be goodness or a stoned-out bad thing; it's up to you systems administrators on how you deal with it...

INTERNET NEWS

HOT WEB URL's for RACF interested parties;

http://www.wln.com/~ssabel/searug/searug.html for our own SEARUG Home Page

http://www.ibmlink.ibm.com for the new WEB IBMLink

http://www.mindspring.com/~ajc10/garug.html for Georgia's RACF User's group

http://www.redbooks.ibm.com/redbooks/ for IBM's REDBOOKCollection

http://www.hiway.co.uk/xephon/racf.html for new RACF Update books from the XEPHON Corporation

COPYRIGHT and TRADEMARKS

All Copyright and Trademarks are recognized by this author wherever they appear in any SEARUG Newsletter; hereforthwith, hereinafter, hereafter, herebeforewith, ad infinitum. (I'm too lazy to add TM and Copyright symbols whenever the words IBM or DB2 or RACF, etc. appear in the text but I respect their ownership and claims to said material)

SEARUG is proudly sponsored by:

Technology Management Group, Inc. (206) 451-2575
"solutions and expertise for managing information technology"

Back to the SEARUG Home Page...