Limit interactive login to a user

[Edmundo T Rodriguez]

How can I limit the amount of times a user
can login interactively?

Let say I want user XYZ to be able to login
interactively only two times, but he should be
able to run as many process as he need.

[Ian Miller.]

I think if you modify the username in authorize to set maxjobs to 2 it should do it.

[Volker Halle]

Edmundo,

note that /MAXJOBS also limits the batch, detached and network jobs for the user. See UAF> HELP MOD/MAXJOBS

The user can spawn as many subprocesses as PRCLM allows (per each job).

Volker.

[Edmundo T Rodriguez]

That's exactly the issue that I am trying to
avoid. The user I am trying to limit generates many batch job while login in and some of the batch jobs do inter-process communication while executing the task.

But I don't want this user to login more than twice interactively because they always stay in the system for days and causes other problems.

[Ian Miller.]

Another way would be some code in the system wide login procedure SYLOGIN which for interactive logins obtained the username using F$GETJPI and checked the limit.

[Edmundo T Rodriguez]

I did a huge research on this accross multiple web-sites and not even the OpenVMS-Wizard seems to have a simple recomendation.

[Volker Halle]

Edmundo,

the following may not be 'simple', but it seems to work ;-)

This is a complex PIPE statement based on the following ITRC entry:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=876934

$ pipe show user 'F$GETJPI("","USERNAME") |
search sys$pipe/noout/stat 'F$GETJPI("","USERNAME") | search sys$pipe matched | ( read sys$pipe x ; y=F$ELEMENT(2," ",F$EDIT(x,"TRIM,COMPRESS")) ; def/job count &y )

The job-wide logical COUNT would contain the no. of times this user is logged in simultaneously cluster-wide. You can then base further decisions during SYLOGIN.COM on the value of this logical.

Volker.

PS: You might want to use your browser's View Source Text function to read and copy the above pipe statement. Note that it's all one DCL line.

[Robert Gezelter]

Edmundo,

You can also check the Process Name of the process from within SYLOGIN.COM (or a group LOGIN.COM invoked by SYLOGIN.COM). The first interactive process is automatically assigned a process name corresponding to the username. The second process (on that cluster node) is assigned a process name based on the login device. If the process name <> the username, then you could just LOGOUT the process.

It is a little more complex, but something similar could be done on a clusterwide basis with a little thought.

I hope that the above is helpful.

- Bob Gezelter, http://www.rlgsc.com

[Volker Halle]

Edmundo,

a slight correction:

You may want to include the argument for the first SEARCH command with a leading and trailing space, to prevent false matches, if the login username happens to be a substring of another logged in username, i.e. use:

" ''F$EDIT(F$GETJPI("","USERNAME"),"TRIM")' "

Volker.