topic Re: Copying user accounts in Operating System - OpenVMS

Copying user accounts

Mike Poole_1 — Tue, 28 Feb 2006 13:51:28 GMT

Hi,

We are switching servers and upgrading from 7.2-1 to 7.3-2 on the 'new' server.

We have about 300 user accounts. Can I copy these from one server to another?

Call me lazy but I don't want to create 300 accounts by hand.

Thank you very much. This is the best IT forum anywhere and I appreciate the OVMS experts!

Re: Copying user accounts

Phillip Thayer — Tue, 28 Feb 2006 14:08:17 GMT

Mike,

I believe you can copy the authorize files to the new system. The files to copy would be:

SYS$SYSTEM:SYSUAF.DAT
SYS$SYSTEM:RIGHTSLIST.DAT
SYS$SYSTEM:VMSMAIL_PROFILE.DATA

I believe there is also a proxy file that would need to be copied as well but I don't recall the name right now.

Phil

Re: Copying user accounts

Uwe Zessin — Tue, 28 Feb 2006 14:11:52 GMT

For that I usually make a copy of SYSUAF and RIGHTLIST, run them though an EDIT/TPU session and remove all records I don't want/need.

I do that, because some special accounts like TCPIP$bla might have different UICs on different systems :-(

The editor will create a sequential file which I copy to the destination system. There, I merge the contents of the existing file with, e.g.:
$ CONVERT SYSUAF.DAT,SYSUAF.NEW ...

The DECnet proxy files are NETPROXY.DAT and NET$PROXY.DAT

Re: Copying user accounts

Arch_Muthiah — Tue, 28 Feb 2006 14:19:54 GMT

Mike,

The format of the SYSUAF.DAT, RIGHTSLIST, and associated files are upward-compatible.

The same basic steps necessary for moving RIGHTSLIST and SYSUAF files to another node are rather similar to the steps involved
in merging these files in an OpenVMS Cluster.

Regarding the new NET$PROXY.DAT file, I hope we have to use syss$system: convert_proxy.exe to convert netproxy.dat to net$proxy.dat

The big task here is that as RIGHTSLIST identifier values and UIC values that end up scattered around the target system must be rationalized to node where you copy.

The lattermost case is resolving the identifier values is the often most difficult part. If you find
that an identifier value (or identifier name) from the source RIGHTSLIST collides with that of an identifier existing on the
target system, you must first determine if the two identifiers perform the same function. In most cases, they will not. If you encounter a collision, changing both of the identifier binary values (or names)involved in the collision to new and unique values can prevent security problems.

In the same way the problem exist with UIC values, as these too tend to be scattered all over the system environment. Like the
binary identifier values, you will find UIC values associated with disks, ACLs, queues, and various other structures.

Archunan

Re: Copying user accounts

Arch_Muthiah — Tue, 28 Feb 2006 16:45:55 GMT

Mike,

This has been discussed in detail eariler in this forum....

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=975328

Archunan