Racf Reports
I have auditor's after me.help! I need a RACF report which will show ID and password interval. I know RACF has a report writer utility, but I don't have time to do the research on how to get the information I need. We are z/OS V1R4. Any help would be appreciated. Thank you -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
RACF report writer cannot do this for you. What reporting tools do you have? Vanguard Consul RACFICE Etc. Kind Regards Mark Wilson Mobile: +44 (0) 7768 617006 -Original Message- From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf Of Mark Steely Sent: Friday, November 11, 2005 4:48 PM To: IBM-MAIN@BAMA.UA.EDU Subject: Racf Reports I have auditor's after me.help! I need a RACF report which will show ID and password interval. I know RACF has a report writer utility, but I don't have time to do the research on how to get the information I need. We are z/OS V1R4. Any help would be appreciated. Thank you -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html CSF Group Plc Registered No: 2646774 Registered Office: Alliance House, 49-51 East Road, London, N1 6AH Tel: 0207 490 2727 www.csf.co.uk This email transmission is confidential and intended solely for the person or organisation to whom it is addressed. If you are not the intended recipient, you must not copy, distribute or disseminate the information, or take any action in reliance of it. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of any organisation or employer. If you have received this message in error, do not open any attachment but please notify the sender deleting this message from your system. Security and reliability of e-mail is not guaranteed. In addition, no liability or responsibility is accepted for viruses and it is your responsibility to scan any attachments. Please note that for business purposes, outgoing and incoming emails from and to the company are monitored and recorded. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
The only Reporting tool we have is Easytrieve. Not much. -Original Message- From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf Of Mark Wilson Sent: Friday, November 11, 2005 11:03 AM To: IBM-MAIN@BAMA.UA.EDU Subject: Re: Racf Reports RACF report writer cannot do this for you. What reporting tools do you have? Vanguard Consul RACFICE Etc. Kind Regards Mark Wilson Mobile: +44 (0) 7768 617006 -Original Message- From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf Of Mark Steely Sent: Friday, November 11, 2005 4:48 PM To: IBM-MAIN@BAMA.UA.EDU Subject: Racf Reports I have auditor's after me.help! I need a RACF report which will show ID and password interval. I know RACF has a report writer utility, but I don't have time to do the research on how to get the information I need. We are z/OS V1R4. Any help would be appreciated. Thank you -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html CSF Group Plc Registered No: 2646774 Registered Office: Alliance House, 49-51 East Road, London, N1 6AH Tel: 0207 490 2727 www.csf.co.uk This email transmission is confidential and intended solely for the person or organisation to whom it is addressed. If you are not the intended recipient, you must not copy, distribute or disseminate the information, or take any action in reliance of it. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of any organisation or employer. If you have received this message in error, do not open any attachment but please notify the sender deleting this message from your system. Security and reliability of e-mail is not guaranteed. In addition, no liability or responsibility is accepted for viruses and it is your responsibility to scan any attachments. Please note that for business purposes, outgoing and incoming emails from and to the company are monitored and recorded. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
Mark Its been a while but I think the SETR will show what you want - I haven;t got a RACF system to verify. Alan -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
On Fri, 11 Nov 2005 10:47:33 -0600, Mark Steely <[EMAIL PROTECTED]> wrote: >I have auditor's after me.help! I need a RACF report which will show >ID and password interval. I know RACF has a report writer utility, but I >don't have time to do the research on how to get the information I need. >We are z/OS V1R4. Any help would be appreciated. On Fri, 11 Nov 2005 11:23:29 -0600, Alan C. Field <[EMAIL PROTECTED]> wrote: >Mark > >Its been a while but I think the SETR will show what you want - I haven;t >got a RACF system >to verify. > SETRopts LIST will only show you the global value. The interval can be set on a user by user basis. Mark, since you don't have any of the reporting products the best you can do is give the global setting without RYO code. You can unload the RACF DB to a flat file using IRRDBU00 and use whatever programming language you want if you need some report for all userids. There are samples all over the place of using the IRRDBU00 file including a REXX example on my web site (RACFUDEL). You might get a better answer from the RACF-L list. Regards, Mark -- Mark Zelden Sr. Software and Systems Architect - z/OS Team Lead Zurich North America and Farmers Insurance Group mailto: [EMAIL PROTECTED] Systems Programming expert at http://Search390.com/ateExperts/ Mark's MVS Utilities: http://home.flash.net/~mzelden/mvsutil.html -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
Hello. I see that you suffers with the auditors...like me.
First step. Unload from RACF DB to flat file.
//*--
//*HACE UNLOAD DE BASE RACF A UN ARCHIVO PLANO
//*--
//UNLOAD EXEC PGM=IRRDBU00,PARM=NOLOCKINPUT
//SYSPRINT DD SYSOUT=*
//INDD1DD DISP=SHR,DSN=SYS1.NEX0.RACFP
//OUTDDDD DSN=IBMUSER.RACF.PLANO.DB,
//DISP=SHR
//* DISP=(NEW,CATLG,KEEP),
//* UNIT=SYSDA,VOL=SER=NXPP30,
//* SPACE=(CYL,(20,10),RLSE),
//* DCB=(RECFM=VB,LRECL=4096)
Second Step...
//RACFICE EXEC PGM=ICETOOL
//TOOLMSG DD SYSOUT=*
//*PRINTDD SYSOUT=*
//PRINT DD DISP=SHR,DSN=IBMUSER.RACF.LISUSER
//DFSMSGDD SYSOUT=*
//DBUDATA DD DISP=SHR,DSN=IBMUSER.RACF.PLANO.DB
//ADUDATA DD DISP=SHR,DSN=IBMUSER.RACF.PLANO.SMF
//TEMP0001 DD DISP=(NEW,DELETE,DELETE),SPACE=(CYL,(60,10,0))
//*RACFCNTL DD DISP=SHR,DSN=IBMUSER.RACF.IRRICE(USERCNTL)
//RACFCNTL DD *
SORTFIELDS=(10,8,CH,A)
INCLUDE COND=(5,4,CH,EQ,C'0200')
OPTION VLSHRT
/*
//TOOLINDD *
**
* NAME: USER
* BUSCA A LOS USUARIOS Y SUS DATOS MAS RELEVANTES
**
SORTFROM(DBUDATA) TO(TEMP0001) USING(RACF)
DISPLAY FROM(TEMP0001) LIST(PRINT) -
PAGE -
TITLE(' LISTADO USUARIOS DE PRODUCCION ') -
DATE(YMD/) -
TIME(12:) -
BLANK -
ON(010,08,CH)HEADER('USER ID') -
ON(079,20,CH)HEADER('USER NAME ') -
ON(019,10,CH)HEADER('FECHA CREA') -
ON(118,10,CH)HEADER('FEC ULT ACCESO') -
ON(054,03,CH)HEADER('REVOKED') -
ON(044,04,CH)HEADER('ES SPECIAL') -
ON(049,04,CH)HEADER('ES OPERATION')-
ON(390,04,CH)HEADER('ES AUDITOR')
/*
The fields position are descrived in the 7.2.1 from SEcurity Server (RACF)
Macros and Interfaces.
Good Lucky.
Saludos.
Alvaro.
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
In a message dated 11/11/2005 11:35:03 A.M. Central Standard Time, [EMAIL PROTECTED] writes: Mark, since you don't have any of the reporting products the best you can do is give the global setting without RYO code. You can unload the RACF DB to a flat file using IRRDBU00 and use whatever programming language you want if you need some report for all userids. There are samples all over the place of using the IRRDBU00 file including a REXX example on my web site (RACFUDEL). >> I'm not a RACFer per se but I think you just use the panels and drill down to settings. It will produce a flat file that will show active classes and Global settings including password interval. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
Alan, Unfortunately, not what Mark asked for. He needs a list of Userids & each expiry date. SETR will only show the system defaults at Userid creation time. These can be overridden of altered. Mark needs to run a report against the RACF database and list all the Userids and the fields he wants. Kind Regards Mark Wilson Mobile: +44 (0) 7768 617006 -Original Message- From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf Of Alan C. Field Sent: Friday, November 11, 2005 5:23 PM To: IBM-MAIN@BAMA.UA.EDU Subject: Re: Racf Reports Mark Its been a while but I think the SETR will show what you want - I haven;t got a RACF system to verify. Alan -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html CSF Group Plc Registered No: 2646774 Registered Office: Alliance House, 49-51 East Road, London, N1 6AH Tel: 0207 490 2727 www.csf.co.uk This email transmission is confidential and intended solely for the person or organisation to whom it is addressed. If you are not the intended recipient, you must not copy, distribute or disseminate the information, or take any action in reliance of it. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of any organisation or employer. If you have received this message in error, do not open any attachment but please notify the sender deleting this message from your system. Security and reliability of e-mail is not guaranteed. In addition, no liability or responsibility is accepted for viruses and it is your responsibility to scan any attachments. Please note that for business purposes, outgoing and incoming emails from and to the company are monitored and recorded. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
Hopefully the auditors are bilingual!
>>> [EMAIL PROTECTED] 11/11/2005 12:37 PM >>>
Hello. I see that you suffers with the auditors...like me.
First step. Unload from RACF DB to flat file.
//*--
//*HACE UNLOAD DE BASE RACF A UN ARCHIVO PLANO
//*--
//UNLOAD EXEC PGM=IRRDBU00,PARM=NOLOCKINPUT
//SYSPRINT DD SYSOUT=*
//INDD1DD DISP=SHR,DSN=SYS1.NEX0.RACFP
//OUTDDDD DSN=IBMUSER.RACF.PLANO.DB,
//DISP=SHR
//* DISP=(NEW,CATLG,KEEP),
//* UNIT=SYSDA,VOL=SER=NXPP30,
//* SPACE=(CYL,(20,10),RLSE),
//* DCB=(RECFM=VB,LRECL=4096)
Second Step...
//RACFICE EXEC PGM=ICETOOL
//TOOLMSG DD SYSOUT=*
//*PRINTDD SYSOUT=*
//PRINT DD DISP=SHR,DSN=IBMUSER.RACF.LISUSER
//DFSMSGDD SYSOUT=*
//DBUDATA DD DISP=SHR,DSN=IBMUSER.RACF.PLANO.DB
//ADUDATA DD DISP=SHR,DSN=IBMUSER.RACF.PLANO.SMF
//TEMP0001 DD DISP=(NEW,DELETE,DELETE),SPACE=(CYL,(60,10,0))
//*RACFCNTL DD DISP=SHR,DSN=IBMUSER.RACF.IRRICE(USERCNTL)
//RACFCNTL DD *
SORTFIELDS=(10,8,CH,A)
INCLUDE COND=(5,4,CH,EQ,C'0200')
OPTION VLSHRT
/*
//TOOLINDD *
**
* NAME: USER
* BUSCA A LOS USUARIOS Y SUS DATOS MAS RELEVANTES
**
SORTFROM(DBUDATA) TO(TEMP0001) USING(RACF)
DISPLAY FROM(TEMP0001) LIST(PRINT) -
PAGE -
TITLE(' LISTADO USUARIOS DE PRODUCCION ') -
DATE(YMD/) -
TIME(12:) -
BLANK -
ON(010,08,CH)HEADER('USER ID') -
ON(079,20,CH)HEADER('USER NAME ') -
ON(019,10,CH)HEADER('FECHA CREA') -
ON(118,10,CH)HEADER('FEC ULT ACCESO') -
ON(054,03,CH)HEADER('REVOKED') -
ON(044,04,CH)HEADER('ES SPECIAL') -
ON(049,04,CH)HEADER('ES OPERATION')-
ON(390,04,CH)HEADER('ES AUDITOR')
/*
The fields position are descrived in the 7.2.1 from SEcurity Server (RACF)
Macros and Interfaces.
Good Lucky.
Saludos.
Alvaro.
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
> -Original Message- > From: IBM Mainframe Discussion List > [mailto:[EMAIL PROTECTED] On Behalf Of Mark Wilson > Sent: Friday, November 11, 2005 11:40 AM > To: IBM-MAIN@BAMA.UA.EDU > Subject: Re: Racf Reports > > > Alan, > > Unfortunately, not what Mark asked for. > > He needs a list of Userids & each expiry date. > > SETR will only show the system defaults at Userid creation time. These > can be overridden of altered. > > Mark needs to run a report against the RACF database and list all the > Userids and the fields he wants. > > Kind Regards > > Mark Wilson > > Mobile: +44 (0) 7768 617006 The simpliest way, in my opinion: //STEP1 EXEC PGM=IKJEFT01,REGION=6M //SYSTSPRT DD SYSOUT=* //SYSTSIN DD * LU * /* // This will list every RACF id in the RACF database to which the submitting user has authority. It will output the basic RACF information, which includes the PASS-INTERVAL. Example: USER=xx NAME=TECH SERVICES OWNER= CREATED=04.177 DEFAULT-GROUP= PASSDATE=05.259 PASS-INTERVAL= 35 ATTRIBUTES=REVOKED REVOKE DATE=NONE RESUME DATE=NONE LAST-ACCESS=05.259/08:22:21 CLASS AUTHORIZATIONS=NONE NO-INSTALLATION-DATA NO-MODEL-NAME LOGON ALLOWED (DAYS) (TIME) - ANYDAY ANYTIME GROUP= AUTH=USE CONNECT-OWNER= CONNECT-DATE=04.177 CONNECTS=38 UACC=NONE LAST-CONNECT=05.259/08:22:21 CONNECT ATTRIBUTES=NONE REVOKE DATE=NONE RESUME DATE=NONE SECURITY-LEVEL=NONE SPECIFIED CATEGORY-AUTHORIZATION NONE SPECIFIED SECURITY-LABEL=NONE SPECIFIED -- John McKown Senior Systems Programmer UICI Insurance Center Information Technology This message (including any attachments) contains confidential information intended for a specific individual and purpose, and its' content is protected by law. If you are not the intended recipient, you should delete this message and are hereby notified that any disclosure, copying, or distribution of this transmission, or taking any action based on it, is strictly prohibited. -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
On Fri, 11 Nov 2005 11:34:39 -0600, Mark Zelden wrote: > >On Fri, 11 Nov 2005 10:47:33 -0600, Mark Steely wrote: >>I have auditor's after me.help! I need a RACF report which will show >>ID and password interval. I know RACF has a report writer utility, but I >>don't have time to do the research on how to get the information I need. >>We are z/OS V1R4. Any help would be appreciated. > >On Fri, 11 Nov 2005 11:23:29 -0600, Alan C. Field wrote: >>Mark >>Its been a while but I think the SETR will show what you want - I haven;t >>got a RACF system to verify. >> > >SETRopts LIST will only show you the global value. The interval can >be set on a user by user basis. While it is true that the interval can be set on a user by user basis, RACF will NOT honor interval settings that are longer than the global value. (The global value overrides.) Knowing that, the SETR LIST display just might be enough to keep the auditor off your back. (That has been covered on the RACF-L list countless times; check their archives.) You can specify larger values for individual users and RACF will accept them (presumably expecting you to eventually raise the global value and 'eventually' hasn't arrived yet). RACF's acceptance of the larger values does not change the fact that the global value ultimately rules. >Mark, since you don't have any of the reporting products the best you >can do is give the global setting without RYO code. You can unload >the RACF DB to a flat file using IRRDBU00 and use whatever programming >language you want if you need some report for all userids. There are >samples all over the place of using the IRRDBU00 file including a REXX >example on my web site (RACFUDEL). > >You might get a better answer from the RACF-L list. Agreed. -- Tom Schmidt Madison, WI -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
//STEP1 EXEC PGM=IKJEFT01,REGION=6M //SYSTSPRT DD SYSOUT=* //SYSTSIN DD * LU * /* // This has the added benefit of generating so much output the auditor may give up and go away!!! HTH, -- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search the archives at http://bama.ua.edu/archives/ibm-main.html
Re: Racf Reports
Thanks, for every one who responded. The technique below is just what I
needed to produce the reports. Thanks again for the response.
-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of Alvaro Quintupray B.
Sent: Friday, November 11, 2005 11:38 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Racf Reports
Hello. I see that you suffers with the auditors...like me.
First step. Unload from RACF DB to flat file.
//*--
//*HACE UNLOAD DE BASE RACF A UN ARCHIVO PLANO
//*--
//UNLOAD EXEC PGM=IRRDBU00,PARM=NOLOCKINPUT
//SYSPRINT DD SYSOUT=*
//INDD1DD DISP=SHR,DSN=SYS1.NEX0.RACFP
//OUTDDDD DSN=IBMUSER.RACF.PLANO.DB,
//DISP=SHR
//* DISP=(NEW,CATLG,KEEP),
//* UNIT=SYSDA,VOL=SER=NXPP30,
//* SPACE=(CYL,(20,10),RLSE),
//* DCB=(RECFM=VB,LRECL=4096)
Second Step...
//RACFICE EXEC PGM=ICETOOL
//TOOLMSG DD SYSOUT=*
//*PRINTDD SYSOUT=*
//PRINT DD DISP=SHR,DSN=IBMUSER.RACF.LISUSER
//DFSMSGDD SYSOUT=*
//DBUDATA DD DISP=SHR,DSN=IBMUSER.RACF.PLANO.DB
//ADUDATA DD DISP=SHR,DSN=IBMUSER.RACF.PLANO.SMF
//TEMP0001 DD DISP=(NEW,DELETE,DELETE),SPACE=(CYL,(60,10,0))
//*RACFCNTL DD DISP=SHR,DSN=IBMUSER.RACF.IRRICE(USERCNTL)
//RACFCNTL DD *
SORTFIELDS=(10,8,CH,A)
INCLUDE COND=(5,4,CH,EQ,C'0200')
OPTION VLSHRT
/*
//TOOLINDD *
**
* NAME: USER
* BUSCA A LOS USUARIOS Y SUS DATOS MAS RELEVANTES
**
SORTFROM(DBUDATA) TO(TEMP0001) USING(RACF)
DISPLAY FROM(TEMP0001) LIST(PRINT) -
PAGE -
TITLE(' LISTADO USUARIOS DE PRODUCCION ') -
DATE(YMD/) -
TIME(12:) -
BLANK -
ON(010,08,CH)HEADER('USER ID') -
ON(079,20,CH)HEADER('USER NAME ') -
ON(019,10,CH)HEADER('FECHA CREA') -
ON(118,10,CH)HEADER('FEC ULT ACCESO') -
ON(054,03,CH)HEADER('REVOKED') -
ON(044,04,CH)HEADER('ES SPECIAL') -
ON(049,04,CH)HEADER('ES OPERATION')-
ON(390,04,CH)HEADER('ES AUDITOR')
/*
The fields position are descrived in the 7.2.1 from SEcurity Server
(RACF) Macros and Interfaces.
Good Lucky.
Saludos.
Alvaro.
--
For IBM-MAIN subscribe / signoff / archive access instructions, send
email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO Search
the archives at http://bama.ua.edu/archives/ibm-main.html
--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html
