topic Re: Security Review Script in Operating System - OpenVMS

Security Review Script

Jack Trachtman — Wed, 05 Sep 2007 14:58:37 GMT

Years ago I had seen a DCL script which would review a VMS config for some obvious security issues (eg AUTHORIZE entries w/o Identifiers, DECnet accounts with default pwds, etc).

I don't recall if this was an HP script or a third party script. I've scoured the web without success.

If anyone remembers this, can they point me to a copy? TIA

Re: Security Review Script

Richard W Hunt — Thu, 06 Sep 2007 11:42:34 GMT

Can't post it, darn thing is too big.

If you have access to a DISA site, or friends in the U.S. Government who have such access, you could look for OPENVMS-SRR-V2R2.COM - but beware that it is terribly buggy. Not to mention that it is a resource hog and takes literally hours to run on a big system.

I had a copy, ran it, barfed (I barfed just after it did...), and rewrote the bugger to fit our site's configuration a little better.

There are at LEAST 6 faulty loops and more than a couple of bad variable references, but it IS a starting point.

Larry Kilgallen might have something more directed, updated, and immediately useful - for a price.

Re: Security Review Script

Hein van den Heuvel — Thu, 06 Sep 2007 17:38:01 GMT

Back in the good old days ( |d|i|g|i|t|a|l|, Easynet, Valbonne ) we used, or were told to use 'inspect'.
I believe my dear, late, friend Dave Monahan worked on that for a while.

Did that become the "Polycenter Security Compliance Manager (PSCM)"
Avaiable through Touch Technologies, Inc?

http://www.ttinet.com/products.html
http://www.ttinet.com/doc/pscm/user_guide_003.html

Hope this helps some,
Hein van den Heuvel (at gmail dot com)
HvdH Performance Consulting

Re: Security Review Script

Hoff — Fri, 07 Sep 2007 16:48:55 GMT

There are any number of these DCL procedures around, and there are (were) tools that specifically sought various insecurities, attacks or known issues. Here's one starting point, with info on the VMS SRR mentioned earlier:

http://64.223.189.234/node/43

And it's perfectly fine to have an entry without an identifier.

If you want to work on your password security, start here:

http://64.223.189.234/node/229