LGI_RETRY_LIM and LGI_BRK_LIM

[stepstepvms]

Hi all,

I have a question about LGI_RETRY_LIM and LGI_BRK_LIM. I know that LGI_RETRY_LIM specifies the number of retry attempts allowed users attempting to log in while LGI_BRK_LIM specifies the number of failures that can occur at login time before the system takes action against a possible break-in. I am confused that is there any difference between these two parameters ?

Moreover, by using SHOW AUDIT i know that the host security audit is enable for
Logfailure: batch,dialup,local,remote,network,subprocess,detached, server

Would you mind telling me what does the logailure value "server" mean ?

Thanks a lot !

[Jon Pinkley]

The output of

$ mcr sysgen help sys_param lgi

seems reasonably clear (except for the last sentence of the description of LGI_RETRY_LIM which states "As long as neither LGI_BRK_LIM nor LGI_BRK_TMO has elapsed, the user can dial in again and reattempt login." What I think it should state is "As long as breakin evasion is not in effect, the user can reconnect and reattempt login."

In short LGI_RETRY_LIM applies to a single run of LOGINOUT. Once the limit is hit, VMS disconnects, and the user will have to connect again.

LGI_BRK_LIM is related to breakin evasion. It is system wide in scope and applies across multiple activations of LOGINOUT. During breakin evasion, a correctly entered username/password will be rejected with the same message as if it were entered incorrectly. This is to limit the amount of password guessing verification that can be done.

See the "OpenVMS System and Password Security" section of http://h71000.www7.hp.com/openvms/journal/v3/ask_the_wizard.html

and for the "Official Documentation"

http://h71000.www7.hp.com/doc/732final/aa-q2hlg-te/aa-q2hlg-te.html

or in pdf

http://h71000.www7.hp.com/doc/732final/aa-q2hlg-te/AA-Q2HLG-TE.pdf

See chapter 7, section "Controlling the Login Process"

After you read those, if there is something that isn't clear, let us know.

Jon

[John Gillings]

Very different!

Connect to a system (say by telnet), you now get LGI_RETRY_LIM attempts to login before the system will drop the connection. You then have to connect again. This introduces a delay in login attempts.

LGI_BRK_LIM is a threshold on login failures inside a sliding time window (see LGI_RETRY_TMO) before the system considers further login failures to be intrusion attempts.

>what does the logfailure value "server" mean ?

SERVER Server or TCB-based login failure.

See Guide to OpenVMS System Security for more detail.