topic Re: Login failure settings in audit in Operating System - OpenVMS

Login failure settings in audit

Wim Van den Wyngaert — Wed, 28 May 2008 12:16:47 GMT

I'm not finding it myself so : is there a complete definition of what the items dialup,, local, remote, network and server are used for in set aud/ena=logfail=xxx ? T.i. when do the alarms exactly occur ?

Wim

Re: Login failure settings in audit

Walter Miller_1 — Wed, 28 May 2008 13:21:02 GMT

Sections 3.4.1 through 3.4.4 in the Guide to System Security has descriptions of these items.

Re: Login failure settings in audit

Wim Van den Wyngaert — Wed, 28 May 2008 13:34:35 GMT

Missed that. http://h71000.www7.hp.com/doc/732FINAL/aa-q2hlg-te/aa-q2hlg-te.HTMl

has some of it.

But I did a
set ho/lat : local
set ho/teln : remote
set ho 0 : remote
ftp : network

I don't get lat and telnet. I would have expected network logins like ftp. And what about server ? Terminal server ?

Wim

Re: Login failure settings in audit

Karl Rohwedder — Wed, 28 May 2008 13:41:49 GMT

Concerning LAT:

I assume. that LAT logins are considered LOCAL, because they replaced former directly conmected terminals with terminals at terminalservers.
If memory serves me right, the SET HOST/LAT functionality was added later to VMS.

regards Kalle

Re: Login failure settings in audit

labadie_1 — Wed, 28 May 2008 13:49:51 GMT

Wim

I bet ologin will be registered as remote.

Hum, may be you have not installed OSI login

:-)

Re: Login failure settings in audit

Wim Van den Wyngaert — Wed, 28 May 2008 14:10:11 GMT

OSI login ? C'est quoi ?

While on the subject : what about subprocess and detached login ? I failed to create a subprocess (spawn with already too many processes for me) but got no alarm.

I did a run sys$system:loginout/inp=nonexistsingfile : subprocess. Idem but /uic : detached. That seems ok.

Wim

Re: Login failure settings in audit

Wim Van den Wyngaert — Wed, 28 May 2008 14:18:49 GMT

Console login is local. Also ok.

Was thinking may be all decnet was remote. But no : T2T is network.

Did an SSH : network. No remote here.

Wim

Re: Login failure settings in audit

labadie_1 — Wed, 28 May 2008 14:49:46 GMT

See

http://h71000.www7.hp.com/doc/82final/decnetplus/ftam_use.pdf

But I am wrong, ologin is used to connect using OSI protocol from a Digital Unix to Vms.

From Vms it is
set host/vtp

This comes from years ago when Digital thought Osi would be the standard, but Tcpip became the standard...

Re: Login failure settings in audit

Walter Miller_1 — Wed, 28 May 2008 16:21:33 GMT

Local

You log in from a terminal connected directly to the central processor or from
a terminal server that communicates directly with the central processor.

Remote

You log in to a node over the network by entering the DCL command SET
HOST.

Network

The system performs a network login when you start a network task on a remote node, such as displaying the contents of a directory or copying files stored in a directory on another node. Both your current system and the remote system must be nodes in the same network.

Re: Login failure settings in audit

Wim Van den Wyngaert — Mon, 02 Jun 2008 09:14:17 GMT

The "server" keyword is still not defined.

Wim

Re: Login failure settings in audit

Richard W Hunt — Fri, 17 Oct 2008 12:03:21 GMT

DIALUP - the UNIT CONTROL BLOCK for the prototype of that serial device says it is a DIALUP line. Or, for non-prototyped devices, the individual device UCB says it is a DIALUP line. I forget which flag you set, but I know it is a UCB flag for terminals.

REMOTE - Anything that came in over a network line before determining the type of session. E.g. TELNET, SET HOST.

LOCAL - Anything that connects through a serial interface as its connection method. E.g. the console, or if you had RS-232 (or newer) lines physically connected to the device. AND its UCB isn't marked "dialup."

For the old DECservers using LAT, you were either LOCAL or DIALUP depending on how you marked the individual ports on the DECserver end. (Did I just give away my age here?)

BATCH is obvious, there is only one way to get there. SUBMIT or an API equivalent using SNDJBC$ or something like that.

SUBPROCESS is a SPAWN or CREPRC$ operation

DETACHED is a RUN/DETACHED or CREPRC$ operation (the latter with the appropriate options).

Re: Login failure settings in audit

Richard W Hunt — Fri, 17 Oct 2008 12:09:27 GMT

Oh, "SERVER"

Possibly one of the SERVER queues such as TCPIP$SMTP_{mumble}, which shows up as a SERVER queue if you use the appropriate SHOW QUEUE /FULL options to select it. After all, you have to create a session under which to run the SMTP sender for your mail messages and such.