Turn off SET HOST for DECnet

[Thomas A. Williams]

Here's what I'm looking to do:

Restrict DECnet access to task-to-task communications only. No SET HOST capability.

Someone mentioned to me there may be a logical OR SYSGEN param (or maybe even an NCL setting?) that would allow this.

Has anyone heard of this?

Thanks.

[John Abbott_2]

Would using the UAF mod usr/NOREMOTE suffice ? (prohibits SET HOST whilst allowing TASK (network) logins).

Regards
John.

[Jan van den Ende]

Thomas,

if you really want to totally remove the functionality from your system, you can modify the definition for the SET command to no nonger contain the HOST syntax.

Use VERB SET to get the current definition, and remove the SET HOST paragraph.
Then SET COMMAND

Be careful NOT to accidentially change any other paragraphs, because that could change the behavior of other SET commands.

hth,

Proost.

Have one on me.

jpe

[Thomas A. Williams]

1) The UAF /noremote option actually worked. Too bad there's no way to do it on a systemwide basis...

2) I'm not familiar with the VERB SET command. Can you expand on how to do that? It's not the same as SET COMMAND, is it?

[EdgarZamora_1]

Modifying the SET command makes me shudder.

Not foolproof, but simple... why not just add some code in SYLOGIN.COM to check for RT terminal and log out if it's RT?

[John Abbott_2]

> 1) The UAF /noremote option actually worked. Too bad there's no way to do it on a systemwide basis...

UAF> MOD */NOREMOTE

:-)
J.

[Thomas A. Williams]

Hey Edgar - This is actually Jeff Lanka. Small world.

the SYLOGIN mod actually sounds like a decent idea too. Thanks

[Jan van den Ende]

Thomas,

from John's response and your answer I conclude that I probably misunderstood your question.

Setting accounts to /NOREMOTE disables _INCOMING_ connections, while removing SET HOST disables _OUTGOING_ connections.

And AFAIK (not tested though, can anyone confirm or dismiss this?) /NOREMOTE also disables incoming TELNET.

_IF_ however /NOREMOTE looks like what you need, do _one_ AUTHORIZE MOD */NOREMOTE, and you are done. (this also modifies the DEFAULT account, so accounts creared in the future will also have that setting).
As a bonus: it can be re-enabled at will on a per-account basis.

---

VERB [] is a (partial) reverse of SET COMMAND -- it extracts (for ) the CLD into a file, in CLD syntax, so it is available for SET COMMAND.

- just remembered, VERB is not standard VMS, it's DECUS-ware, I think now available on the freeware CD.

hth

Proost.

Have one on me.

jpe

[EdgarZamora_1]

Hey Jeff... long time! I'm down in Naples, Florida now!

Regarding UAF /NOREMOTE... sounds great, too bad there's not the same switch for telnet.

[Thomas A. Williams]

ewwww.... DECUSware - we're not allowed to use that here, oh well...

Actually restricting TELNET would be OK, seeing as how we're striving for SSH only, TELNET is being shut down too. I think /noremote might be our best bet.