password complexity enforcement for OpenVMS 7.3-1 and OpenVMS 7.3-2

[Joseph Huber_1]

No such error on my Alpha 7.3-1 system and IA64 8.3 .
What is Your system ?
Do You have a symbol MACRO ? (show symbol macro).

[Thanassis Papadimitriou]

$ show symbol macro
%DCL-W-UNDSYM, undefined symbol - check validity and spelling
$ show system
OpenVMS V7.3-2

[Joseph Huber_1]

Since I have not really changed parse_uic.mar, just replaced lib$tparse by lib$table_parse,
try "macro parse_uic_vax", the original.

My only idea is that the default macro command in 7.3-2 is invoking the Alpha assembler, not macro32.
Try "macro/migrate parse_uic" to see if that works.

If yes, replace the macro commands in compile.com by macro/migrate.

[Joseph Huber_1]

Oh no, I see compile.com does already macro/migrate for alpha and ia64.
So the problem must be in VMS 7.3-2 macro in general or Your installation specifically.

I assume your previous distribution of uaf.zip was working, except it did not have the newer flags keyword: compare the parse_uic.mar from there with the new one. Does it compile ?

[Joseph Huber_1]

And BTW AMAC-E- messages clearly are generated bvy the Alpha macro-assembler, NOT the macro32 (Vax-macro-) compiler.
I really wonder how You were able to compile before ?

[Thanassis Papadimitriou]

I was not able to compile.

I downloaded an already compiled distribution with .obj and .exe already created.

[Joseph Huber_1]

Well then, I have no idea what causes this behaviour. macro/migrate should invoke the macro32 compiler, not the macro64 assembler.
Maybe an out of the box alpha VMS is installing it like that ?
The only thing I can see on my system regarding macro was an installation of macro64 in vmsinstal.history.
So maybe this is necessary to invoke the macro32 compiler.

Meanwhile I will add the alpha object and exe files to my uaf.zip in sudirectory [.alpha]
just wait half an hour ...

[Thanassis Papadimitriou]

Thank you Joseph!!

I downloaded the compiled kit.. it works!!

One more thing and I believe we are done.

When I issue the following command (find all accounts that are disabled and have pwdmix flag set):

uafselect2 /select=flag=(DISUSER,PWDMIX) -
/display=(username,flags)/total

I ask to display the username and flags. I observed that all other flags are displayed except pwdmix even though it is set.

Please help!

[Joseph Huber_1]

Yep, I counted the number of bits wrong:
in display.c max_flags is 26 not 25.
Change this one number in display.c or
get the new obj/exe from my updated uaf.zip .

[Thanassis Papadimitriou]

I got the new obj/exe files, but still pwdmix flag is not displayed.

[Joseph Huber_1]

I have no alpha with a VMS version new enough to test, but on IA64 VMS 3.8 it works:

$ uaf/select=flags=pwdmix /display=(username,flags)
user: DEFAULT flags: DISUSER,PWDMIX
$ sh sys/noproc
OpenVMS V8.3-1H1 on node DECUSI 30-JAN-2009 13:11:22.66 Uptime 15 18:36:59


And I compiled and linked from the same source on Alpha 7.3-1.

Eventually just link uaf.exe again from the objects in [.alpha] subdirectory.

And You are sure not to use the old version of uaf.exe (see Your uaf symbol), and are testing on the 7.3-2, not on 7.3-1 ?

[Joseph Huber_1]

And even on my 7.3-1 system:

MPIW10_HUB> uaf/select=flags=pwdmix /display=(username,flags)
user: DEFAULT flags: DISUSER,PWDMIX
MPIW10_HUB>sh sys/noproc
OpenVMS V7.3-1 on node MPIW10 30-JAN-2009 13:29:23.30 Uptime 100 22:55:14


You either did noth update uaf.zip (web proxy cache not updated), or your uaf command symbol is pointing to an old version.
Does "AUTHORIZE SHOW user" show the flag ?

[Thanassis Papadimitriou]

Yes the authorize command displays the flag.

I observed that the files within uaf.zip at your site, when I download it they have a date of 27/1/2009 in ALPHA directory.

Is that correct?

Maybe I redownload the previous version of uaf.zip!

[Joseph Huber_1]

No, [.alpha]display.obj and uaf.exe has a date of today.
You definitely got the old version from cache.
I try to flush the cache of my web-server, retry to fetch uaf.zip again in a few minutes, but make sure You use the cache bypass feature of your browser.

[Joseph Huber_1]

If it is not possible to bypass cache/proxy, use anonymous FTP to wwwvms.mppmu.mpg.de

cd /pub/vmssig/archive/u
binary
get uaf.zip

[Thanassis Papadimitriou]

Hello,

I managed to download the latest version of uaf.zip. It works and displays pwdmix flag.

Thank you all for your effort.

Case is closed.

[Thanassis Papadimitriou]

Using uaf.zip I am able to query authorize by non-standard criteria as provided by itself in uaf. Hence, I am able now to display all disabled users with pwdmix set and so on.

Also, I have found a code in macro 32 which allows to force password complexity to user. I am able to specify the level of complexity between lower, upper, number and special characters. Very convenient.

Thank you.

[Jon Pinkley]

Joseph Huber, this link appears to be dead.

http://wwwvms.mppmu.mpg.de/vmssig/archive/u/uaf.zip

Have you considered sending your updates to Hunter?

Jon

[Craig A Berry]

I've updated UAF so it compiles without using /STANDARD=VAXC, no longer uses RTL routines and system services that were deprecated decades ago, and can handle newer privileges and flags (e.g., EXTAUTH).

Source code and binary kits are available from:

http://code.google.com/p/jmuaf/

[Joseph Huber_1]

Thanks Craig for doing the update.
Jon,
my fix in 2009 was just an adhoc fix to add the missing flags for the imminent needs, I did not fix the many other problems with old code.
My remaining 7.3-1 is anyway too old to reflect recent VMS state.
And my VMSSIG archive also is not updated since years.
I just kept and will keep the various /vmssig/src/ files on my current personal web pages.
See
http://wwwvms.mppmu.mpg.de/vmssig/
which is now redirected to
http://www.mpp.mpg.de/~huber/vmssig/

[Hoff]

Here's a different variation of the classic UAF tool, and has new knobs including /CLSVAL (for the DEFCLSVAL flag), /DISPPWDSYNCH, /EXTAUTH, /MIGRATEPWD, /PWDMIX and /VMSAUTH.

Code bits are here:

http://labs.hoffmanlabs.com/node/1205

This is descended from some code originally written by Frank Nagy.