XDM - insufficient privilege

[Brian Reiter]

Hi All,

So I'm trying to get XDM working on a variety of OpenVMS hosts, from Alpha 7-3-2, Alpha 8-3 and Itanium 8-3-1. I'm using xming from the PCs.

In all cases I get the following message

%SYSTEM-F-NOPRIV, insufficient privilege or object protection violation

in the TCPIP$XMD_RUN.LOG file. I'm assuming there is a little bit of configuration missing somewhere. File permissions seem to be OK in the TCPIP$XDM directory

Any thoughts or advice?

cheers

Brian

[RBrown_1]

I have no idea what XDM (XMD?) is, but the following things come to mind.

How is it run? Is if possible to to stick a SET VERIFY someplace that will provide additional information?

Can you learn anything by running it interactively?

Can you run it in the debugger?

[Hoff · Accepted solution]

Shotgun answer follows:

The X Windows Display Manager (XDM) and its associated control program XDMCP are components of a distributed X Windows login- and session-management environment.  

Xming is a free X Windows client for Windows systems.   (This, PuTTY, and tools such as ssh are common additions to Windows systems.)

XDM can fail for various reasons.  Given the generic NOPRIV error reported, the first visit would be a look at the file ownership and protections, and at the parent directory ownership, and probably anyting with *XDM* in the filename.  Then the oft-recommended choice is security auditing.  Enable security auditing (or security alarms), try the failing action, and  see what (if anything) shows up in the audit logs or in the alarm displays.

Given the unfortunate UI complexity of managing XDM (and most of the rest of TCP/IP Services), review the configuration directions from the documentation, and ensure each step has been followed.   Ensure that the XDM server is started via the TCPIP$CONFIG tool, or was configured to start and subsequently failed, as the error implies has happened here.

Try restarting all of TCP/IP Services (as sometimes it gets itself in an odd state), or reboot the VMS servers.

Check the patch levels, and upgrade to current patches where applicable.

In particular, the NOPRIV implies either a file or parent directory ownership issue.  Unfortunately for debugging these, I've encountered a few instances where error messages have been "re-purposed" within some applications, and this might not be a VMS-generated NOPRIV error, which means you might not get a report in security auditing.

And FWIW, do what you can to elimate the usage of words akin to "seems" or "appears" whenever debugging.  Aim for "is" or "is not".  If you're not sure whether some setting is valid or is not valid, then please research it, or please consider posting the current details or settings, and somebody here can have a look at them.  Put another way, areas where "seems" or "appears" might be used can be good targets to rule in or rule out a configuration error.

I'll assume OpenVMS I64 V8.3-1 was intended to reference OpenVMS I64 V8.3-1H1.  (If you're running OpenVMS I64 V8.2-1, then you'll definitely want to upgrade that box to V8.3-1H1.)

If this configuration is a cluster, then also look for skewed ownerships and skewed authorization database values, as a mis-configured cluster can cause all sorts of odd protection errors when hosts have different UIC values for TCP/IP Services components that have and create OpenVMS usernames.

[Brian Reiter]

Hi Hoff,

Thanks for the pointers. The account TCPIP$XDM requires the GRPNAM privilege, the default account setup doesn't have it. Got to the login screen by amending the privieges for the account and then restarting the TCPIP$XSM service.

The other thing to check is the protection on SYLOGIN.COM. One machine didn't have W:RE on this file.

So a combination of things, but at least it all works.

cheers

Brian

[Brian Reiter]

OK, one final query around this area. I need to fiddle with the keyboard maps to get things all hunky-dory and working before I pass the details onto the team.

The following link

http://h30499.www3.hp.com/t5/General/Xming-key-map-for-EVE-application-keypad/m-p/4635931#M18263 

References information deep within the previous forum - is there an easy way to get to this particular topic?

Or does anyone have any more information on setting up xming with the appropriate VMS keydoard maps.

cheers (again)

Brian

[Hoff]

X keyboard mapping gets discussed regularly, and various folks have tools or keyboard maps available,   From my site: "DECxterm package on the OpenVMS Freeware V7.0 distro. Alternatively, see the Ask The Wizard topic (5869) for information example X keyboard mappings.", and particular see AskHL: Mac OS X and X11 VT Function and Editing Keypads (yes, the title says "Mac", other X server tools will typically use the same or a similar scheme.)

I'd recommend moving away from software or command interfaces that need the keypad; that's dead technology.  The toughest tool for me to migrate was the text editor; I'm increasingly using vim for that.  Most of the other tools I'd been working with (the OpenVMS Debugger, etc) have/had command mode interfaces, or alternatives to using the keypad.

As for finding stuff in ITRC's HPSC downgrade, the robots.txt file here is/was reportedly broken, and Google was/is apparently blocked, and there is no URL contininuity for the old URLs.  In aggregrate, that means using the search box here is the only way, but make sure you don't end up using the default constraint of "board" or such in that picker.  Use "category" or "community" to search what's here.  Obscure names, all, yes.  The search engine is  also implemented to not widen its search for a better match, even if it gets no match.  So basically you have to reset the thing regularly to allow it to return hits from the old ITRC indexes.  And use some substring or title string as returned from the Google ITRC cache, at least until HP sorts out the broken robots.txt and (if they're not explicitly blocking it) allowing Googlebot to index the HPSC forums.

I don't see the previous cited post in the "community-wide" search index based on the name cited there; the search engine is tweaked to place the topics containing all those congratulatory replies for a new graphical icon far higher in the search results, too, so there's often more to wade through.  That may not have been migrated.

[Dennis Handly]

>References information deep within the previous forum - is there an easy way to get to this particular topic?

Using mr google's cache and a forum search finds:

http://h30499.www3.hp.com/t5/Hardware/What-client-instead-of-old-VT/m-p/3765186

>As for finding stuff in ... there is no URL continuity for the old URLs.

They said they would eventually fix them.

>And use some substring or title string as returned from the Google ITRC cache

That's what I did.

>at least until HP sorts out the broken robots.txt and allowing Googlebot to index the HPSC forums.

google already works, you just have to help it by adding: site:h30499.www3.hp.com

(The EBC forum has no connection with HPSC, they are separate.)

>That may not have been migrated.

They solved the closed thread issue several weeks ago.