The IBM RACF SERVAUTH resource class must be active for TCP/IP resources.

IBM Provides the SERVAUTH Class for use in protecting a variety of TCP/IP features/functions/products both IBM and third-party. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data.

From a command input screen enter: SETROPTS LIST

If there are TCP/IP resources defined and the SERVAUTH resource class is not active, this is a finding.

Configure RACF SETROPTS to have the SERVAUTH resource class is active.

Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:

The RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes.

The SERVAUTH Class is activated with the command SETR CLASSACT (SERVAUTH).

Generic profiles and commands should also be enabled with the command SETR GENERIC(SERVAUTH) GENCMD(SERVAUTH).