Securing Functions

CA SMF Director can provide SMF and RMF records containing performance and accounting information to anyone. Therefore, it may be necessary to restrict certain functions of this product from certain users.

The functions of this product can be secured by using an external security product such as CA TOP SECRET, CA ACF2, or IBM's RACF. The resource class CA$MSMF must be defined to the external security product prior to using CA SMF Director. IBM RACF customers accomplish this using the ICHERCDE macro to modify the Class Descriptor Table (CDT) and the ICHRFRTB macro to modify the RACF Router Table. CA TOP SECRET customers should modify their Resource Definition Table (RDT) using the TSS ADD(RDT) command. CA ACF2 customers should create a CLASMAP and GSO SAFDEF records. For more details, see the administrator guide for the security product.

The resource class CA$MSMF must allow alphanumeric resource names up to 20 characters in length, and access levels of UPDATE, READ or NONE. CA SMF Director issues a RACROUTE REQUEST=AUTH using the resource class of CA$MSMF, application id of SMFDIR, and an ENTITY name (resource name) consisting of the format: PRM.xxxxxx or CMD.xxxxxx. 'PRM' indicates that the function was requested via the JCL EXEC PARM keyword, whereas 'CMD' represents the function was requested via the SYSIN data set.

We recommend that the default for the CA$MSMF resource class should be to disallow access. To allow use of this function, the following resources must be defined or permitted to the user's security record:

If the CASFDUMP procedure is started by operators or via the auto dump feature, then the default batch or STC security record must contain permissions to PRM.DUMP and/or CMD.DUMP. If other functions will be performed by the CASFDUMP procedure such as backup or restore, security permissions must also be allowed.

The following example illustrates how a CA TOP SECRET security Administrator might define this product to the security system and allow John Doe to perform PRINT or EXTRACT requests only:

TSS ADD (RDT) RESCLASS (CA$MSMF) RESCODE (XX) MAXLEN (20) ATTR (MASK)
 ACLST (READ=4000, UPDATE=8000, NONE=0000, ALL=FFFF)

The above CA TOP SECRET command can be used as an example of how to update the Resource Descriptor Table. The resource class is CA$MSMF for CA SMF Director. An available resource code should be selected by the user.

The following CA Top Secret commands define the ownership of resources to an already existing user USER01.

TSS ADD (USER01) CA$MSMF (PRM)

TSS ADD (USER01) CA$MSMF (CMD)

The following CA Top Secret commands remove access to all users, and define access for JOHNDOE to the EXTRACT and PRINT commands.

The next example illustrates how a RACF security administrator would define CA SMF Director to RACF. The class descriptor table is used to describe resource classes to be used by this product.

ICHERCDE  CLASS=CA$MSMF,               X
      id=128,                          X
      FIRST=ALPHA,                     X
      OTHER=ANY,                       X
      POSIT=25,                        X
      MAXLNTH=20,                      X
      DFTUACC=NONE

For the RACF router table enter the following:

ICHRFRTB  CLASS=CA$MSMF,               X
       ACTION=RACF

Use the RACF RDEFINE command to define all RACF resources belonging to the new classes specified in the class descriptor table.

When using an external security product to secure the CA SMF Director functions, the security product will either allow or deny access to the resources mentioned above. If the security product denies access to a resource, CA SMF Director will not continue to process the command. A message is issued indicating that authority was denied for the request and a return code of 12 is set.

By default this product requires update access to the SCDS file. Specifying PARM=READ on the EXEC statement calling program SMFD will allow this product to process functions that require read only access. This can be done provided that the external security product will grant access to the SCDS file, any related programs, and the specific function to be processed. Functions that require SCDS Update access will fail with a message that READONLY processing was requested.

In addition to defining the above resources, the security product must allow access to the CA SMF Director programs, the SCDS file and SMF history files. The DUMP function requires create access for the SMF history files, with update access to the SCDS file. Read access to the SMF history files for the EXTRACT and PRINT functions are needed.

The following commands require UPDATE access to the SCDS file. Use these commands to perform the specified actions.

BEGIN

start a series of configuration commands.

COMPILE

compile the configuration definition.

END

end the configuration definition.

STREAMOPTIONS

define specifications for SMF history files for a specific stream.

DUMPOPTIONS

define specifications for SMF history files for each system.

OPTIONS

define specifications for all systems.

DUMPTAPES

modify the pool of tapes available for dumped SMF data.

TAPEINIT

switch the current dump tape.

DUMP

empty the contents of one or more SMF files.

SPLIT

generate application-ready SMF files while dumping.

ADDX

add index entries of SMF data.

DELETEX

remove one index entry of SMF data at a time.

UPDTX

modify a range of index entries.

The following commands require READ access to the SCDS file. Use these commands to perform the specified actions.

EXTRACT

copy SMF data to be processed by another product.

PRINT

print SMF data.

LISTC

list configuration information for one or more SIDs.

LISTH

list index information for SMF history files.

SOURCE

redefine the input source of data to be used in processing by CA SMF Director.

CHECKIT

to be used as a diagnostic tool used to display SCDS records in dump format.