Thomas,
Modifying or restricting access to RTPAD will not achieve the result. A user could easily bring over their own copy of RTPAD (although RTPAD appears to be installed with the TMPMBX privilege).
While I do not have the time to try it at the moment, relying on access control or removing the command from the default DCL tables is not much of a prevention. A user could just obtain a copy of the image elsewhere and use it instead of the standard RTPAD. This would likely remain undetected (except for the remote login at the destination).
The modifications to SYLOGIN are more useful, you can prevent the access by checking the name of the device and the originating node using the F$GETDVI lexical function.
You could also block incomming connections by removing the listener that RTPAD connects with, but that would have the effect of preventing ALL use of RTPAD, which can be operationally a problem.
On several occasions, I have limited RTPAD (and TELNET) access by creating and granting an identifier specific to that purpose, and checking it in either SYLOGIN, or in a GROUP login that is automatically (and unavoidably) invoked by SYLOGIN.
- Bob Gezelter,
http://www.rlgsc.com
