How to remove "old style" DECNET Proxies?

[Ken Fairfield]

We're running DECNET-Plus under VMS 7.3-1
with only the local namespace, i.e., we use
DECNET_REGISTER to add and remove nodes based
on their Phase IV addresses. We're using NSP
transport only.

In Authorize, we typically add proxies like:

SYSUAF> add/proxy LOCAL:.node::user user/default

Today I was attempting to cleanup some
obsolete proxy entries, particularly ones
of the form NODE::USER USER (D). One
can display these with:

SYSUAF> show/proxy/old *

However, I've found no way to REMOVE these
old style proxies (there is no /OLD qualifier
to REMOVE/PROXY).

In addition, for a certain subset of nodes,
ones that I in fact want to keep, there is
both a LOCAL:.NODE::USER and a NODE::USER
proxy. A remove/proxy removes the
LOCAL:.NODE::USER proxy, but not the
NODE::USER proxy.

Does anyone know how to remove the old-style
proxies???

Note: I did find a couple of discussions in
comp.os.vms from the 2000-2001 time frame
that basically said you need delete the old
NETPROXY.DAT, and possibly NET$PROXY.DAT,
file then recreate them (within Authorize).
I can do this on the system in question, but
not on other production nodes...

Thanks, Ken

[David B Sneddon]

Ken,

If the nodename in question has a valid IP address
you can use the following syntax

SYSUAF> remove/proxy ip$a.b.c.d::username localname

Dave

[Robert_Boyd]

Ken,

Once upon a time about 5 years ago I ran into a problem like this -- I remember writing a script to read all of the records of both types and generate a merged list of all the records. I may have used the output from AUTHORIZE SHOW/PROXY to do it.

The 2nd step of the script was to generate commands to delete all of the entries of both types. Then when the script was finished I believe that I did some work by hand to delete one or both of the files.

The script also generated a command file to re-generate all the proxies. I then edited the commands to make sure all of them were in the correct format and ran the command file to re-load all of the proxies.

I just did a search to see if I still have a copy of the procedure, but apparently it died with the system that it was used on when it was decommissioned.

Robert

[Ken Fairfield]

David, the IP$w.x.y.z::user method doesn't
work on our systems. I'm not surprised
since we haven't configured the TP4 (?)
transport (DECNET OSI over IP) and don't
use DNS with DECNET.

Robert, your suggestion is similar to what
I found in the comp.os.vms archives. It
may be the only solution, but for now I'm
looking for an alternative.

Thanks, Ken

[David B Sneddon]

Ken,

DNS is not the issue. I just tried the following...

$ tcpip set host test1/address=1.2.3.4
$ mcr authorize add/proxy test1::dsneddon dsneddon
%UAF-I-NAFADDMSG, proxy from TEST1::DSNEDDON to DSNEDDON added


This created an "old style" proxy entry.

$ tcpip set nohost test1
$ tcpip set host test1/address=2.3.4.5
$ mcr authorize remove/proxy test1::dsneddon
%UAF-I-NAFREMMSG, proxy from TEST1::DSNEDDON to * removed

I think all it needs is something that will equate
the the nodename in the old style proxies.

Dave

[David B Sneddon]

Sorry to follow up my previous post -- I just
re-read the original and you mentioned you are
_only_ using the local namespace...

I'll go back to sleep now.

Dave

[Veli Körkkö]

well, you could maybe use

$@sys$manager:net$configure advanced

and from menu selection 2 to reconfigure your
system to use LOCAL and DOMAIN. Now to make
sure that all still takes place via nsp (and you do not have OSI TRANSPORT configured at all you said?)


$ mcr ncr set session control transport precedence (nsp,tp4)

and maybe after this step

$ mcr ncl flush session control naming cache entry "*"
and then to remove the unneeded proxies with

$ ucx set host xyz/add=something !if needed
$ mcr authorize remove/proxy domain:.xyz::user user

once all proxies are removed, you could reconfigure the naming information again.
and the flush again and maybe undo the transport precedence stuff

$ mcr ncl set session control transport precedence ()

_veli

[Ken Fairfield]

Veli, please re-read the original question.
I simply stated that IP doesn't enter into
my problem and I'm not trying to turn it on.

My problem is with old, DECNET Phase IV
style proxies that I'd like to clean out.

Unless I hear another solution, I'll
probably go the route of renaming the
current NETPROXY.DAT and NET$PROXY.DAT out
of the way, then create new empty versions
via:

SYSUAF> create/proxy

Then repopulate the proxies from a command
procedure.

Still would be nice to have a:

SYSUAF> remove/proxy/OLD

command. Sigh...

Thanks, Ken

[Veli Körkkö]

ken,

I did note that you are not using DECnet over IP and do not wish to use.

My "solution" was to enable part of DECnet over IP temporarily. Namely the part of "DOMAIN lookups", not the actual DECnet travelling over transport really.

What good do I expect going from LOCAL to LOCAL,DOMAIN on name lookups?

Well, a unexpected method to remove those old proxies.

Since a typical DECnet (aka LOCAL) proxy gets added like

LOCAL:.TUOMAS::KORKKO
KORKKO (D)


whereas a IP style proxy appears just like
the OLD PROXY.

UAF> add/prox domain:.tuomas::korkko korkko/def
%UAF-I-NAFADDMSG, proxy from TUOMAS::KORKKO to KORKKO added
UAF> show/proxy *::*

Default proxies are flagged with (D)

TUOMAS::KORKKO
KORKKO (D)

LOCAL:.TUOMAS::KORKKO
KORKKO (D)

Therefore to remove those old proxies maybe one can reverse the process.

Of course doing this in live production is always ...


_veli

[David B Sneddon]

Ken,

The other option is just to delete the records
from the file. It is just an indexed file. It
wouldn't take much code.

Dave

[Ian Miller.]

"The other option is just to delete the records
from the file. It is just an indexed file. It
wouldn't take much code.
"
Do it in DCL and don't forget to restart the security server afterwards :-)

[Michael Yu_3]

Hi Ken,

This may come too late, but...

There are two proxy files, net$proxy.dat and netproxy.dat. Net$proxy.dat is used for phase V style full name while netproxy.dat is used for phase IV compatibility.

There is a program in sys$system, called convert_proxy.exe, which can convert the old proxy records to net$proxy.dat.

To get rid of records in netproxy.dat, use convert_proxy to convert it to net$proxy.dat, then use remove/proxy to remove the unwanted ones. This should remove the entries in both net$proxy.dat and netproxy.dat.

Thanks and regards.

Michael

[Jan van den Ende]

Ken,

from your Forum Profile:


I have assigned points to 7 of 14 responses to my questions.


Maybe you can find some time to do some assigning?

Mind, I do NOT say you necessarily need to give lots of points. It is fully up to _YOU_ to decide how many. If you consider an answer is not deserving any points, you can also assign 0 ( = zero ) points, and then that answer will no longer be counted as unassigned.
Consider, that every poster took at least the trouble of posting for you!

To easily find your streams with unassigned points, click your own name somewhere.
This will bring up your profile.
Near the bottom of that page, under the caption â My Question(s)â you will find â questions or topics with unassigned points â Clicking that will give all, and only, your questions that still have unassigned postings.

Thanks on behalf of your Forum colleagues.

PS. â nothing personal in this. I try to post it to everyone with this kind of assignment ratio in this forum. If you have received a posting like this before â please do not take offence â none is intended!

Proost.

Have one on me.

jpe