topic Re: FTP Account, no privileges in Operating System - OpenVMS

FTP Account, no privileges

Dario Karlen — Wed, 19 Oct 2005 02:00:24 GMT

i want to create a vms account without any privileges. it should be possible to connect and get/put files only in the default dir. which privileges do i have to give to this account, default are only netmbx and tmpmbx? i have an old vms system manager manual and i've nothing found in the online UAF help also.

Re: FTP Account, no privileges

Vladimir Fabecic — Wed, 19 Oct 2005 02:15:49 GMT

What is your OS version and TCPIP (or UCX) version?
Did you try to create anonymous ftp account?
Run TCPIP$CONFIG (or UCX$CONFIG) and choose Optional components and Set up Anonymous FTP Account and Directories.
You can copy and modify this account.

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 02:26:08 GMT

You need NETMBX priv. You also only need to enable NETWORK access (not batch, local, dialup or remote). Also review what's in your LGICMD and ensure it's protected (ie. can't be replaced/updated by the ftp account).

You should ensure you set-up the appropriate file protections/acls to prevent unwanted access into other disk/directory areas.

Re: FTP Account, no privileges

Joseph Huber_1 — Wed, 19 Oct 2005 02:41:51 GMT

Consider also the use of Hunters HGFTP server
(see freeware at http://www.process.com/openvms )
which gives full control over the directories accessible, and the operations allowed.
Through logicals in the HGFTP startup one can define a list of directories anywhere.

Re: FTP Account, no privileges

Dario Karlen — Wed, 19 Oct 2005 02:43:03 GMT

DIGITAL TCP/IP Services for OpenVMS Alpha Version V5.0A
on a COMPAQ AlphaServer DS10 466 MHz running OpenVMS V7.2-1
on network i gave full access.
i copied the anonymous account. i can login on the system, but when i try to gave the DIR command, this is displayed: %DIRECT-E-OPENIN, error opening DSA2:[WAL.XFER]*.*;* as input
-RMS-E-PRV, insufficient privilege or file protection violation

Re: FTP Account, no privileges

Vladimir Fabecic — Wed, 19 Oct 2005 02:56:40 GMT

Maybe you will modify some settings of copied account. First, change default directory (DSA2:[WAL.XFER]) owner and permitions.

Re: FTP Account, no privileges

Arch_Muthiah — Wed, 19 Oct 2005 03:00:18 GMT

Hi,

Go to this link below where you can download all types of latest VMS related manauls including "OpenVMS System Managers" manual Vol-I and Vol-II andTCPIP configuration manual.

http://h71000.www7.hp.com/doc/os82_index.html

Also the TCPIP version 5.0A is very old, you can download TCPIP docs for Version 5.4 from the above link.

Archunan

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 03:02:54 GMT

This might help.

If you're "playing" away from Production try $ set security/acl=(id=[ftp_account_acl],access=read+execute+write) required_directory.dir (perhaps DSA2:[WAL]XFER.dir;)

Joseph makes a good point by recommending Hunters HGFTP server, I know of several people who enjoy this.

Re: FTP Account, no privileges

Ian Miller. — Wed, 19 Oct 2005 03:03:04 GMT

what the protection on DSA2:[WAL.XFER]

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 03:04:59 GMT

Sorry, ftp_account_acl = ftp_account_uic - doah!

Re: FTP Account, no privileges

Dario Karlen — Wed, 19 Oct 2005 03:06:08 GMT

KARLEND > sh def
DSA2:[WAL.XFER]
KARLEND > show prot
SYSTEM=RWED, OWNER=RWED, GROUP=RE, WORLD=NO ACCESS

Re: FTP Account, no privileges

Dario Karlen — Wed, 19 Oct 2005 03:09:06 GMT

UAF> sh ftp

Username: FTP Owner: ANONYMOUS
Account: ANONY UIC: [400,20] ([FTP])
CLI: DCL Tables: DCLTABLES
Default: DSA2:[WAL.XFER]
LGICMD:
Flags: DisCtlY LockPwd DisWelcome DisNewMail DisMail DisReport DisReconnect
Primary days: Mon Tue Wed Thu Fri
Secondary days: Sat Sun
Primary 000000000011111111112222 Secondary 000000000011111111112222
Day Hours 012345678901234567890123 Day Hours 012345678901234567890123
Network: ##### Full access ###### ##### Full access ######
Batch: ----- No access ------ ----- No access ------
Local: ----- No access ------ ----- No access ------
Dialup: ----- No access ------ ----- No access ------
Remote: ##### Full access ###### ##### Full access ######
Expiration: (none) Pwdminimum: 6 Login Fails: 0
Pwdlifetime: (none) Pwdchange: (pre-expired)
Last Login: 19-OCT-2005 08:39 (interactive), 19-OCT-2005 08:32 (non-interactive)
Maxjobs: 0 Fillm: 50 Bytlm: 52200
Maxacctjobs: 0 Shrfillm: 0 Pbytlm: 0
Maxdetach: 0 BIOlm: 18 JTquota: 4096
Prclm: 8 DIOlm: 18 WSdef: 350
Prio: 8 ASTlm: 100 WSquo: 512
Queprio: 4 TQElm: 15 WSextent: 512
CPU: (none) Enqlm: 100 Pgflquo: 10240
Authorized Privileges:
NETMBX TMPMBX
Default Privileges:
NETMBX TMPMBX

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 03:11:33 GMT

Dario, you post gives your current processes default protection for new files. Issue a $ dir/sec DSA2:[WAL]XFER.dir to get the details on the directory file.

Try my suggested $ set security/acl=(id=[ftp],access=read+execute+write) DSA2:[WAL]XFER.dir

Re: FTP Account, no privileges

Dario Karlen — Wed, 19 Oct 2005 03:23:32 GMT

before
KARLEND > dir/sec DSA2:[WAL]XFER.dir

Directory DSA2:[WAL]

XFER.DIR;1 217 19-FEB-2001 14:14:13.07 [SYSTEM]
(RWE,RWE,RE,E)

Total of 1 file, 217 blocks.

and after your command:
KARLEND > set security/acl=(id=[ftp],access=read+execute+write) DSA2:[WAL]XFER.d
KARLEND > dir/sec DSA2:[WAL]XFER.dir

Directory DSA2:[WAL]

XFER.DIR;1 217 19-FEB-2001 14:14:13.07 [SYSTEM]
(RWE,RWE,RE,E)
(IDENTIFIER=[FTP],ACCESS=READ+WRITE+EXECUTE)

Total of 1 file, 217 blocks.

you re my man! good work, thanks a lot, it works fine

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 03:26:27 GMT

:-) Good stuff ! The important thing here is that you try and find time to understand the commands used. There are lots more things you can do to protect your system further, all it takes is knowledge !

Best
John.

Re: FTP Account, no privileges

Dario Karlen — Wed, 19 Oct 2005 04:28:44 GMT

thanks a lot, i'm a young programmer and have to manage the vms as a system manager by the way. so it takes a lot of time to get the knowledge :)
one last question: i set the security for the directory, but every hour a process creates a file and copies it to this dir. the new file has still the old security, so i cannot read it with the ftp account. what do i have to change?

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 04:55:03 GMT

You need this command:
$ set security/acl=(id=[ftp],options=default,access=read+execute+write) DSA2:[WAL]XFER.dir

This will allow user ftp rwe access to files created by someone else (who has permission to write into this area).

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 04:59:25 GMT

not sure if you know this one... you need to apply this permission to existing files within the directory $ set file/acl/def/log DSA2:[WAL.XFER...]*.*;*

This assumes you're happy to allow r+w+e access for user ftp to all files in xerf and below. You might just want r(read). In that case you can edit the security acl by typing $ edit/acl xfer.dir;

Re: FTP Account, no privileges

Dario Karlen — Wed, 19 Oct 2005 05:06:34 GMT

that's not necessary, but helps!

now i have 2 colons in the dir/secu
KARLEND > dir/secu [wal]xfer.dir

Directory DSA2:[WAL]

XFER.DIR;1 217 19-FEB-2001 14:14:13.07 [SYSTEM]
(RWE,RWE,RE,E)
(IDENTIFIER=[FTP],OPTIONS=DEFAULT,ACCESS=READ+WRITE+EXECUTE)
(IDENTIFIER=[FTP],ACCESS=READ+WRITE+EXECUTE)

Total of 1 file, 217 blocks.

can i remove the secend one? and how can remove it?
i'm very happy to get such a help from an old hand, THANK YOU!

Re: FTP Account, no privileges

John Abbott_2 — Wed, 19 Oct 2005 05:36:54 GMT

You need them both. The one with options=default propagates the ACL properties to files within and below this dorectory, the one without is specifically for the directory, so they address your initial problem and you subsequent one!