topic Re: Limit interactive login to a user in Operating System - OpenVMS

Limit interactive login to a user

Edmundo T Rodriguez — Tue, 09 May 2006 11:36:46 GMT

How can I limit the amount of times a user
can login interactively?

Let say I want user XYZ to be able to login
interactively only two times, but he should be
able to run as many process as he need.

Re: Limit interactive login to a user

Ian Miller. — Tue, 09 May 2006 11:41:24 GMT

I think if you modify the username in authorize to set maxjobs to 2 it should do it.

Re: Limit interactive login to a user

Volker Halle — Tue, 09 May 2006 11:54:51 GMT

Edmundo,

note that /MAXJOBS also limits the batch, detached and network jobs for the user. See UAF> HELP MOD/MAXJOBS

The user can spawn as many subprocesses as PRCLM allows (per each job).

Volker.

Re: Limit interactive login to a user

Edmundo T Rodriguez — Tue, 09 May 2006 12:00:33 GMT

That's exactly the issue that I am trying to
avoid. The user I am trying to limit generates many batch job while login in and some of the batch jobs do inter-process communication while executing the task.

But I don't want this user to login more than twice interactively because they always stay in the system for days and causes other problems.

Re: Limit interactive login to a user

Ian Miller. — Tue, 09 May 2006 12:03:06 GMT

Another way would be some code in the system wide login procedure SYLOGIN which for interactive logins obtained the username using F$GETJPI and checked the limit.

Re: Limit interactive login to a user

Edmundo T Rodriguez — Tue, 09 May 2006 12:29:00 GMT

I did a huge research on this accross multiple web-sites and not even the OpenVMS-Wizard seems to have a simple recomendation.

Re: Limit interactive login to a user

Volker Halle — Tue, 09 May 2006 12:53:20 GMT

Edmundo,

the following may not be 'simple', but it seems to work ;-)

This is a complex PIPE statement based on the following ITRC entry:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=876934

$ pipe show user 'F$GETJPI("","USERNAME") |
search sys$pipe/noout/stat 'F$GETJPI("","USERNAME") | search sys$pipe matched | ( read sys$pipe x ; y=F$ELEMENT(2," ",F$EDIT(x,"TRIM,COMPRESS")) ; def/job count &y )

The job-wide logical COUNT would contain the no. of times this user is logged in simultaneously cluster-wide. You can then base further decisions during SYLOGIN.COM on the value of this logical.

Volker.

PS: You might want to use your browser's View Source Text function to read and copy the above pipe statement. Note that it's all one DCL line.

Re: Limit interactive login to a user

Robert Gezelter — Tue, 09 May 2006 20:33:10 GMT

Edmundo,

You can also check the Process Name of the process from within SYLOGIN.COM (or a group LOGIN.COM invoked by SYLOGIN.COM). The first interactive process is automatically assigned a process name corresponding to the username. The second process (on that cluster node) is assigned a process name based on the login device. If the process name <> the username, then you could just LOGOUT the process.

It is a little more complex, but something similar could be done on a clusterwide basis with a little thought.

I hope that the above is helpful.

- Bob Gezelter, http://www.rlgsc.com

Re: Limit interactive login to a user

Volker Halle — Wed, 10 May 2006 02:19:16 GMT

Edmundo,

a slight correction:

You may want to include the argument for the first SEARCH command with a leading and trailing space, to prevent false matches, if the login username happens to be a substring of another logged in username, i.e. use:

" ''F$EDIT(F$GETJPI("","USERNAME"),"TRIM")' "

Volker.