Hi,

I'm looking to restrict access to CSDATA segment via Command Verifier.

I've created profile in XFACILIT class C4R.GROUP.CSDATA which deny access done via RACF commands or L option in zSecure Admin but has no effect if I type S instead of L or use any other command to recreate or similar.

What is the best way to restrict access to CSDATA to user granted with CKR.READALL if that's ever possible?

Thanks

Bruno

Hi Bruno

zSecure Admin and zSecure Audit ignore the Command Verifier (C4R) profiles.  If there are any C4R profiles, the RACF commands executed from zSecure Admin may be affected, but the zSecure Admin display don't care.

zSecure Admin and zSecure Audit will show the application segments in the scope of the user/administrator, so when the user is granted CKR.READALL, all application data segments will be shown.  Including the CSDATA segment.

Note, CSDATA is not a safe place to store (initial) passwords and SSN in clear text, they will be visible for users with special, auditor, roaudit using normal RACF commands.

Hi Rob,

Thanks for your response. I'm not storing passwords in CSDATA anyway, it was just related to future development and assessing capabilities of Command Verifier in that particular case.

Bruno