Anyone use OMS?

[Victor Mendham]

Anyone use OMS, care to relate any experiences, the good , the bad...

The OpenVMS Management Station (OMS) allows you to manage multiple OpenVMS systems from various Windows desktop platforms OMS includes two components:
Client â Installed on the PC from which you will manage OpenVMS systems
Server â Installed on each OpenVMS system to be managed

Account creation tasks can be done from OMS:
Add a UAF entry
Grant rights identifiers
Create directory
Set up disk quota
Set up user VMSmail characteristics

Account maintenance tasks can be done from OMS:
Update disk quota
Add privilege
Grant identifier
Remove account

[Mobeen_1]

I have used Mgmt Station for quite some time. But just found out that it was evantually easier to do the task using command line within UAF.

rgds
Mobeen

[labadie_1]

a friend of mine was interested, noticed that it was lacking the queues (print and batch, stop, and start...), and said it was useless

:-(

[Wim Van den Wyngaert]

I never used it but removed it from our systems. My boss used it without knowing what he was doing.

The problem was that the agent on VMS regularly started looping. It also doesn't handle nodes that are down/unreachable, sysuaf's that are distributed etc.

[Ian Miller.]

works ok but I use it rarely (being more of a command line sort of person). printer queues work ok also. However the emails when the disk error count or disk space gets too low have proved handy but there are other ways to do that.

[Dave Gudewicz]

We've field tested OMS in the past. Heard its moving to IA64. I'd say give it a spin.

With proper training, help desk people can use OMS to reset passwords, restart a queue, etc.

Let's face it, there are some who have never seen or used a command line interface these days. OMS fits the bill nicely for them.

In fact, just before I wrote this, I used it to check on a stalled queue.

[Steve Reece]

I tried it at one point, but it scared me that you couldn't tailor what the user was doing or what a user had access to.. It was an all or nothing thing.

[Ian Miller.]

steve - as far is I can tell you can specify everything you can in authorize, disk quota and vmsmail profile so I don't understand what you7 mean.

[Roger Grauwmeijer]

One of the nicest features is the ability to create new users based on an existing user or template (we have several disabled accounts with access/resources/identifiers set for different job roles). This is particularly useful where application control is via named identifiers - saves entering a whole lot of GRANT/ID commands!

[Steve Reece]

Ian,
My experience was that you couldn't prevent a helpdesk user (for example) that only needed access to resetting passwords from being able to create new accounts. I wanted a solution where I could limit access to functions and allow access to others through OMS but it didn't seem like it was able to do that.

Times may, however, have changed or I may have missed something.

Steve

[Ian Miller.]

OMS is just a GUI interface to AUTHORIZE and VMSMAILPROFILE and a couple of other bits. It's advantge is it brings all the things together in a GUI for people who like that sort of thing (I'm a CLI person myself). If you want e.g a limited function for a helpdesk user I think you have to make your own.

[Jan van den Ende]

have to make your own

That' s what we did.

For that (and other functions) we have (many versions of) a tiny c program that just spawns a (name hard coded!) command procedure.
This image has an ACL that limits access to holders of a specific identifier, and it is INSTALLed with the priv's needed for that function.
It is run from a menu that gets it entries from the various identifiers that specify which funtions/apllics a user is allowed.
Of course any error- & exit route is (subprocess-) LOGOUT, ie. UNpriv'd back into the menu.
This way we control exactly what certain users can and cannot do.
For example, at > 10K SYSUAF entries you DON'T want to maintain that by hand (and much less by GUI!!).
All personnel is loaded from the personnel system into SYSUAF automatically.
The Authorisation Group (which works 4-platform) have a menu that allows them to grant & revoke application identifiers to EXISTING personnel. Of course this is logged with all info that the auditors want to have on it (like who gave the order for it), AND they maintain a paper record of all requests.
People NOT from the personnel system (temporaty hired forces, supplier maintenance people etc) CAN be added (by a very limited number of people only), but only with expiration dates less than half a year into the future.
And of course we DON'T allow any interactive access to the system by any account that is not uniquely defined to be ONE and only ONE person.

We have also looked into various "one GUI, multi-platform" user-authorization tools, but we never found one that even remotely approached the granularity of control we want.
And after a rather short time most of the many people that have some form of these non-GUI menu's (usually in a terminal emulator window) are commenting at how must more pleasant it is to work WITHOUT having to access the mouse so often..


Jan