Rexec on OpenVMS 7.3.2

[Dax Yap]

Hi

I would like to know by enabling REXEC service, do I have the options or how to restrict a particular IP and logon ID for client to access.
Appreciate your details explanation and help.

[Karl Rohwedder]

You can restrict access to specific services using the /ACCEPT or /REJECT qualifier in SET SERVICE, e.g.

$ TCPIP SET SERVICE REXEC/ACCEPT=x.y.z.w

regards Kalle

[Hoff]

In addition to the previous reply, you can set up a firewall box in front of the OpenVMS box. Smoothwall, M0n0wall, "pro-sumer" SMB/SOHO firewalls and high(er)-end network firewalls can all be options. This firewall has other advantages.

One-line questions are often surprisingly difficult to answer. What are you up to, and what are the details of the particular problem you're looking to solve? (I understand the direct question as did the previous poster, but there may be alternatives here that have not been considered.)

You could check credentials in SYLOGIN.COM, for instance.

Or use ssh and related.

Or use a web server and CGI.

Or...

As a general comment, the old-style r-tools such as rexec can be pretty leaky as network and data security goes, too.

Some background, please?

Stephen Hoffman
HoffmanLabs LLC

[Robert Gezelter]

Dax,

I wholeheartedly second Hoff's comment. Firewalls and TCP settings cannot (generally) discriminate by user, they are limited to discriminating by IP address.

Other methods involving validating the user once the connection is established can be more finely tuned. If trying to block access to remote users, blocking outside IP addresses is helpful, but a rogue office user could appear to come from a local IP address using a zombie program (or simply GOTOMYPC).

More information about the actual application requirement would perhaps make it possible to come up with a better suggestion as to how to accomplish the goal in a safe and secure way.

- Bob Gezelter, http://www.rlgsc.com

[Dax Yap]

Hi All,

Firstly, thanks for your valuable information.

I have an environment whereby 2 system located differently with firewall, client running on linux and host running on openvms.

The main reason is the system on openvms doesn't have IP spoofing on the firewall and the concern as mentioned earlier someone could just breach in.

I am looking the best effort to protect the system by identifying logon and IP for REXEC on openvms.

[Robert Gezelter]

Dax,

Have you considered the use of STUNNEL to provide a secure connection between the two systems?

- Bob Gezelter, http://www.rlgsc.com

[Dax Yap]

Hi Robert,

I believed both end has to be SSL enabled. Correct me if I am wrong.
Currently, the openvms is not complient to SSL.

[Robert Gezelter]

Dax,

OpenSSL and STUNNEL for OpenVMS are available via the HP OpenVMS www site at http://h71000.www7.hp.com/ebusiness/technology.html

A quick check of the SSL www pages leads one to the release notes and the pre-requisites, including OpenVMS 7.3-2. Please read the release notes as a starting point.

It goes without saying that when creating X.509 certificates for this purpose, I do not not recommend that clients use self-signed certificates for any purpose other than testing, and often not even that.

- Bob Gezelter, http://www.rlgsc.com

[Aaron Sakovich]

Since you're running 7.3-2, you may be running TCP/IP Services v5.4. If that's the case (or if you're running a third party stack), you can use SSH as a direct replacement for RSH -- you can issue a single command line just as you can with RSH, but in a secure, encrypted, and authenticated connection.

Try issuing the command "ssh -h" to see if it works. You may need to setup the server environments on both systems if that's not already been done. See the online docu for SSH here:

http://h71000.www7.hp.com/doc/732final/aa-rvbua-te/aa-rvbua-te.html

[Hoff]

Consider using a hardware-based VPN or tunnel. Most mid-grade and pro-sumer firewalls will include one or more of various VPN connections.