Security Review Script

[Jack Trachtman]

Years ago I had seen a DCL script which would review a VMS config for some obvious security issues (eg AUTHORIZE entries w/o Identifiers, DECnet accounts with default pwds, etc).

I don't recall if this was an HP script or a third party script. I've scoured the web without success.

If anyone remembers this, can they point me to a copy? TIA

[Richard W Hunt]

Can't post it, darn thing is too big.

If you have access to a DISA site, or friends in the U.S. Government who have such access, you could look for OPENVMS-SRR-V2R2.COM - but beware that it is terribly buggy. Not to mention that it is a resource hog and takes literally hours to run on a big system.

I had a copy, ran it, barfed (I barfed just after it did...), and rewrote the bugger to fit our site's configuration a little better.

There are at LEAST 6 faulty loops and more than a couple of bad variable references, but it IS a starting point.

Larry Kilgallen might have something more directed, updated, and immediately useful - for a price.

[Hein van den Heuvel]

Back in the good old days ( |d|i|g|i|t|a|l|, Easynet, Valbonne ) we used, or were told to use 'inspect'.
I believe my dear, late, friend Dave Monahan worked on that for a while.

Did that become the "Polycenter Security Compliance Manager (PSCM)"
Avaiable through Touch Technologies, Inc?

http://www.ttinet.com/products.html
http://www.ttinet.com/doc/pscm/user_guide_003.html


Hope this helps some,
Hein van den Heuvel (at gmail dot com)
HvdH Performance Consulting

[Hoff]

There are any number of these DCL procedures around, and there are (were) tools that specifically sought various insecurities, attacks or known issues. Here's one starting point, with info on the VMS SRR mentioned earlier:

http://64.223.189.234/node/43

And it's perfectly fine to have an entry without an identifier.

If you want to work on your password security, start here:

http://64.223.189.234/node/229