Mainframe Security — RACF, ACF2 & Top Secret

In this tutorial, you'll learn about Mainframe Security. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Mainframe security is enforced through three specialized products — RACF, ACF2, and Top Secret — that control access to datasets, programs, and transactions with military-grade audit trails and mandatory access controls.

What You'll Learn

• The three mainframe security products and how they differ
• RACF profiles, user administration, and dataset protection
• How ACF2's rule-based access and Top Secret's ACID model work
• Real-world security administration and Compliance scenarios

Why Mainframe Security Matters

Mainframes hold the world's most sensitive data — bank accounts, tax records, medical records, stock trades. A single breach could expose millions of records. Yet mainframes suffer far fewer breaches than cloud or Distributed Systems. Why? Because security is built into the hardware and operating system, not bolted on after the fact.

Durga Antivirus Pro applies mainframe-style mandatory access controls to prevent malware from altering protected files. DodaZIP uses RACF-inspired access validation before allowing compression operations on sensitive directories.

Learning Path

flowchart LR
  A[z/OS Guide] --> B[Mainframe Security
You are here]
  B --> C[Mainframe Modernization]
  C --> D[Cloud Integration]
  D --> E[DevSecOps]

The Three Security Products

All three integrate with z/OS's System Authorization Facility (SAF) — the central security interface that all system components use to check access.

RACF — Resource Access Control Facility

RACF is IBM's own security product, bundled with z/OS. It works by attaching profiles to resources and permits to users.

Key RACF Concepts

Protecting a VSAM Dataset with RACF

//RACFDEF  JOB  'RACF DEFINE',CLASS=A
//STEP1    EXEC PGM=IKJEFT01
//SYSTSPRT DD  SYSOUT=*
//SYSTSIN  DD  *
  ADDGROUP PAYROLL +
    SUPGROUP(SYS1) +
    OWNER(SYSADM)

  ADDUSER SMITH +
    DFLTGRP(PAYROLL) +
    NAME('JOHN SMITH') +
    NOPASSWORD

  RDEFINE DATASET ACCT.PAYROLL.** +
    OWNER(SYSADM) +
    UACC(NONE)

  PERMIT ACCT.PAYROLL.** +
    ID(SMITH) +
    ACCESS(UPDATE)

  SETROPTS RACLIST(DATASET) REFRESH
/*

Explanation: First we create a group (PAYROLL) and a user (SMITH). Then we define a dataset profile for ACCT.PAYROLL.** (all datasets starting with that prefix) with universal access NONE. Finally we permit SMITH with UPDATE access.

Common RACF Commands

LISTUSER  SMITH             — Show user details
LISTDSD   DATASET ACCT.PAYROLL.**  — List dataset profiles
PERMIT    ACCT.PAYROLL.** ID(JONES) ACCESS(READ)  — Grant READ
ALTUSER   SMITH NAME('JOHN SMITH')  — Change user attributes
DELUSER   SMITH              — Delete a user

Expected output for LISTUSER SMITH:

USER=SMITH      NAME=JOHN SMITH       OWNER=SYSADM
  CREATED=2025-01-15    LAST ACCESS=2026-06-20
  DEFAULT GROUP=PAYROLL
  GROUPS=PAYROLL
  ATTRIBUTES=NONE
  REVOKE DATE=NONE     RESUME DATE=NONE

ACF2 — Access Control Facility 2

ACF2 uses a rule-based approach with a default-deny philosophy. If no rule explicitly allows access, it's denied.

ACF2 Rule Structure

$KEY(ACCT)
 PAYROLL.-        UID(SMITH) READ(A) UPDATE(A)  ALLOW
                     UID(**)   READ(A)           ALLOW
 MASTER.-         UID(SMITH) READ(A) UPDATE(A) ALLOW

Explanation: $KEY(ACCT) defines the high-level qualifier. PAYROLL.- matches any dataset starting with ACCT.PAYROLL.. SMITH has READ and UPDATE access. ** is a wildcard matching any user with READ-only.

GSO (Global System Options)

ACF2's central configuration is in the GSO record. Key GSO record types:

Top Secret

Top Secret uses ACIDs (Accessor Control Identity) — entities that combine user, group, and privilege information into a single object.

Top Secret Commands

TSS CREATE(PAYROLL) TYPE(GROUP)
TSS CREATE(SMITH) TYPE(USER) GROUP(PAYROLL) NAME('JOHN SMITH')
TSS PERMIT(SMITH) DSNAME(ACCT.PAYROLL.**) ACCESS(UPDATE)
TSS WHOHAS DSNAME(ACCT.PAYROLL.MASTER)

Comparing Security Products

SMF Auditing

All three products write audit records to SMF (System Management Facility). SMF records every security event:

These records are used for Compliance reporting, breach detection, and forensics.

Real-World: Banking Security Architecture

A typical mainframe security setup for a bank:

flowchart TD
  A[User Login] --> B{RACF Authentication}
  B -->|Valid| C{Is dataset protected?}
  C -->|Yes| D{RACF Profile Check}
  D -->|READ permitted| E[Access Granted]
  D -->|Not permitted| F[Access Denied + SMF 80]
  C -->|No| E
  B -->|Invalid| G[Lock After 3 Attempts + SMF 80]

SMF records capture every denied access including the user, resource, time, and terminal. Security teams run daily SMF reports to detect patterns that might indicate an attack.

Common Errors

1. RACF: ICH408I — Dataset access denied

The user doesn't have the required access level. Use PERMIT to grant appropriate access or check if the user's group membership is correct.

2. ACF2: LOGONID not found

The user ID doesn't exist in ACF2's database. Create with INSERT command or check for typos.

3. Top Secret: T7080I — Password expired

Top Secret enforces password aging. The user must change their password. Use TSS REPLACE(SMITH) PASSWORD(newpass, EXPIRED).

4. RACF: Password is REVOKED

After three invalid logon attempts, RACF revokes the user ID. Use ALTUSER SMITH RESUME to re-enable.

5. Profile not found (RACF)

If no profile protects a dataset, access may default to READ (depending on UACC). Always define profiles with UACC(NONE) for sensitive data.

6. ACF2: Rule collision

Multiple rules match the same dataset. ACF2 uses the most specific rule. Verify rule order with ACF RULELIST.

7. SMF dataset full

If SMF datasets fill up, security auditing stops. Monitor SMF dataset usage and ensure automatic dump/switch is configured.

Practice Questions

1. What does UACC(NONE) mean in a RACF profile? It means Universal Access is NONE — no one has any access unless explicitly permitted. This is the most secure setting.

2. How does ACF2's default-deny model differ from RACF's profile model? ACF2 denies all access unless a matching rule explicitly allows it. RACF can permit access either through profiles or through defaults defined in the resource class.

3. What is SMF Type 80 used for? It records RACF security events including logons, dataset access attempts (both granted and denied), and administrative commands.

4. What is the purpose of SETROPTS RACLIST REFRESH? It refreshes the in-storage copy of RACF profiles, making changes effective immediately without an IPL.

5. How does password aging improve security? It forces users to change passwords at regular intervals, reducing the window of exposure if a password is compromised.

Challenge: Design a RACF security scheme for a bank with three tiers of employees — tellers (READ-only on customer data), managers (UPDATE), and auditors (READ on all data plus special SMF query access). Write the RACF commands.

Mini Project: Security Audit Script

Write an REXX script that queries RACF for all users with ALTER access to production datasets:

/* REXX — Security Audit Report */
say "Security Audit Report — Users with ALTER Access"
say "================================================"
say ""

/* List dataset profiles with ALTER access */
"LISTDSD DATASET PROD.** OWNER(SYSADM) GENERIC"

/* Check for users with elevated privileges */
"SEARCH CLASS(USER) ATTR(SPECIAL,OPERATIONS,AUDITOR)"

say ""
say "Review these users:"
say "- SPECIAL allows bypassing security controls"
say "- OPERATIONS allows dataset ALTER access"
say "- Only authorized personnel should hold these"

Expected output:

Security Audit Report — Users with ALTER Access
================================================

  DATASET PROD.PAYROLL.**     UACC(NONE)
    ACCESSOR COUNTS: READ=45 UPDATE=12 ALTER=2

  USER=SMITH    ATTR=OPERATIONS
  USER=JONES    ATTR=SPECIAL

Review these users:
- SPECIAL allows bypassing security controls
- OPERATIONS allows dataset ALTER access
- Only authorized personnel should hold these

FAQ

What's Next

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro. Updated 2026-06-21.