DECNET Phase IV

[Peter Quodling]

Just did a VMS 7.3-2 upgrade (from 7.3-1) and all went well, except... DECNET Plus was selected rather than Phase IV (something about HP strongly recommends going to DECnetplus).

It would appear that most everything is working, but the network objects for osu keep barfing...

We have now found that a couple of things have broken, most importantly our OSU web server. I have been reading the Decnetplus documentation all day, and am gouing cross-eyed - can anyone give a quick (how-to) on DECnet plus migration from Phase IV.

Failing that, we will have to revert, which will be either a) restore from backups, or b) remove decnet plus using PCSI and install DECNET Phase IV - I see indications that the kits are unbundled on this, and this should be doable from the V7.3-2 distribution media.

[Joseph Huber_1]

My suspicion is that name resolution is not working, and depending on that, DECNET proxies are not working.
Use MCR DECNET_REGISTER to populate the node-names and aliases for all nodes involved.

[Karl Rohwedder]

If my memory serves me right, when 1st running
NET$CONFIGURE after installing PhaseV, there should be a question regarding an old Phase IV
configuration and if the configure should convert this to PhaseV, incl. populating the node database.

regards Kalle

[David B Sneddon]

Peter,

Don't know anything about OSU, but if the problem
was introduced going from Phase IV to Phase V, is
it possible that OSU doesn't know about the correct
syntax for Phase V to define the network objects
and is still trying to use NCP to create the objects?
Is there anything in the OSU installation that asks
about DECnet?

Dave

[Karl Rohwedder]

PhaseV understands NCP and its syntax for manipulating objects, see SYSY$MANAGER:NET$NCP_APPLICATIONS.COM.

regards Kalle

[Joseph Huber_1]

Ah davids question reminds me:
OSU is not defining an object, but calling the DECnet TASK object using a proxie to itself.
So the TASK object has to be defined, and I think net$configure doesn't do it automatically.
In sys$manager:net$application_startup.ncl look if TASK is defined, if not, add it to net$application_local.ncl. It should look like this:
CREATE NODE 0 SESSION CONTROL APPLICATION TASK
SET NODE 0 SESSION CONTROL APPLICATION TASK ADDRESSES = {NAME=TASK} -
,CLIENT = -
,INCOMING ALIAS = TRUE -
,INCOMING PROXY = TRUE -
,OUTGOING ALIAS = FALSE -
,OUTGOING PROXY = TRUE -
,NODE SYNONYM = TRUE -
,INCOMING OSI TSEL =

[Peter Quodling]

osu under phase IV creates a number of decnet objects.

most importantly www_init

mc ncp def obj www_init number 0 file sys$manager:http_startup.com user httpd password 'p1 proxy both

and then a set obj etc...

and a mc ncp set known proxies all for good measure...

In Decnet plus I am issuing a
mc ncl
create node 0 sesion control application wwwinit
set node session control application wwwinit addresses = (name=wwwinit) -
,client= -
,incoming alias=true -
,incoming proxy=true -
,outgoing alias=false -
,outgoing proxy=true -
,imagename=sys$manager:http_startup.com -
,incoming osi tsel


The log file for the failed osu startup says...

$! DECnet-based scripting.
$!
$ define/sys www_init DISK01:[WWW1.SYSTEM]HTTP_STARTUP.COM;2
%DCL-I-SUPERSEDE, previous value of WWW_INIT has been superseded
$ open/write/read net 0"WWW_DEV pr0t3ct"::"0=WWW_INIT"
%DCL-E-OPENIN, error opening 0"WWW_DEV password"::"0=WWW_INIT" as input
-RMS-E-ACC, ACP file access failed
-SYSTEM-F-LINKABORT, network partner aborted logical link


q

[Peter Quodling]

re Karl, there is no sys$manager:net$ncp_applications.com (or any where on the system disk, for that matter....)

q

[Peter Quodling]

Joseph

there is a task definition in blah.ncl but it's.
SET NCL DEFAULT ENTITY NODE 0
!%
CREATE SESSION CONTROL APPLICATION TASK
SET SESSION CONTROL APPLICATION TASK ADDRESSES = {NAME = TASK} -
,NODE SYNONYM = TRUE -
,USER NAME = "ILLEGAL"


I'll try changing it.

[Karl Rohwedder]

Peter,

if you use NCP to SET an object, the mentioned file is created.

regards Kalle

[Karl Rohwedder]

Peter,

the last error messgae states WWW_INIT as
task object, but you define WWWINIT, may be
just a typo?

regards Kalle

[Joseph Huber_1]

No Peter, keep the ,USER NAME = "ILLEGAL",
it's a security measure, i.e. it allows only PROXY access to the object, and OSU HTTPD makes a proxy access.
Look at the opcom messages when OSU starts, it should show the access (and why it fails).

[Volker Halle]

Peter,

NCP DEFINE commands on DECnet-Plus will be converted to appropriate NCL commands and written (appended) to sys$manager:net$ncp_applications.com - you would need to invoke that procedure during SYSTARTUP_VMS.COM to actually have those objects (DECnet-Plus calls them: session control applications) defined during startup.

See docu about NCP emulator:

http://h71000.www7.hp.com/doc/72final/6499/6499pro_002.html#ncp_emul_tcl

Volker.

[Peter Quodling]

re karl (yup, I typed the posting by hand - it is as it should be, not as I wrote.

re .last -

Reset the task definition in NCL, restarted the web server, failed same-same nothing coming up in opcom... (yes, I did type reply/enable. )

[Joseph Huber_1]

... nothing coming up in opcom...
That's very strange.
To find out the general problem, test it independently from OSU:
create some test.com in Your home directory
doing nothing. Then
open/read/write net 0"user passwd"::"0=TEST"
This either succeds or gets an error seen in opcom. Is audit enabled (to see messages in opcom) ?
set audit/alarm/class=security/enable

[Peter Quodling]

set audit/alarm/ena=logfailure=net

because...
Dev> set audit/audit/class=security_class/alarm/enable
%SET-W-NOEVENTS, no valid auditing events specified; command ignored


open/read/write net 0"quodling passwordxx"::"0=fart"
%DCL-E-OPENIN, error opening 0"quodling password"::"0=fart" as input
-RMS-E-ACC, ACP file access failed
-SYSTEM-F-LINKABORT, network partner aborted logical link


%%%%%%%%%%% OPCOM 13-JUN-2005 19:58:09.78 %%%%%%%%%%%
Message from user AUDIT$SERVER on INFAC2
Security alarm (SECURITY) and security audit (SECURITY) on INFAC2, system id: 43030
Auditable event: Security alarm state set
Event time: 13-JUN-2005 19:58:09.75
PID: 00000584
Username: QUODLING
Alarm flags: LOGFAIL: (NETWORK)

[Karl Rohwedder]

I assume, that no NET$SERVER.LOG is created in your home directory?

[Peter Quodling]

Correct...

[Volker Halle]

Peter,

try: $ set audit/alarm/ena=conn

and then rety your DECnet connection.

Volker.

[Peter Quodling]

It occured to me, on the way home, (as it does after a long day in the office), that a couple of things come into play here... And now that I have a glass of wine, and calmed my weary nerves.

1. I don't know why I was talking about www_init it should be wwwexec that I am worrying about.

2. There are multiple instances of the web server each running under different user accounts, and even though everything web related is IP, they need a decnet connection - I noticed that there are proxies in the uaf that align to the names under which this is activated,

3. I also notice that there is a recommendation I came across, either in the startup script for OSU, or somewhere that says to "mc ncp set known proxies all" - I tried this under decnet-plus and got a message about. not being compatible with management interface or such like. Is there a decnet-plus equivalent?

Peter Q

[Volker Halle]

Peter,

2. this seems to be the implemented way in the OSU server to run certain operations (CGI scripts ?) in a new process context on the local node using DECnet PROXY access.

3. there are no commands in DECnet-Plus to explicitly re-load proxies (from the permanent to the volatile database - as in DECnet IV). You just manage proxies with AUTHORIZE.

If you audit your connections (with the command given in my previous reply), you should be able to figure out what's happening. As you are getting a LINKABORT error, a connection HAS been established, question is, why is it being aborted.

Volker.

[Joseph Huber_1]

www_init is called from http_startup.com,
wwwexec is called later when scripts are invoked.

But the OSU server is not Your problem until the general problem of invoking the TASK object is solved.
And proxies are not involved as long as a full access string "user password" is used (like You apparently pass as p1 to http_startup).

Does eventually analyze/audit/select=event=logfail/full reveal more than the opcom message does ?

[Joseph Huber_1]

Sorry, the correct command is
analyze/audit/select=user=quodling/event=logfail/full to show the details of the failed test.

[Jan van den Ende]

... leave out the /user=...
I am not so sure which account is used. My first guess would be the owner of OSU, but that is only a first guess.
Leave out the clause to get ANY logfail.
Maybe too much output to start with, but at least you do not miss it.

Proost.

Have one on me.

jpe

[Joseph Huber_1]

I was referring to the standalone test for the task object, under the user quodling, which gave an opcom message of LOGFAIL.

I think, as I wrote, that first the underlying problem to call the TASk object has to be cleared, then maybe OSU has still problems, but maybe not ...