topic SSH in a captive account? in Operating System - OpenVMS

SSH in a captive account?

Thomas A. Williams — Wed, 10 May 2006 10:04:52 GMT

I just tried to run an ssh and scp command from a captive account, and I got this error:

' System error message: 'captive account - spawn command not allowed'

Is there any workaround to this? Or are SSH commands not going to work from a captive account?

Re: SSH in a captive account?

Thomas A. Williams — Wed, 10 May 2006 14:17:36 GMT

Correction - the SSH command actually works from a captive account. It's just the SCP command that doesn't

Re: SSH in a captive account?

Steven Schweda — Wed, 10 May 2006 16:37:50 GMT

I don't know anything, but SHOW PROCESS
/SUBPROCESSES (/IDENTIFICATION = xxxxxxxx)
does show a subprocess when SCP is run, and
a quick dump of the executable
(SYS$SYSTEM:TCPIP$SSH_SCP2.EXE) does show
what looks like message text mentioning
"sys$creprc()", so I'd guess that you're
doomed.

A quick Google search for:
scp subprocess
turns up a few places which say things like:

Recall that the command:

$ scp ... S:file ...

actually runs ssh in a subprocess to connect to S and invoke a remote scp server. [...]

(http://www.unix.org.ua/orelly/networking_2ndEd/ssh/ch11_05.htm)

All of which seems to reinforce the initial
impression of doom.

Re: SSH in a captive account?

John Gillings — Wed, 10 May 2006 18:00:45 GMT

Thomas,

The big hammer fix would be to set bit 6 in the SYSGEN parameter SECURITY_POLICY - this allows SPAWN from CAPTIVE accounts. Depending on your environment, it might not be appropriate to open this hole.

Note SECURITY_POLICY is NOT dynamic so it's a reboot to set or clear it.

If the SPAWN command is in DCL, you could add /TRUSTED, or if you can get at the source code, add the flag CLI$M_TRUSTED to the LIB$SPAWN FLAGS parameter.

I checked the SCP command for a "TRUSTED" flag, nothing obvious.

Re: SSH in a captive account?

Thomas A. Williams — Thu, 11 May 2006 07:42:36 GMT

Thanks for the replies. I also opened a call with HP support and this was their reply:

"Iâ ve confirmed the behavior, and have contacted TCPIP engineering about it, and waiting for a response."