topic DNA$SESSCTRL is inactive in Operating System - OpenVMS

DNA$SESSCTRL is inactive

Manny DeAssis — Thu, 04 Nov 2004 11:16:38 GMT

I'm running VMS V7.3-2 with DECnet Plus V7.3-2 ECO 1. The UAF record for DNA$SESSCTRL shows it been inactive for years. I'm going to recommend that it gets removed. However won't it just get created again the next time a DECnet ECO is applied? Does it need to be around for file ownership reasons? Please advise. Thanks.

Re: DNA$SESSCTRL is inactive

Ian Miller. — Thu, 04 Nov 2004 12:14:18 GMT

I think its a leftover from earlier version. I've just looked at VMS V7.3-1 AND v7.1 system and its not there.

Check for any files owned by that UIC before deleting
(
DFU SEAR /OWN=uic device
or DIR/BY_OWN=uic device
)

Re: DNA$SESSCTRL is inactive

John Gillings — Thu, 04 Nov 2004 16:03:24 GMT

Manny,

If you want to play cautious, just disable the account:

UAF> MOD DNA$SESSCTRL/NOACCESS/FLAG=DISUSER

This disables the account in two ways. Keep an eye on login failure audits to see if anything attempts to use it.

If you do decide to remove the record, consider leaving the rights identifier:

UAF> REMOVE/NOREMOVE DNA$SESSCTRL

This will help prevent reusing the UIC, and will retain the name if there are any owned files or objects - a good policy (IMHO it should be the default for REMOVE!)

Re: DNA$SESSCTRL is inactive

Manny DeAssis — Thu, 04 Nov 2004 16:24:37 GMT

Thank you for all your responses. I will most likely consider leaving it alone or use the 'remove /noremove' solution. Thanks again.

Re: DNA$SESSCTRL is inactive

Jan van den Ende — Thu, 04 Nov 2004 16:52:39 GMT

John,

caught you again in a very good suggestion!

Any more voters to promote that to an official request level, please?

Cheers.

Have one on me.

Jan

Re: DNA$SESSCTRL is inactive

Ian Miller. — Thu, 04 Nov 2004 16:59:15 GMT

http://www.hpuseradvocacy.org/
is waiting for that suggestion :-)

Re: DNA$SESSCTRL is inactive

Jan van den Ende — Thu, 04 Nov 2004 17:03:08 GMT

Sorry,

should have made myself more clear.
I directed my previous post at
" good policy (IMHO it should be the default for REMOVE!)

Cheers.

Have one on me.

Jan

Re: DNA$SESSCTRL is inactive

Jan van den Ende — Thu, 04 Nov 2004 17:12:52 GMT

Ian,

you _ARE_ quick!

Yes, I agree, but;

a. John's idea. HE should have the credit of posting
b. over here it is probably getting more attention
and, sadly, and as an excuse :-(
c. somehow my access to various HP sites has (historically) gotten confused between logins at the European/EMEA and the USA sites, and any correction to one issue out of that generates trouble in accessing other(s).
I learned to live with the current Status Quo, and when needed I just (ab-)use ITRC (or various Mail-to's) to circumvent that.

Sometimes it reminds me of using billyware 8-(((

Anyhow:

Cheers.

Have one on me.

Jan

Re: DNA$SESSCTRL is inactive

Martin P.J. Zinser — Thu, 04 Nov 2004 17:56:01 GMT

Hello Manny,

you might also want to check if the account is
associated with any known DECnet objects before removing it.

Greetings, Martin