ROAUDIT The user with the ROAUDIT attribute (read-only auditor) has the same primary  responsibility as the user with the AUDITOR attribute; that is to monitor the  system. The difference between the AUDITOR attribute and the ROAUDIT  attribute is that a user with the AUDITOR attribute can monitor the system and  set auditing controls. A user with the ROAUDIT attribute can monitor only the  system with the set of auditing controls OPERATIONS When assigning this attribute at the system level, it allows the user to perform  any maintenance operations, such as copying, reorganizing, cataloging, and  scratching, on RACF-protected resources. At the group-OPERATIONS level,  the authorization to perform these operations is restricted to the resources that  are within the scope of the group. CLAUTH The CLAUTH (class authority) attribute allows the user to define profiles in a  specific RACF class. A user can have class authority for the USER class and  any of the classes that are defined in the class descriptor table (CDT). REVOKE This attribute excludes the RACF defined user from entering the system.  Revoke can be assigned at the group level, in which case the user cannot enter  the system that is connected to that group. PROTECTED A protected user ID cannot be used to enter the system by any method that uses  a supplied password, such as CP logon, rlogin, or FTP. Also, a protected user  ID cannot be revoked through inactivity or unsuccessful attempts to access the  system by using an incorrect password or password phrases. A protected user  ID is defined by assigning the NOPASSWORD and NOPHRASE attributes  through the  ADDUSER  or  ALTUSER  command. User attribute Description To show the attributes of a user, list the user’s profile. Example 5-4 show attributes SPECIAL  and OPERATIONS that are assigned to user EDI. Example 5-4 Displaying attributes on a user Example 5-5 Adding attribute SPECIAL to user EDI rac lu edi  USER=EDI NAME=UNKNOWN OWNER=IBMUSER CREATED=19.167  DEFAULT-GROUP=SYS1 PASSDATE=19.167 PASS-INTERVAL= 30 PHRASEDATE=N/A  ATTRIBUTES=SPECIAL OPERATIONS  REVOKE DATE=NONE RESUME DATE=NONE  LAST-ACCESS=19.172/15:14:17  CLASS AUTHORIZATIONS=NONE  NO-INSTALLATION-DATA  NO-MODEL-NAME  rac lu edi  USER=EDI NAME=UNKNOWN OWNER=IBMUSER CREATED=19.167  DEFAULT-GROUP=SYS1 PASSDATE=19.167 PASS-INTERVAL= 30 PHRASEDATE=N/A  ATTRIBUTES=NONE  REVOKE DATE=NONE RESUME DATE=NONE  LAST-ACCESS=19.168/15:26:13  CLASS AUTHORIZATIONS=NONE  NO-INSTALLATION-DATA  NO-MODEL-NAME To give an attribute to a user, run the  ALTUSER  command. Example 5-5 shows the attribute  SPECIAL being added to user EDI. 112  Securing Your Cloud: IBM Security for LinuxONE