topic Re: More Proxy issues in Operating System - OpenVMS

More Proxy issues

matthew robey — Wed, 29 Jun 2005 21:17:00 GMT

After looking at Kieths issue with proxies, I came across a problem with mine.

I have dual nics with IP failover (VMS 7.3-2,TCPIP V5.4 and Decnet V over IP).

If I add the proxy using remote_node.x.y.z::user, only one ip address of the remote node actually works, the other fails.

When I add a proxy using ip addresses, I get the following:

uaf> add/prox ip$xxx.xxx.xxx.AAA::user user/d
%UAF-I-NAFADDMSG, proxy from
node.x.y.z::user to user added
uaf> add/prox ip$xxx.xxx.xxx.BBB::user user/d
%UAF-I-NAFADDMSG, proxy from
ip$xxx.xxx.xxx.BBB::user to user added

Note that the first entry translates to the DNS address, the second stays as an IP address.

The local host database contains no entries for the remote node.

TCPIP SHO NODE, displays both IP addresses for the remote node.

1. Why cant I just have remote_node.x.y.z::user, and that be accepted from either of its IP addresses ?

2. Why (and where does it get it from), when adding proxies using the ip address, the first entry translates to the DNS name ? (and not the second address as well?)

3. Will I have to enter all proxies twice, one for each ip address of the remote node ?

I dont really want to use *::user user/d if possible.

Thanks,

Matt

Re: More Proxy issues

matthew robey — Wed, 29 Jun 2005 21:41:43 GMT

Sorry, that should have said "Kens proxy issues"

Re: More Proxy issues

John Gillings — Wed, 29 Jun 2005 23:06:29 GMT

Matt,

1) "that be accepted from either of its IP addresses"
Short answer "because" ;-)
Longer answer - it depends on how the SYS$REM* logical names get defined in the resulting process. That depends on many things (see 2)

2) "where does it get it from"
Depends on exactly how name resolution is configured. However, it's the same place for both AUTHORIZE and SYS$REM*. (see 3)

3) "Will I have to enter all proxies twice"
In theory, no, since the node should always be identified the same way by both AUTHORIZE and network process creation, the proxy should always work. HOWEVER, if you change any of the numerous things that might affect name translation, you may break the match.

Remember that the original design for DECnet proxies was based on a much simpler network model. The simple minded "exact match" mechanism, rather than a more complex translation model is, in some ways, a security feature, since it makes it a bit trickier to spoof hosts.

If you want to work out exactly how the name translations are being done, please log a case (feel free to email your access number).