topic Re: Turn off SET HOST for DECnet in Operating System - OpenVMS

Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 08:59:24 GMT

Here's what I'm looking to do:

Restrict DECnet access to task-to-task communications only. No SET HOST capability.

Someone mentioned to me there may be a logical OR SYSGEN param (or maybe even an NCL setting?) that would allow this.

Has anyone heard of this?

Thanks.

Re: Turn off SET HOST for DECnet

John Abbott_2 — Fri, 05 Jan 2007 09:06:22 GMT

Would using the UAF mod usr/NOREMOTE suffice ? (prohibits SET HOST whilst allowing TASK (network) logins).

Regards
John.

Re: Turn off SET HOST for DECnet

Jan van den Ende — Fri, 05 Jan 2007 09:08:44 GMT

Thomas,

if you really want to totally remove the functionality from your system, you can modify the definition for the SET command to no nonger contain the HOST syntax.

Use VERB SET to get the current definition, and remove the SET HOST paragraph.
Then SET COMMAND

Be careful NOT to accidentially change any other paragraphs, because that could change the behavior of other SET commands.

hth,

Proost.

Have one on me.

jpe

Re: Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 09:16:52 GMT

1) The UAF /noremote option actually worked. Too bad there's no way to do it on a systemwide basis...

2) I'm not familiar with the VERB SET command. Can you expand on how to do that? It's not the same as SET COMMAND, is it?

Re: Turn off SET HOST for DECnet

EdgarZamora_1 — Fri, 05 Jan 2007 09:23:33 GMT

Modifying the SET command makes me shudder.

Not foolproof, but simple... why not just add some code in SYLOGIN.COM to check for RT terminal and log out if it's RT?

Re: Turn off SET HOST for DECnet

John Abbott_2 — Fri, 05 Jan 2007 09:27:16 GMT

> 1) The UAF /noremote option actually worked. Too bad there's no way to do it on a systemwide basis...

UAF> MOD */NOREMOTE

:-)
J.

Re: Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 09:33:28 GMT

Hey Edgar - This is actually Jeff Lanka. Small world.

the SYLOGIN mod actually sounds like a decent idea too. Thanks

Re: Turn off SET HOST for DECnet

Jan van den Ende — Fri, 05 Jan 2007 09:34:41 GMT

Thomas,

from John's response and your answer I conclude that I probably misunderstood your question.

Setting accounts to /NOREMOTE disables _INCOMING_ connections, while removing SET HOST disables _OUTGOING_ connections.

And AFAIK (not tested though, can anyone confirm or dismiss this?) /NOREMOTE also disables incoming TELNET.

_IF_ however /NOREMOTE looks like what you need, do _one_ AUTHORIZE MOD */NOREMOTE, and you are done. (this also modifies the DEFAULT account, so accounts creared in the future will also have that setting).
As a bonus: it can be re-enabled at will on a per-account basis.

---

VERB [] is a (partial) reverse of SET COMMAND -- it extracts (for ) the CLD into a file, in CLD syntax, so it is available for SET COMMAND.

- just remembered, VERB is not standard VMS, it's DECUS-ware, I think now available on the freeware CD.

hth

Proost.

Have one on me.

jpe

Re: Turn off SET HOST for DECnet

EdgarZamora_1 — Fri, 05 Jan 2007 09:35:51 GMT

Hey Jeff... long time! I'm down in Naples, Florida now!

Regarding UAF /NOREMOTE... sounds great, too bad there's not the same switch for telnet.

Re: Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 09:37:56 GMT

ewwww.... DECUSware - we're not allowed to use that here, oh well...

Actually restricting TELNET would be OK, seeing as how we're striving for SSH only, TELNET is being shut down too. I think /noremote might be our best bet.

Re: Turn off SET HOST for DECnet

EdgarZamora_1 — Fri, 05 Jan 2007 09:38:50 GMT

>And AFAIK (not tested though, can anyone >confirm or dismiss this?) /NOREMOTE also >disables incoming TELNET.

Just tested it and it disables incoming telnet too!

Re: Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 09:39:54 GMT

>Hey Jeff... long time! I'm down in Naples, Florida now!

>Regarding UAF /NOREMOTE... sounds great, too bad there's not the same switch for telnet.

Naples - have you watched the swamp buggy races yet?

I'll tell Maria hello for you... I'm at 55 Water St. these days...

AFA TELNET, we've just disabled that service.

Re: Turn off SET HOST for DECnet

Ian Miller. — Fri, 05 Jan 2007 09:46:39 GMT

You could set an ACL on RTPAD.EXE preventing access to all. This will stop non-priv users.

Re: Turn off SET HOST for DECnet

Karl Rohwedder — Fri, 05 Jan 2007 09:50:47 GMT

Another way to prevent users from using SET HOST would be to disable access to the RTPAD image, either with /PROTE or by setting ACL's.

Changing the VERB defnition does not help, because a user may reset the commands for his current process only at his own will.

regards Kalle

Re: Turn off SET HOST for DECnet

Jan van den Ende — Fri, 05 Jan 2007 10:04:52 GMT

Edgar wrote:

>>>
Just tested it and it disables incoming telnet too!
<<<
and Thomas wrote:
>>>
seeing as how we're striving for SSH
<<<

Then be aware, and test first: I would expect /NOREMOTE to disallow SSH as well!

SYLOGIN testing to disallow RT and TN terminal name are probably your better option; pretty good match between "need" & "gain".
As an aside: How about FTP? The command mode of ftp also allows for many "pretty" accesses!

Proost.

Have one on me.

jpe

Re: Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 11:03:18 GMT

/NOREMOTE allows SSH.

Re: Turn off SET HOST for DECnet

EdgarZamora_1 — Fri, 05 Jan 2007 11:03:51 GMT

Hmmm... I just discovered that on a 7.3-1 system, the /NOREMOTE prevented me from using telnet too, but on my 7.3-2 system, the /NOREMOTE only prevented SET HOST and not telnet. I don't have the time to test SSH right now.

Re: Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 11:13:47 GMT

I tested on 7.3-2, and /NOREMOTE did NOT allow TELNET

Re: Turn off SET HOST for DECnet

EdgarZamora_1 — Fri, 05 Jan 2007 11:19:01 GMT

Well that's really strange. Maybe it has something to do with the version of TCPIP? Here's a log of my test...

CLCC1>
CLCC1> SHOW SYS/NOPROC
OpenVMS V7.3-2 on node CLCC1 5-JAN-2007 10:15:17.09 Uptime 54 01:56:32
CLCC1> TCPIP SHO VER

HP TCP/IP Services for OpenVMS Alpha Version V5.4 - ECO 4
on a AlphaServer 4100 5/533 4MB running OpenVMS V7.3-2

CLCC1> AUTH :== $SYS$SYSTEM:AUTHORIZE
CLCC1>
CLCC1> AUTH MOD EZAMORA /NOREMOTE
%UAF-I-MDFYMSG, user record(s) updated
CLCC1>
CLCC1> SET HOST 0

CLCC1 - Test System

Username: EZAMORA
Password:
You are not authorized to login from this source
%REM-S-END, control returned to node CLCC1::
CLCC1> TELNET CLCC1
%TELNET-I-TRYING, Trying ... 10.10.200.5
%TELNET-I-SESSION, Session 01, host clcc1, port 23
-TELNET-I-ESCAPE, Escape character is ^]

CLCC1 - Test System

Username: EZAMORA
Password:

Last interactive login on Friday, 5-JAN-2007 10:03:10.37
Last non-interactive login on Thursday, 4-JAN-2007 12:41:46.22

///////// //
#########/ ##/
#########/ ##/
##/ ##/
##/ ##/
##/ ##/
##/ ##/
##/////// ##///////
#########/ #########/
#########/ #########/
TEST SYSTEM
TEST SYSTEM
///////// /////////
#########/ #########/
#########/ #########/
##/ ##/
##/ ##/
##/ ##/
##/ ##/
##/////// ##///////
#########/ #########/
#########/ #########/
CLCC1> LO
EZAMORA logged out at 5-JAN-2007 10:16:55.41
%TELNET-S-REMCLOSED, Remote connection closed

Re: Turn off SET HOST for DECnet

Thomas A. Williams — Fri, 05 Jan 2007 11:20:25 GMT

re: Version of TCPIP

could be - we're running ECO6