topic Re: limiting interactive logins in Operating System - OpenVMS

limiting interactive logins

CHRIS KRALL — Fri, 27 Feb 2009 18:28:22 GMT

I wish to limit interactive access to a VMS node to certain persons. In the past the UAF flag

Local: ----- No access ------

could be set a such which prevented interactive logins, which remains true over decnet.

Username: jdoe
Password:

You are not authorized to login from this source

SSH appears to ignore this flag. I have also tried various lexical functions (getjpi) to no avail.

Anyone have any success limiting interactive logins to specific persons when the person is accessing via ssh?

Re: limiting interactive logins

marsh_1 — Fri, 27 Feb 2009 18:56:45 GMT

hi,

in the sshd2_config file there is the allowusers/denyusers/allowgroups/denygroups options to use.

HTH

Re: limiting interactive logins

Robert Gezelter — Fri, 27 Feb 2009 19:03:10 GMT

Chris,

Yes. The LOCAL setting is a rather crude bludgeon.

The OP does not mention which IP stack or which version of OpenVMS is involved.

Personally, what I have done in several cases is to make a change to either SYS$MANAGER:SYLOGIN.COM (or a group login file invoked by SYLOGIN.COM) to check the device name against a Rights List Identifier.

If the user holds the Identifier, the login is permitted, if not, output the appropriate message and LOGOUT.

Using this approach, it is important to disable CNTRL-Y etc by default (else an enterprising user could just keep hitting the keys to bypass the check).

- Bob Gezelter, http://www.rlgsc.com

Re: limiting interactive logins

CHRIS KRALL — Fri, 27 Feb 2009 19:51:39 GMT

Mark

this rule would apply for sftp as well?

Re: limiting interactive logins

marsh_1 — Fri, 27 Feb 2009 20:22:21 GMT

hi,

yes, it uses ssh as well.

Re: limiting interactive logins

marsh_1 — Fri, 27 Feb 2009 20:33:14 GMT

sorry should have said file is in dir sys$sysdevice:[tcpip$ssh.ssh2] and disable/enable ssh service when you've done your change (assuming vms tcpip)

hth

Re: limiting interactive logins

Hoff — Fri, 27 Feb 2009 22:04:09 GMT

That the sshd isn't (fully) checking the authorization database looks like a bug in the implementation.

If you have a support contract, send along a bug report to HP.

Re: limiting interactive logins

Kees L. — Mon, 02 Mar 2009 07:40:19 GMT

If you modify the userrecord with:
$ uaf modify user /nonetwork
then login through ssh will be disabled.
Also (s)ftp and similar by the way.