topic VMS AUDIT LOG in Operating System - OpenVMS

VMS AUDIT LOG

Sk Noorul Hassan — Fri, 25 Sep 2009 09:04:43 GMT

Hi,

I am getting the following information in audit log of one of the vms server VAX111.

"2-APR-2009 12:58:55.09 LOGFAIL NETWORK VAX111 ILLEGAL 00084EF3"

What does this ILLEGAL mean?

Re: VMS AUDIT LOG

Volker Halle — Fri, 25 Sep 2009 10:13:37 GMT

Hi,

the string 'ILLEGAL' is the local username used for the attempted DECnet network access.

Check your DECnet object (or session control application) database for this username.

As far as I remember, this string could be used to protect the TASK object from remote default access.

Volker.

Re: VMS AUDIT LOG

Hein van den Heuvel — Fri, 25 Sep 2009 10:22:17 GMT

The word ILLEGAL appears in the columns between nodename and ID where typically the username appears. That's what the ANAL/AUDI column headers indicate, That's what the data on my system looks like.

Do you have any reason to believe that 'ILLEGAL' is not simply a username?

Now on my 8.3 system, when I cause a LOGFAIL using an invalid (illegal?!) username that name is NOT displayed, but the text is used.

It would not surprise me if some earlier OpenVMS version reported the actually username which is not unlikely to be a fat-fingered password.

What OpenVMS version is being used? Considering the node name... V5.5-2 ?

Check out:
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1372502

Hein.

Re: VMS AUDIT LOG

Sk Noorul Hassan — Fri, 25 Sep 2009 10:28:29 GMT

Thanks. I got it.

Re: VMS AUDIT LOG

Hein van den Heuvel — Fri, 25 Sep 2009 10:32:41 GMT

Ah! now I remember. Volker is right of course. I was also right, in that is was a username.
I just did not see it on my system because I happened to have the task object enabled.

See for example : http://h71000.www7.hp.com/doc/73final/documentation/pdf/decnet_ovms_gd_network.pdf

The username used could be anything, but is by default establish as 'ILLEGAL' with the command

MCR NCP DEFINE OBJECT TASK NUMBER 0 USER ILLEGAL PASSWORD DISABLED

It can be verified with MCR NCP SHOW KNOWN OBJECTS

Hein.