lgi_brk_disuser seems to be not working

[Jan van den Ende]

Mustafa,

please follow Volkers last advise.

I can already forsee one of your (our your successor's) next questions:
"ALL of our accounts with SYSPRV have been blocked by too many tries. How can we still get into the system?"

It is a REAL danger. And it will not happen now, but probably some months, or years from now.
Maybe after you have left this site. In that case it will ruin your reputation!

Better convince the auditors of the risk. You may show them this thread, if they wish you to substantiate your arguments.

hth

Proost.

Have one on me.

jpe

[Robert Gezelter]

mustafa,

I must return Jan's compliment from the other day (in a different thread).

His advice is VERY sound. I often recommend going one step further: creating an emergency access account, whose username/password combination is stored in A SEALED ENVELOPE with other important corporate papers under control of the CFO.

Being completely locked out of the system is a serious problem, particularly when there is no option of rebooting the node in a standalone mode from the console to reset the password.

- Bob Gezelter, http://www.rlgsc.com

[Wim Van den Wyngaert]

Attempts to use decnet objects that have no listener active and that don't start one either can lead to intrusions. So, if you enable this LGI_BRK_LIM you might get into problems (user locked out and service not working when it get started).

Do know what exactly is done in the code but we do have that problem in server to server communications.

Wim

[Wim Van den Wyngaert]

Make that LGI_BRK_DISUSER of course.

Wim

[mustafa_12]

LGI_BRK_DISUSER is 0 now and I will try to convince them using these posts.