-SYSTEM-F-INVLOGIN, login information invalid at remote node

[Rajeev Hejib]

I keep getting following error

IT4108> dir bgta02::
%DIRECT-E-OPENIN, error opening BGTA02::*.*;* as input
-RMS-E-FND, ACP file or directory lookup failed
-SYSTEM-F-INVLOGIN, login information invalid at remote node

I can set host to BGTA02.
When I do $show proc (on BGTA02 after set host) I get

BGTA02> show proc

16-JAN-2006 12:28:45.64 User: SYSTEM Process ID: 000AD1CD
Node: BGTA02 Process name: "SYSTEM"

Terminal: RTA1: (IP$10.54.09.56::SYSTEM)
User Identifier: [SYSTEM]
Base priority: 4
Default file spec: SYS$SYSROOT:[SYSMGR]
Number of Kthreads: 1

Devices allocated: BGTA02$RTA1:

I have proxy set for system and IT4108 is on local host list (see below).

Not sure why its not working. Any help will be really appreciated.

BGTA02> uaf show/proxy ip$10.54.09.56::system

Default proxies are flagged with (D)

IT4108::SYSTEM
SYSTEM (D)
BGTA02> ucx show host it4108

BIND database

Server: 10.38.3.20 jgcdns1

Host address Host name

10.54.9.56 IT4108.TRADING.CENTRICA.COM

[Robert Gezelter]

Rajeev,

What are the settings for the SYSTEM account? Pay particular attention to the NETWORK allowed login hours. Use AUTHORIZE to display this information (post the output from AUTHORIZE, if you are permitted to do so).

- Bob Gezelter, http://www.rlgsc.com

[Jan van den Ende]

Rajeev,

you defined your proxy in DECnet format, and your network info in IP format.

If this is correct, then you need to specify your proxy info in IP format as well.
That is NOT done with AUTHORIZE, but with TCPIP commands.

And for the exact syntax of that, please tell us which IP stack you are using.

Proost.

Have one on me.

jpe

[Rajeev Hejib]

Thanks Bob and JPE.
Bob,
I have checked the privileges and it has "no access restriction".
JPE,
Before, on UAF we could add proxy by specifying "IP$....::SYSTEM" but now everytime I try adding one it translates the IP$ proxy to the host name.

We have TCP/IP V5.3 on target and V5.4 on intiating node.

I have addedd UCX CD proxy for system on the target node. It still gives me same error.

[Daniel Fernandez Illan]

Rajeev

For use DECnet you need define proxies using DECnet format:
UAF>add/proxy IT4108::SYSTEM SYSTEM/D

(Possibly you will need delete previous proxy).

In this case command SHO/PROXY will display

LOCAL:.IT4108 ...

Remark the node prefix LOCAL: (It is standard for DECnet phase V proxy definition).

Command $dir bgta02:: is using DECnet, not TCP protocol.

Saludos.
Daniel.

[Rajeev Hejib]

Hi Daniel,

I have now set the proxy as LOCAL:.IT4108::SYSTEM SYSTEM/DEF

BGTA02> uaf show/proxy local:.it4108*::system

Default proxies are flagged with (D)

LOCAL:.IT4108*::SYSTEM
SYSTEM (D)
I still get the same error. OPCOM messages that pop on BGTA02 at that time are

BGTA02>
%%%%%%%%%%% OPCOM 16-JAN-2006 14:04:32.47 %%%%%%%%%%%
Message from user AUDIT$SERVER on BGTA02
Security alarm (SECURITY) and security audit (SECURITY) on BGTA02, system id: 40007
Auditable event: Network breakin detection
Event time: 16-JAN-2006 14:04:32.47
PID: 00000414
Process name: NET$ACP
Username: DNA$SessCtrl
Remote node id: 0 (0.0)
Remote node fullname: IP$10.54.09.56
Remote username: SYSTEM
Status: %LOGIN-F-NOTVALID, user authorization failure

BGTA02>
%%%%%%%%%%% OPCOM 16-JAN-2006 14:04:32.49 %%%%%%%%%%%
Message from user SYSTEM on BGTA02
Event: Access Control Violation from: Node LOCAL:.BGTA02 Session Control,
at: 2006-01-16-14:04:32.490+00:00Iinf
NSAP Address=/0A360938,
Source=UIC = [0,0]SYSTEM,
Destination=number = 17,
Destination User="",
Destination Account="",
Node Name=
eventUid 0486A948-8699-11DA-86D1-AA000400479C
entityUid A52A93DF-6C2A-11DA-8305-AA000400479C
streamUid AE686EBC-6C2A-11DA-844F-AA000400479C


BGTA02>

I had removed intrusion records before.
Also had done mc ncl flush...

[Jan van den Ende]

Rajeev,


Remote node fullname: IP$10.54.09.56


So you are using DECnet over IP !!!

Specify your proxy as:

UAF>add/prox IP$10.54.09.56::system */def

Somehow it seems the nodename-in-IP format does not get translated into IT4108, although the the way it is OK.

Success.

Proost.

Have one on me.

jpe

[Rajeev Hejib]

Thanks.

I have tried doing that before. But it translates IP$.... to host name

UAF> show/proxy ip$10.54.9.56::system

Default proxies are flagged with (D)

IT4108::SYSTEM
SYSTEM (D)
UAF>

[John Abbott_2 · Accepted solution]

Very odd.. can't quite see what you're doing wrong. We have a similar set-up here (Decnet over FDDI, DECNET over IP over SM and over 100MB FD links) The only difference that I can see is that your AUDIT alarm for remote system is reporting back the ip$10.54.09.56 I would have expected to see IT4108. Eg. I would have expected your audit alarm post to read...
.
.
.
"Remote node fullname: IT4108".
.
.
.

Not sure if anyone else can shed some light here...

We have proxy setup using the DECnet node name, no IP values, just like Daniel suggests.

What is the output from the command
$mc ncl sho sess con nam search path
on both systems ?

[Rajeev Hejib]

On IT4108

IT4108> mc ncl sho sess con nam search path

Node 0 Session Control
at 2006-01-16-15:05:59.795+00:00Iinf

Characteristics

Naming Search Path =
{
[
Directory Service = Local ,
Template = "*"
] ,
[
Directory Service = Local ,
Template = "local:*"
] ,
[
Directory Service = Local ,
Template = "LOCAL:.*"
] ,
[
Directory Service = Domain ,
Template = "*"
] ,
[
Directory Service = Domain ,
Template = "*.UK.CENTRICAPLC.COM"
]
}

IT4108>

On BGTA02

BGTA02> mc ncl sho sess con nam search path

Node 0 Session Control
at 2006-01-16-15:06:16.864+00:00Iinf

Characteristics

Naming Search Path =
{
[
Directory Service = Domain ,
Template = "*"
] ,
[
Directory Service = Domain ,
Template = "*.uk.centricaplc.com"
] ,
[
Directory Service = Domain ,
Template = "*.trading.centrica.com"
] ,
[
Directory Service = Local ,
Template = "*"
] ,
[
Directory Service = Local ,
Template = "local:*"
] ,
[
Directory Service = Local ,
Template = "local:.*"
]
}

BGTA02>