Reports for RACF

From the navigation bar at the top of the window, you can select and display different types of information in BMC AMI Security Policy Manager:

Related topic

Using

For details about the Tools menu, see Administering.

Tip

If your browser window is too narrow to see all the values in the report, click the + icon reportMore.pngat the beginning of the row. The column headings and values show below the row, as displayed in the following example:

reportMore_values.png

Click the - icon reportLess.pngto collapse the row.

Data sets

Click Data sets and select one of the following reports to display information about sensitive data sets:

Non-Fully Qualified Generic > APF

APF Data Sets without Fully Qualified Generic profile

This option lists all APF data sets that do not have a Fully Qualified Generic data set profile defined in RACF:

System

Data set name

Protecting Profile

RSMP

SYS1.SVCLIB

SYS1.**

RSMP

AZF.SAZFLOAD

AZF.**

RSMP

CBC.SCLBDLL

CBC.**

RSMP

CBC.SCLBDLL2

CBC.**

Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

RACF profile that protects the data set

Non-Fully Qualified Generic > Other

Other Data Sets with Non-Fully Qualified Generic profiles

This option lists all other sensitive data sets that do not have a fully qualified generic data set profile defined in RACF:

System

Data set Name

Protecting Profile

Data set Type

RSMP

SYS1.LINKLIB.EXITS

SYS1.**

LINK

RSMP

USER.LINKLIB

USER.**

LINK

RSMP

SYS1.SIEALNKE

SYS1.**

LINK

RSMP

SYS1.SIEAMIGE

SYS1.**

LINK

Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

Non-fully qualified generic RACF profile that is protecting the data set

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Data Sets > UACC > None

Sensitive Data Sets with UACC > None

This option lists all RACF data set profiles with a universal access (UACC) greater than NONE for sensitive data sets:

System

Data set Name

Protecting Profile

UACC

Data set Type

RSMP

CICSTS52.CICS.SDFHAUTH

CICSTS52.**

Read

APF

RSMP

CICSTS52.CICS.SDFHLIC

CICSTS52.**

Read

APF

RSMP

CICSTS52.CICS.SDFJAUTH

CICSTS52.**

Read

APF

RSMP

CICSTS52.CPSM.SEYUAUTH

CICSTS52.**

Read

APF

Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

Non-fully qualified generic RACF profile that is protecting the data set

UACC

Universal ACCess of the sensitive data set

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Data Sets > ID(*) > None

Sensitive Data Sets with ID(*) > None

This option lists all RACF data set profiles with ID(*) greater than NONE:

System

Data set Name

Protecting Profile

ID(*)

Data set Type

RSMP

SYS1.LINKLIB

SYS1.LINKLIB

Read

APF

RSMP

AZF.SAZFLOAD

AZF.**

Read

APF

RSMP

CBC.SCLBDLL

CBC.**

Read

APF

RSMP

CBC.SCLBDLL2

CBC.**

Read

APF

Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

Non-fully qualified generic RACF profile that is protecting the data set

ID(*)

Default access for defined users

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Data Sets > WARN

Sensitive Data Sets with WARN

This option lists all RACF data set profiles that are in WARNING mode:

System

Data set Name

Protecting Profile

Data set Type

RSMP

ISVR.RSS.LOADLIB

ISVR.RSS.**

APF

RSMP

ISVR.RSS.SSPR.V2R1M0.RSMLOAD

ISVR.RSS.**

APF

RSMP

ISVR.RSS.VIA.V2R1M0.RSMLOAD

ISVR.RSS.**

APF

RSMP

ISVR.RSS.V2R1M0.RSMLOAD

ISVR.RSS.**

APF


Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

RACF profile that is protecting the data set

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Data Sets > Uncatalogued

Uncatalogued Sensitive Data Sets

This option lists all RACF Uncatalogued Sensitive Data sets:

System

Data set Name

Protecting Profile

Data set Type

RSMP

ISVR.CA.SYSVIEW.V15R00.CNM4BLOD

ISVR.CA.SYSVIEW.**

APF

RSMP

ISVR.COMPWARE.CPWR.MPAA170.SPAAAUTH

ISVR.COMPWARE.**

APF

RSMP

ISVR.COMPWARE.CPWR.MKAZ170.SKAZAUTH

ISVR.COMPWARE.**

APF

RSMP

ISVR.COMPWARE.CPWR.MKFX171.SKFXAUTH

ISVR.COMPWARE.**

APF


Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

RACF profile that is protecting the data set

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Data Sets > Inappropriate Audit

Sensitive Data Sets with Inappropriate Audit

This option lists all RACF data set profiles for sensitive data sets that do not comply with the recommended best practices for audit settings:

System

Data set Name

Protecting Profile

Audit S/F?

Data set Type

RSMP

SYS1.SVCLIB

SYS1.**

-/R

APF

RSMP

CBC.SCLBDLL

CBC.**

-/R

APF

RSMP

CBC.SCLBDLL2

CBC.**

-/R

APF

RSMP

CSF.SCSFMOD0

CSF.**

-/R

APF


This relates to the audit settings, e.g. Success(UPDATE) and Fail(READ), often abbreviated to S/F. This display shows the Audit Level (both Successes and Failures) in a three-character format: a success level, a forward slash, a failures level.

Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

RACF profile that is protecting the data set

AUDIT S/F?

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Data Sets > Level=99

Sensitive Data Sets with Level = 99

This option lists all data sets with a RACF level of 99:

System

Data set Name

Protecting Profile

Volume

Creation Date

Referenced Date

Catalogued?

SMS?

APF?

UACC

ID(*)

Fully Qualified Generic?

Warning?

Audit S/F

Data set Type

RSMP

ISVR.RSS.SUE.QA.TEST

ISVR.RSS.SUE.**

TISV08

29/01/2019

1900-01-00

Y

Y

Y

Read

Read

N

Y

R/R

APF

RSMP

TSGNJC.TEST.XMIT

TSGNJC.TEST.**

TTSO01

16/01/2019

16/01/2019

Y

Y

Y

None


N

N

-/R

APF

Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

RACF profile that is protecting the data set

VOLUME

Volume Serial number

CREATION DATE

Date of data set creation

REFERENCED DATE

Date last referenced

CATALOGED?

Whether the data set is cataloged

SMS?

Whether the data set SMS is controlled

APF?

APF Library Indicator

UACC

Universal ACCess for undefined user IDs

ID(*)

Default access for defined user IDs

FULLY QUALIFIED GENERIC?

FQG indicator

WARNING?

Whether the profile has the WARNING attribute

AUDIT S/F

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Data Sets > All

All Sensitive Data Sets

This option lists all sensitive data sets and includes any relevant information:

System

Data set Name

Protecting Profile

Volume

Creation Date

Referenced Date

Cataloged?

SMS?

APF?

UACC

ID(*)

Fully Qualified Generic?

Warning?

Level

Audit S/F

Data set Type

RSMP

CATALOG.CICS.UCAT.Z210

CATALOG.**

CPWRK3

18/12/2014

06/02/2019

Y



None

Read

N

N

0

-/R

UCAT

RSMP

CATALOG.EXPRESS.SMPE.UCAT

CATALOG.**

SYS001

11/02/2019

12/02/2019

Y



None

Read

N

N

0

-/R

UCAT

RSMP

CATALOG.FDRPAS.SHARED

CATALOG.**

IODF01

17/11/2017

06/02/2019

Y



None

Read

N

N

0

-/R

UCAT

RSMP

CATALOG.IMS.USER

CATALOG.**

PTSG06

11/12/2015

06/02/2019

Y



None

Read

N

N

0

-/R

UCAT

Column

Description

SYSTEM

System ID from which the record was written

DATASET NAME

Name of the data set

PROTECTING PROFILE

RACF profile that is protecting the data set

VOLUME

Volume serial number

CREATION DATE

Date of data set creation

REFERENCED DATE

Date last referenced

CATALOGED?

Whether the data set is cataloged or not

SMS?

Whether the data set SMS is controlled

APF?

APF library indicator

UACC

Universal ACCess for undefined user IDs

ID(*)

Default access for defined user IDs

FULLY QUALIFIED GENERIC?

FQG indicator

WARNING?

Whether the profile has the WARNING attribute

LEVEL

Data set level

AUDIT S/F

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

DATASET TYPE

Type of sensitive data set being reported on, such as APF or Link

Sensitive Commands

Click Sensitive Commands and select one of the following reports to display information about sensitive commands:

MVS.SETPROG

MVS.SETPROG Commands

Lists all MVS SETPROG commands issued in the system and related information:

System

Date

Time

Userid

Name

From

Event

Command

Details

RSMP

12/02/2019

13:37:46

REXXBAT

Unknown

CONSOLE

CONS

SETPROG APF,ADD,DSN=ISVR.RSS.QA.ZDT.RSMLOAD,VOL=NC3998

System Command

RSMP

12/02/2019

13:37:45

REXXBAT

Unknown

CONSOLE

CONS

SETPROG APF,ADD,DSN=ISVR.RSS.QA.ZDT.RSMLOAD,VOL=NC3997

System Command

RSMP

12/02/2019

13:37:44

REXXBAT

Unknown

CONSOLE

CONS

SETPROG APF,ADD,DSN=ISVR.RSS.QA.ZDT.RSMLOAD,VOL=NC3996

System Command

RSMP

12/02/2019

13:37:43

REXXBAT

Unknown

CONSOLE

CONS

SETPROG APF,ADD,DSN=ISVR.RSS.QA.ZDT.RSMLOAD,VOL=NC3995

System Command

Column

Description

SYSTEM

System ID from which the record was written

DATE

Date the command was executed

TIME

Time the command was executed

USERID

User ID that issued the command

NAME

Name of the user, if available

FROM

Where the command was entered

EVENT

Internal event type or SMF Event and Event Qualifier

Event refers to the SMF Event/Code Qualifier documented in the IBM SMF manuals, or CONS for a command entered at the system console.

COMMAND

Command that was entered

DETAILS

Internal event type

SETROPTS


Lists all RACF SETROPTS commands issued in the system and related information:

System

Date

Time

Userid

User Name

Port Of Entry

Event

Description

Command Image

RSMP

14/02/2019

12:15:59

AUSER

Fred Smith

A05TCP45

1800

SETROPTS command

SETROPTS RACLIST(XFACILIT) REFRESH

RSMP

14/02/2019

12:14:15

BUSER

Dave Jones

A05TCP57

1800

SETROPTS command

SETROPTS GENERIC(DATASET) REFRESH

RSMP

14/02/2019

12:11:29

CUSER

Bert Williams

A05TCP34

1800

SETROPTS command

SETROPTS RACLIST(STARTED) REFRESH

RSMP

14/02/2019

12:09:23

DUSER

Tina Brown

A05TCP19

1800

SETROPTS command

SETROPTS RACLIST(OPERCMDS) REFRESH

Column

Description

SYSTEM

System ID from which the record was written

DATE

Date the command was executed

TIME

Time the command was executed

USERID

User ID that issued the command

USER NAME

Name of the user, if available

PORT OF ENTRY

Where the command was entered

EVENT

Internal event type or SMF event and event qualifier

Event refers to the SMF event/code qualifier documented in the IBM SMF manuals, or CONS for a
command entered at the system console.

DESCRIPTION

Command that was entered

COMMAND IMAGE

Internal event types

All MVS Commands

Lists all MVS commands issued in the system and related information:

System

Date

Time

Userid

User Name

Port Of Entry

Event

Description

Command Image

RSMP

14/02/2019

12:15:59

AUSER

Fred Smith

A05TCP45

1800

SETROPTS command

SETROPTS RACLIST(XFACILIT) REFRESH

RSMP

14/02/2019

12:14:15

BUSER

Dave Jones

A05TCP57

1800

SETROPTS command

SETROPTS GENERIC(DATASET) REFRESH

RSMP

14/02/2019

12:11:29

CUSER

Bert Williams

A05TCP34

1800

SETROPTS command

SETROPTS RACLIST(STARTED) REFRESH

RSMP

14/02/2019

12:09:23

DUSER

Tina Brown

A05TCP19

1800

SETROPTS command

SETROPTS RACLIST(OPERCMDS) REFRESH

Column

Description

SYSTEM

System ID from which the record was written

DATE

Date the command was executed

TIME

Time the command was executed

USERID

User ID that issued the command

USER NAME

Name of the user, if available

PORT OF ENTRY

Where the command was entered

EVENT

Internal event type or SMF event and event qualifier

Event refers to the SMF event/code qualifier documented in the IBM SMF manuals, or CONS for a
command entered at the system console.

DESCRIPTION

Command that was entered

COMMAND IMAGE

Internal event types

Resources

Click Resources and select one of the following reports to display information about RACF general resources:

Missing Profiles > OPERCMD

Lists all recommended OPERCMD profiles that are missing and should be defined to RACF by the Mainframe Security team:

Class

Profile

Purpose

Recommended

OPERCMDS

MVS.SET.PROG.**

Modify APF Libraries

Access must be limited to authorized personnel only. Preferably only accessible via Security PAM ids. Should have UACC(NONE) and AUDIT(SUC(READ) FAIL(READ))


Column

Description

CLASS

RACF class

PROFILE

OPERCMDS profile

PURPOSE

Purpose of the RACF profile

RECOMMENDED

BMC recommendations

Missing Profiles > STGADMIN

Lists all recommended STGADMIN profiles that are missing and should be defined to RACF by the Mainframe Security team:

Class

Profile

Purpose

Recommended

FACILITY

STGADMIN.ADR.CONVERTV

Convert VTOC to SMS

Require READ access to use. Restrict access to this

FACILITY

STGADMIN.ADR.COPY.BYPASSACS

Copy data sets bypassing ACS routines

Require READ access to use. Restrict access to this

FACILITY

STGADMIN.ADR.COPY.INCAT

INCAT processing

Require READ access to use. Restrict access to this

FACILITY

STGADMIN.ADR.COPY.PROCESS.SYS

Copy SYS1 data sets

Require READ access to use. Restrict access to this


Column

Description

CLASS

RACF class

PROFILE

STGADMIN profile

PURPOSE

Purpose of the RACF profile

RECOMMENDED

BMC recommendations

Missing Profiles > UNIXPRIV

Lists all recommended UNIXPRIV profiles that are missing and should be defined to RACF by the Mainframe Security team:

Class

Profile

Purpose

Recommended

UNIXPRIV

SUPERUSER.IPC.RMID

Release IPC resources (ipcrm)

Require READ access to use. Limit to UNIX processes/debuggers

UNIXPRIV

SUPERUSER.PROCESS.KILL

Issue kill to processes

Require READ access to use. Limit to UNIX processes/debuggers

UNIXPRIV

SUPERUSER.PROCESS.PTRACE

Use ptrace through dbx debugger

Require READ access to use. Limit to UNIX processes/debuggers

UNIXPRIV

SUPERUSER.SETPRIORITY

Increase own priority

Require READ access to use. Limit to Storage Admin Group


Column

Description

CLASS

RACF class

PROFILE

UNIXPRIV profile

PURPOSE

Purpose of the RACF profile

RECOMMENDED

BMC recommendations

Missing Profiles > FACILITY/STGADMIN due to Catch-All Profile

Lists all missing RACF profiles from classes FACILITY and STGADMIN that are being overlooked due to the UACC being greater than NONE or ID(*) being defined in the access control list (ACL) with access greater than NONE:

Class

Profile

Purpose

Recommended

FACILITY

STGADMIN.IDC.DIAGNOSE.CATALOG

Run DIAGNOSE command against catalogs

Require READ access to use. Restrict access to this

FACILITY

STGADMIN.IDC.DIAGNOSE.VVDS

DIAGNOSE command against a VVDS

Require READ access to use. Restrict access to this

FACILITY

STGADMIN.IDC.EXAMINE.DATASET

Allows use of the IDCAMS EXAMINE command

Require READ access to use. Restrict access to this

FACILITY

STGADMIN.IGG.ALTER.SMS

Allows Storage Class or Management Class to be altered

Require READ access to use. Restrict access to this


Column

Description

CLASS

RACF class name

PROFILE

RACF profile

PURPOSE

Profile purpose

RECOMMENDED

BMC recommendations

Missing Profiles > Command Verifier

Class

CV Profile

Purpose

Recommended

XFACILIT

C4R.EXEMPT

Allows certain users to be exempt from policy enforcement

If you are installing Command Verifier for the first time, ensure that 1 or 2 users are permitted

XFACILIT

C4R.USER.ATTR.AUDITOR.**

Prevents system AUDITOR from being granted to users

Very few users should have this access

Set default universal access authority (UACC) to NONE.

XFACILIT

C4R.USER.ATTR.OPERATIONS.**

Prevents system OPERATIONS from being granted to users

Very few users should have this access

Set UACC to NONE.

XFACILIT

C4R.USER.ATTR.SPECIAL.**

Prevents system SPECIAL from being granted to users

Very few users should have this access

Set UACC to NONE.

Column

Description

CLASS

Class name to which the profile belongs

CV Profile

Command verifier profile

Purpose

Profile owner

Recommended

BMC recommendations for this setting

Missing Profiles > Certificate

Lists all the recommended general resource profiles related to digital certificates that are not defined to RACF:

Class

Missing Profile

Recommended Setting

FACILITY

IRR.DIGTCERT.**

Set UACC/ID(*) to NONE. READ allows users to issue the RACDCERT commands for themselves, UPDATE for others and CONTROL for SITE and CERTAUTH certificates

FACILITY

IRR.DIGTCERT.CHECKCERT

Set UACC/ID(*) to NONE. READ allows users to issue the RACDCERT commands for themselves, UPDATE for others and CONTROL for SITE and CERTAUTH certificates


Column

Description

CLASS

RACF class

MISSING PROFILE

Missing RACF profile

RECOMMENDED SETTING

BMC recommended profile

Certificates > All Profiles

Lists all general resource profiles related to digital certificates defined to RACF:

Data set Name

Protecting Profile

Owner

UACC

Warning?

Audit S/F

ID(*)

Level

ACL count

FACILITY

IRR.DIGTCERT.*

TSGDL

None

N

/R


0


FACILITY

IRR.DIGTCERT.ADD

TSGCG

None

N

/R

R

0

7

FACILITY

IRR.DIGTCERT.ADDRING

TSGCG

None

N

/R

R

0

7

FACILITY

IRR.DIGTCERT.ALTER

TSGCG

None

N

/R

R

0

7

Column

Description

CLASS

RACF class

PROTECTING PROFILE

RACF profile

OWNER

Profile owner

UACC

RACF universal ACCess setting

WARNING?

Whether the WARNING attribute is on

AUDIT S/F

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

ID(*)

Default access for the profile

LEVEL

Resource level

ACL COUNT

Number of users on the access list

Certificates > Expiring

Lists all digital certificates defined to RACF that are about to expire:

Class

Profile

Remaining

Expiry Date

DIGTCERT

00.CN=RSMP?TEST.T=RSS.OU=RSM?PARTNERS?LTD.O=RSM.L=STOKE?POUND.SP=BROMSGROVE.C=GB

106

01/06/2019

DIGTCERT

01.CN=RSMP?TEST.T=RSS.OU=RSM?PARTNERS?LTD.O=RSM.L=STOKE?POUND.SP=BROMSGROVE.C=GB

106

01/06/2019

DIGTCERT

4AA7268B.CN=CA?Receive?Order.OU=CA?Receive?Order

207

10/09/2019

DIGTCERT

00.CN=CKNCA.OU=ZSECURE.O=IBM.C=US

349

30/01/2020

Column

Description

CLASS

RACF class

PROFILE

Profile name

REMAINING

Number of days until the certificate expires

EXPIRY DATE

Certificate expiry date

Certificates > Expired

Lists all digital certificates defined to RACF that have expired:

Class

Profile

Days

Expired date

DIGTCERT

01.CN=Root?CA?Test.OU=Technology.O=Test.L=Glasgow.SP=Scotland.C=GB

-99

07/11/2018

DIGTCERT

35DEF4CF.OU=Equifax?Secure?Certificate?Authority.O=Equifax.C=US

-176

22/08/2018

DIGTCERT

01A3.CN=GTE?CyberTrust?Root.O=GTE?Corporation.C=US

-4739

23/02/2006

DIGTCERT

03.CN=GTE?CyberTrust?Root.O=GTE?Corporation.C=US

-4792

01/01/2006


Column

Description

CLASS

RACF class

PROFILE

Profile name

DAYS

Number of days after the certificate expired

EXPIRED DATE

Date the certificate expired

Misconfigured Settings > CICS SIT

Lists the security settings defined in the CICS system initialization table (SIT) that conflict with BMC recommendations:

Region

Setting

Current

Recommended

Purpose

Notes

CICSTS55

CONFDATA

Show

HIDETC

Determines whether user data to appear in traces or dumps. This data could be used to penetrate the system.

Default is SHOW. This may have SOX implications

CICSTS55

CONFTXT

No

Yes

Determines whether user data to appear in traces or dumps. This data could be used to penetrate the system.

Default is NO VTAM can trace user data.

CICSTS55

GMTRAN

CESN

CSGM

Specifies the initial transaction that will be executed.

Default is CSGM. Specify an ATI transaction that will be run.

CICSTS55

SECPRFX

No

Yes

This parameter allows for segregation of access to separate regions. CICS will prefix all resource names with the CICS userid ID when talking to the ESM

YES is generally recommended if multiple CICS systems are running.


Column

Description

Region

CICS region name

Setting

System name

Current

Current value

Recommended

BMC recommended value

Purpose

Description of the purpose of the setting

Notes

Supplementary notes regarding the BMC recommendation

Misconfigured Settings > IMS

Lists the security settings defined in the IMS system initialization table (SIT) that conflict with BMC recommendations:

Region

Setting

Current

Recommended

Purpose

Notes







Column

Description

Region

IMS region name

Setting

System name

Current

Current value

Recommended

BMC recommended value

Purpose

Description of the purpose of the setting

Notes

Supplementary notes regarding the recommendation

Misconfigured Settings > DB2

Lists the security settings defined in the DB2 SIT that conflict with BMC recommendations:

System

Region

Setting

Current

Recommended

Purpose

Notes








Column

Description

System

System name where the DB2 region is running

Region

Db2 region name

Setting

System name

Current

Current value

Recommended

BMC recommended value

Purpose

Description of the purpose of the setting

Notes

Supplementary notes regarding the recommendation

Misconfigured Settings > MQ

Lists the security settings defined in the MQ SIT that conflict with BMC recommendations:

System

Region

Setting

Current

Recommended

Purpose

Notes








Column

Description

System

System name where the MQ region is running

Region

MQ region name

Setting

System name

Current

Current value

Recommended

BMC recommended value

Purpose

Description of the purpose of the setting

Notes

Supplementary notes regarding the recommendation

Software Security Settings > CICS SIT

Lists the security settings defined in the CICS system initialization table (SIT) of each active CICS region:

System

Region

Parameter

Current setting

RSMP

CICSTS51

AIEXIT

DFHZATDX

RSMP

CICSTS51

APPLIDG

A05CICS1

RSMP

CICSTS55

APPLIDG

A


Column

Description

SYSTEM

System name where the CICS region is running

REGION

CICS region name

PARAMETER

SIT initialization parameter

CURRENT SETTING

Current setting

Software Security Settings > IMS

Lists the security settings defined in the IMS SIT of each active IMS region:

System

Region

Parameter

Current setting






Column

Description

SYSTEM

System name where the IMS region is running

REGION

IMS region name

PARAMETER

SIT initialization parameter

CURRENT SETTING

Current setting

Software Security Settings > DB2

Lists the security settings defined in the DB2 SIT of each active DB2 region:

System

Region

Parameter

Current setting






Column

Description

SYSTEM

System name where the IMS region is running

REGION

IMS region name

PARAMETER

SIT initialization parameter

CURRENT SETTING

Current setting

Software Security Settings > MQ

Lists the security settings defined in the MQ SIT of each active MQ region:

System

Region

Parameter

Current setting

RSMN

QCBAMSTR

ACTIVE

Yes

RSMN

QCBAMSTR

ACTIVE

No

RSMN

QCBAMSTR

ACTIVE

No

RSMN

QCBAMSTR

ACTIVE

No


Column

Description

SYSTEM

System name where the MQ region is running

REGION

MQ region name

PARAMETER

Parameter name

CURRENT SETTING

Current setting

Profiles with Inappropriate Audit

Lists all general resource profiles that do not comply with the recommended audit settings:

Class

Profile

Owner

UACC

Warn

Audit S/F

ID(*)

Level

# on ACL

Cert Start

Cert End

DIGTCERT

023456.CN=GeoTrust?Global?CA.O=GeoTrust?Inc..C=US

TSGAT

T

N

/


0


21/05/2002

21/05/2022

FACILITY

AOPADMIN

IBMUSER

N

N

/R


0

1



FACILITY

AP

#OPSMVS

N

N

/R


0

1



FACILITY

BPX.CONSOLE

TSGSJ

N

N

/R


0

8



Column

Description

CLASS

RACF class

PROFILE

RACF profile

OWNER

Profile owner

UACC

Universal ACCess for undefined user IDs

WARN

Whether the WARNING attribute is on

AUDIT S/F

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

ID(*)

Default access for defined user IDs

LEVEL

The level from the RACF profile definition

# ON ACL

Number of users on the access list (ACL)

CERT START

Start date if a certificate

CERT END

End date if a certificate

All Profiles

Lists all general resource profiles from the recommended RACF classes:

Class

Profile

Owner

UACC

Warn

Audit S/F

ID(*)

Level

on ACL

Cert Start

Cert End

DIGTCERT

00.CN=CKNCA.OU=ZSECURE.O=IBM.C=US

TSGTS

T

N

/


0


24/05/2018

30/01/2020

FACILITY

AOPADMIN

IBMUSER

N

N

/R


0

1



FACILITY

AP

#OPSMVS

N

N

/R


0

1



FACILITY

BPX.CONSOLE

TSGSJ

N

N

/R


0

8



Column

Description

CLASS

RACF class

PROFILE

RACF profile

OWNER

Profile owner

UACC

Universal ACCess for undefined user IDs

WARN

Whether the WARNING attribute is on

AUDIT S/F

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

ID(*)

Default access for defined user IDs

LEVEL

Level from the RACF profile definition

  1. ON ACL

Number of users on the access list (ACL)

CERT START

Start date if a certificate

CERT END

End date if a certificate

Global Access Table

Lists all RACF definitions defined in the Global Access Table (GAT):

Class

Profile

Entry

Access

GLOBAL

DATASET

&RACUID.**

A

GLOBAL

DATASET

SYS1.**

R

GLOBAL

DATASET

SYS1.HELP

R

GLOBAL

DATASET

SYS1.MARK

R


Column

Description

CLASS

RACF class – GLOBAL

PROFILE

RACF profile type

ENTRY

Global table entry member

ACCESS

Global access:

  • A (ALTER)
  • R (READ)

:


System Settings

Click System Settings and select one of the following reports to display information about your RACF and z/OS environment:

PPT > Entries Specifying NOPASS

Lists all Program Properties Table (PPT) entries that have NOPASS specified in z/OS PARMLIB member SCHEDxx:

System

Program

RSMP

EPWINIT

Column

Description

SYSTEM

System name

PROGRAM

Program that has NOPASS in the PPT

PPT > Entries Defined as NOSWAP

Lists all Program Properties Table (PPT) entries that have NOSWAP defined in z/OS PARMLIB member SCHEDxx:

System

Program

Key

RSMP

AZFSTCMN

2

RSMP

BNJLINTX

8

RSMP

BPEINI00

7

RSMP

BPXBATA2

2


Column

Description

SYSTEM

System name

PROGRAM

Program name in the PPT

KEY

MVS storage protect key that the program runs under and has been defined in the MVS PPT

Misconfigured Settings

Lists all RACF and z/OS settings that are potential vulnerabilities on your system:

System

Type

Setting

Current Value

Recommended

Description

Notes

RSMP

PASSWORD

INTERVAL

30

90

Number of days before user must change password (1-254).

Specify as PASSWORD( INTERVAL(nn)). nn should be <=90

RSMP

PASSWORD

MINCHANGE

0

1

Number of days before user can change password again (0-254).

Specify as PASSWORD(MINCHANGE(nn)). nn should be >=1

RSMP

SETROPTS

APPLAUDIT

NOAPPLAUDIT

APPLAUDIT

Enables auditing of APPC transactions

Set as APPLAUDIT

RSMP

SETROPTS

GENERICOWNER

NOGENERICOWNER

GENERICOWNER

Restricts creation of more specific undercutting profiles

Specify GENERICOWNER


Column

Description

SYSTEM

System LPAR name

TYPE

Setting type

Type is either 'SETROPTS', 'PASSWORD', 'SMF' or 'SYSTEM' and
denotes the category of the setting that has been misconfigured.

SETTING

Setting name

CURRENT VALUE

Current value of the setting from storage

RECOMMENDED

Recommended setting

DESCRIPTION

Description of the setting

NOTES

Notes and recommendations

All Settings

System

Type

Setting

Current Value

RSMN

PASSWORD

HISTORY

6

RSMN

PASSWORD

INTERVAL

30

RSMN

PASSWORD

MINCHANGE

0

RSMN

PASSWORD

MIXEDCASE

MIXEDCASE

Column

Description

SYSTEM

System name

TYPE

Setting type

SETTING

Setting name

CURRENT VALUE

Current value of the setting from storage

STC Entries with Unprotected User ID

Lists all started tasks defined to RACF that have unprotected user IDs:

System

Profile

Stuser

Stgroup

Privileged

Trusted

Traced

LPAR1

BPXAS.*

OMVSKERN

OMVSGRP




LPAR1

FTPD.*

FTPD





LPAR2

TCPIP.*

TCPIP

OMVSGRP


Yes


LPAR3

TN3270.*

TN3270

OMVSGRP


Yes



Column

Description

SYSTEM
(SPE2304)

System name

PROFILE

Started task profile name

STUSER

Started task user IDs associated with the profile

STGROUP

Started task group associated with the profile

PRIVILEGED

Whether the task is privileged

TRUSTED

Whether the task is trusted

TRACED

Whether the task is traced

Inactive Monitored Jobs

Lists all jobs marked for monitoring in Security Policy Manager that are not currently running:

System

Job not running

RSMP

RSSTAM

RSMP

CICSTS42


Column

Description

SYSTEM

System name

JOB NOT RUNNING

Name of the monitored job that appears not to be running

Users

Click Users and select one of the following reports to display information about RACF users:

Specific User Activity

With the Specific User Activity report, you can fetch information about a specific user. Select the report, enter the user ID you want to query, and click Submit.

The report lists detailed user activity, as displayed in the following example:

detailedUserActivity.png

Weak Passwords

Lists all RACF users that have weak passwords defined:

Userid

Name

Default Group

Special

Operations

Password Security Level

Generations

AUSER

Tina Smith

GRPAUSR

Y


1

4

BUSER

Fred Brown

GRPAUSR



1

2

CUSER

Ann Williams

GRPAUSR



3

6

DUSER

Dave Jones

GRPAUSR

Y


2

2


Column

Description

USERID

User ID

NAME

Associated name, if available

DEFAULT GROUP

User ID default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

PASSWORD SECURITY LEVEL

Type of weak password detected

Contact BMC Support for details.

GENERATIONS

Number of passwords in the password history

You can also show if the account has ever been used.

Special and Audit

Lists all RACF users that have system special and system audit attributes:

Userid

Name

Default Group

Special

Operations

Auditor

AUSER

Austin Smith

#RSM

Y


Y

BUSER

George Brown

#RSM

Y

Y

Y

CUSER

Janet Williams

#RSM

Y

Y

Y

DUSER

Mary White

#RSM

Y

Y

Y


Column

Description

USERID

User ID

NAME

Associated name, if available

DEFAULT GROUP

User ID's default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

AUDITOR

Whether the user has the AUDITOR attribute set

Operations

Lists all RACF users that have system operations attributes:

Userid

Name

Default Group

Special

Operations

Auditor

BATCH01

BATCH PROCESSING

SYS1


Y


RSS

RSS STARTED TASK

#RSM

Y

Y


AUSER

Bert Wilson

#RSM

Y

Y

Y

BUSER

Fredda Mayflower

#RSM

Y

Y

Y


Column

Description

USERID

User ID

NAME

Associated name, if available

DEFAULT GROUP

User ID's default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

AUDITOR

Whether the user has the AUDITOR attribute set

No Password Interval

Lists all RACF users that do not have a password interval defined:

Userid

Name

Default Group

Special

Operations

Auditor

AUSER

Ernie Brown

#RSM




BUSER

Phill Smith

#RSM

Y



CUSER

Joe Smith

#RSM

Y



DUSER

Sue Wilson

#RSM

Y

Y

Y


Column

Description

USERID

User ID

NAME

Associated name, if available

DEFAULT GROUP

User ID's default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

AUDITOR

Whether the user has the AUDITOR attribute set

UID(0)

Lists all RACF users that have UID(0) defined, that is, superuser attribute in Unix System Services (USS):

Userid

Name

Default Group

Special

Operations

Auditor

ADCDMST

ADCD MASTER

SYS1




BATCH01

BATCH PROCESSING

SYS1


Y


BPXOINIT

BPXOINIT

SYS1




AUSER

Brian Small

#RSM



Y

Column

Description

USERID

User ID

NAME

Associated name, if available

DEFAULT GROUP

User ID's default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

AUDITOR

Whether the user has the AUDITOR attribute set

Not used for 90 days

Lists all RACF users that have not been used for the past 90 days:

Userid

Name

Default Group

Special

Operations

Auditor

Last connect date

Not used x days

ADCDMST

ADCD MASTER

SYS1




17-Oct-12

2311

ADCDN

ADCDN

TEST




06-Nov-08

3752

ADCDO

ADCDO

TEST




06-Nov-08

3752

ADCDP

ADCDP

TEST




06-Nov-08

3752

Column

Description

USERID

User ID

NAME

Associated name, if available

DEFAULT GROUP

User ID's default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

AUDITOR

Whether the user has the AUDITOR attribute set

LAST CONNECT DATE

Date the user last connected

NOT USED X DAYS

Number of days since last use

IBMUSER Not Revoked

Lists IBMUSER details if it does not have the Revoked attribute:

Userid

Name

Default Group

Special

Operations

Auditor

Last connect date

Not used x days









Column

Description

USERID

User ID, IBMUSER

NAME

Associated name, if available

DEFAULT GROUP

IBMUSER's default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

AUDITOR

Whether the user has the AUDITOR attribute set

LAST CONNECT DATE

Date the IBMUSER last connected

NOT USED X DAYS

Number of days since last use

Revoked Special Users

Lists all RACF system special users with the Revoked attribute:

Userid

Name

Default Group

Special

Operations

Auditor

Last connect date

Not used x days

AUSER

June Smith

PMIUSER

Y



13-Mar-13

2164

BUSER

Peter Brown

PMIUSER

Y



20-Oct-10

3039

CUSER

Charlie White

#RSM

Y



26-Jun-18

233

DUSER

John Wilson

#RSM

Y



26-Jun-18

233

Column

Description

USERID

User ID

NAME

Associated name, if available

DEFAULT GROUP

User ID's default group

SPECIAL

Whether the user has the SPECIAL attribute set

OPERATIONS

Whether the user has the OPERATIONS attribute set

AUDITOR

Whether the user has the AUDITOR attribute set

LAST CONNECT DATE

Date the user last connected

NOT USED X DAYS

Number of days since last use

Duplicate Names

Lists all RACF users that have the same name defined in field 'Name':

Userid

Duplicated name

Default Group

Owner

Password Interval

Last use

Passwords in History

Revoke Count

Installation Data

AUTALERT

AUTOOPERATOR

INGAUTO

TSGTS

30

11-Oct-16

0

0

AUTOMATION AUTOTASK: USED FOR ALERT BASED NO

BLZ400

DSN PROFILE ID

#RSM

#RSM

30

27-Mar-18

0

0

GENERAL DATASET PROFILE ID

BPXROOT

RUI FEIO NO 2

#RSM

#RSM

30

29-Jun-18

0

0

123456

C2PSUSE2

ZSECURE ALERT STC

SYSAUDIT

SYSAUDIT

30

13-Oct-15

0

0



Column

Description

USERID

User ID

DUPLICATED NAME

Name that is duplicated

DEFAULT GROUP

Default RACF group (DFLTGRP)

OWNER

Owner

PASSWORD INTERVAL

User ID's password interval

LAST USE

Date of last use

PASSWORDS IN HISTORY

Number of passwords in the password history for this user

REVOKE COUNT

Number of unsuccessful password attempts

INSTALLATION DATA

Displays any INSTDATA

File Transfers

Date

Time

System

User

Action

Program

Dataset

Jobname









Column

Description

DATE

Date the file transfer was run

TIME

Time the file transfer was run

SYSTEM

System the file transfer was run from

USER

User ID performing the file transfer

ACTION

Send or receive

PROGRAM

Name of the program used to transfer the file

DATASET

Name of the data set that was transferred

JOBNAME

Name of the job that ran the file transfer

Compliance

Click Compliance and select one of the following reports to display information about security violations detected in the z/OS environment:

Access Violations

Lists all security access violations detected in your z/OS environment:

System

Date

Time

Userid

Name

Class

Resource

Volser

Intent

Allowed

RSMP

19/02/2019

14:29:14

RSS

RSS STARTED TASK

MQCMDS

QCBA.DISPLAY.SECURITY


Read

None

RSMP

19/02/2019

14:29:14

RSS

RSS STARTED TASK

MQCMDS

QCBB.DISPLAY.SECURITY


Read

None

RSMP

19/02/2019

14:00:16

RSSCHIP

RSS STARTED TASK

MQCMDS

QCBA.DISPLAY.SECURITY


Read

None

RSMP

19/02/2019

14:00:16

RSSCHIP

RSS STARTED TASK

MQCMDS

QCBA.DISPLAY.ARCHIVE


Read

None

Column

Description

SYSTEM

System where the violation was detected

DATE

Event date

TIME

Event time

USERID

User ID who caused the violation

NAME

User ID's name

CLASS

Class of the resource that generated the violation

RESOURCE

Resource that generated the violation

VOLSER

Volume serial number if appropriate

INTENT

Access intent

ALLOWED

Access allowed


Allowlists

Many of the Security Policy Manager queries can exclude results by using allowlists. Allowlists are defined in the index member of the rules data set and consist of exceptions that can be used to prevent specific users or resources from being reported on as non-compliant.

For example, if only one user ID is allowed to update APF libraries, then an allowlist containing that one user ID can be defined, and the compliance query can specify a clause such as:
AND userid NOT IN (SELECT userid FROM allowlist WHERE type='APF')

The allowlist defined would be:

* TSO allowlists
Allowlist APF
TSGAPF     Userid allowed to update APF data sets.

For an example of the alllowlist, see Sample-index-member.

Compliance Reports

Select Overview to see the Compliance Overview dashboard that is described in Logging-on-and-viewing-compliance-summaries.

Select All to see all the compliance reports defined on the system, including all policies contained in the index member, their last run time, next run time, and result of the run. For more information, see "Examining all compliance reports" and "To run individual reports" in Logging-on-and-viewing-compliance-summaries.

Select one of the following report categories:

  • DISA STIG
  • MVS
  • DB2
  • RACF
  • TSS
  • USS
  • TCP/IP
  • CICS
  • REXX

The list of categories might change, depending on your system configuration.

If you add a custom category to the HLQ.RULES(INDEX) member and update the rules with the /f stc, loadrules command (or restart the product), the custom category is displayed in the Compliance menu and in the All Compliance Reports table. For an example of the index member, see Sample-index-member.

RACF

Click RACF and select one of the following reports to display information about issues on your RACF environment:

Profiles with > UACC > None

Lists all RACF data set and general resource profiles with universal access (UACC) greater than NONE:

Class

Profile

Owner

UACC

ID(*)

Warning

S/F Audit

Level

APPL

FEKAPPL

TSGSJ

Read


N

/R

0

APPL

GPMSERVE

TSGSJ

Read


N

/R

0

APPL

GPM4CIM

TSGSJ

Read


N

/R

0

CSFSERV

CSF%%C

TSGMK

Read


N

/R

0


Column

Description

CLASS

RACF class

PROFILE

RACF Profile

OWNER

Profile owner

UACC

Universal ACCess setting for the profile

ID(*)

ID(*) setting for the profile.

WARNING

Whether the WARNING attribute is on

S/F AUDIT

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

LEVEL

Profile level

Profiles with > ID(*) > None

Lists all RACF data set and general resource profiles with ID(*) defined in the access control list (ACL) with access greater than NONE:

Class

Profile

Owner

UACC

ID(*)

Warning

S/F Audit

Level

ACCTNUM

ACCT#

IBMUSER

None

Read

N

/R

0

CCICSCMD

**

TSGMW

None

Read

N

/R

0

DATASET

ADCD.**

#RSM

None

Read

N

/R

0

DATASET

AFF260.**

#RSM

None

Read

N

/R

0


Column

Description

CLASS

RACF class

PROFILE

RACF profile

OWNER

Profile owner

UACC

Universal ACCess setting for the profile

ID(*)

ID(*) setting for the profile

WARNING

Whether the WARNING attribute is on

S/F AUDIT

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

LEVEL

Profile level

Note

This is applicable to all displays showing an 'S/F Audit' column. 'S/F' refers to Success/Failures, so 'U/R' is equal to 'Success(Update)/Failures(Read)'.

Profiles with > Warning

Lists all RACF data set and general resource profiles in WARNING mode:

Class

Profile

Owner

UACC

ID(*)

Warning

S/F Audit

Level

DATASET

ISVR.RSS.**

#RSM

Read

Update

Y

R/R

0

DATASET

ISVR.RSS.SUE.**

#RSM

Read

Read

Y

R/R

99

DATASET

SYS1.PARMLIB

TSGMW

None

Read

Y

/R

90

DATASET

TSGAF.CARLA.EXER.**

#RSM

Alter


Y

/R

0


Column

Description

CLASS

RACF class

PROFILE

RACF profile

OWNER

Profile owner

UACC

Universal ACCess setting for the profile

ID(*)

ID(*) setting for the profile

WARNING

Whether the WARNING attribute is on

S/F AUDIT

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

LEVEL

The profile level.

Profiles with > Empty ACL

Lists all RACF data set and general resource profiles with no users or groups defined in the access control list (ACL):

Class

Profile

Owner

UACC

ID(*)

Warning

S/F Audit

Level

ACCTNUM

RSMTST

SYS1

None


N

/R

0

APPL

#OPSMVS

#OPSMVS

None


N

/R

0

APPL

CICSTS3*

TSGMW

None


N

/R

0

CDT

#TESEMP

SYS1

None


N

/R

0


Column

Description

CLASS

RACF class

PROFILE

RACF profile

OWNER

Profile owner

UACC

Universal ACCess setting for the profile

ID(*)

ID(*) setting for the profile

WARNING

Whether the WARNING attribute is on

S/F AUDIT

Audit successes and failures

The audit levels can have the following values:

  • - (not set)
  • R (READ)
  • U (UPDATE)
  • C (CONTROL)
  • A (ALTER)

For example, U/R is equal to Success(Update)/Failures(Read).

LEVEL

Profile level

Groups > Owner Not Supgroup

Lists all RACF groups where the superior group (SupGroup) is different from the owner:

Group

Owner

Supgroup

#Sub Groups

#Users

Creation Date YYYY/MM/DD

Installation Data

Universal Group?

UACC

Notermuacc?

ACL Count

#EPSINC

TSGMK

SYS1



01/05/2018


N

NONE


5

#TIVOMAD

TSGHS

SYS1



07/08/2018

TIVOLI OUTPUT MANAGER ADMIN

N

NONE


3

$JMLMAST

TSGNJC

#RSM



16/02/2018


N

NONE


3

$JMLTEMP

TSGNJC

#RSM



16/02/2018


N

NONE


1


Column

Description

GROUP

RACF group name

OWNER

Group owner

SUPGROUP

Group's superior group

#SUB GROUPS

Number of subgroups connected to this group

#USERS

Total connects to this group

CREATION DATE YYYY/MM/DD

Group creation date

INSTALLATION DATA

Group's INSTDATA setting

UNIVERSAL GROUP?

Whether it is a universal group

UACC

Group's Universal ACCess setting

NOTERMUACC

NOTERMUACCC value

ACL COUNT

Count of connected users

Groups > Universal Settings

Lists all Universal groups defined to RACF:

Group

Owner

Supgroup

#Sub Groups

#Users

Creation Date

Installation Data

UACC

Notermuacc?

ACL Count

#TEST

#RSM

#RSM



20111031


NONE


2

#TEST2

#RSM

#RSM



20111101


NONE


1

SUBZSEC

ZSECURE

ZSECURE



20171018


NONE



TESTUNIV

#RSM

#RSM



20130918

UNIVSAL TEST GROUP

NONE




Column

Description

GROUP

RACF group name

OWNER

Group owner

SUPGROUP

Group's superior group

#SUB GROUPS

Number of subgroups connected to this group

#USERS

Total connects to this group

CREATION DATE

Group creation date

INSTALLATION DATA

Whether it is a universal group

UACC

Group's Universal ACCess setting

NOTERMUACC?

NOTERMUACCC value

ACL COUNT

Count of connected users

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*