VMS system management Gui

[KENDALL MCCARTHY_1]

There is a request here to install a GUI so that "NON-VMS" data security folks can perform some system management functions . Is ther such a utility out there and if yes , how current is it?

[Dean McGorrill]

' "NON-VMS" data security folks can perform some system management functions '

take care here, theres many things that can
be broken. There used to be a product (and
may still be) called INSPECT that we were
demanded to use back at what is now HP. It
did a pretty good job. But it broke things
to! decnet objects, notes as I recall.

It might be better for the "NON-VMS" types to have a trained system manager carefully and selectively enforce their security ideas. Dean

[Robert Gezelter]

Kendall,

I may be out of date, but there is the OpenVMS Management Station.

The important question is: Which system management functions?

Enabling/Disabling accounts: No problem.
Granting/Revoking Identifiers on User Accounts: No problem.

I have delegated the simple tasks many times.

Many other tasks can have far-ranging implications, I recommend caution. I did do a seminar at HP World 2004 on how to delegate system management responsibilities and limit the number of privileged users, which may be useful background (see http://www.rlgsc.com/hpworld/2004/N227.html for the abstracted session notes).

- Bob Gezelter, http://www.rlgsc.com

[Volker Halle · Accepted solution]

Kendall,

there is a piece of software called OpenVMS Management Station, which allows you to do some Account, Printer and Storage Managment using a GUI running on a Windows system.

This software is part of OpenVMS. It's also called TNT.

http://h71000.www7.hp.com/DOC/732FINAL/DOCUMENTATION/PDF/managestationv32b.PDF

Volker.

[Ian Miller.]

If they want to look at usernames etc with a point and grunt interface then OpenVMS management station

http://h71000.www7.hp.com/openvms/products/argus/index.html

May do enough.

[KENDALL MCCARTHY_1]

Before I get too many responses in this vein... This is not my decision to make. The stuff to be managed is user related security and password / rights stuff. believe me , I am quite aware how disruptive this path can be , but I just turn the wrenches.

Has anyone used inspect? Is that the "blessed" VMS tool?

[Dean McGorrill]

Kendall,
I just went to the lab and checked a 2003 distribution list, and don't see it. but it may have been bundled with polycenter stuff or renamed.

So you turn the wrenchs, well thats
good. user/pwd stuff is simple. you can
adjust expirations dates, force generated
passwords. My sympathy is with you, I have
been there.. Dean

[Robert Gezelter]

Kendall,

As Volker pointed out, the Management station can do this.

The challenge is restricting changes to USER accounts.

Then again, the answer to the challenge may be handled on an administrative level. If a change brings down something vital, who is responsible/accountable for the problem. Having participated in audits of tightly regulated entities for security concerns, establishing accountability is the bedrock of security responsibility.

- Bob Gezelter, http://www.rlgsc.com

[KENDALL MCCARTHY_1]

Actually Im a DBA that is coding,Analyzing , DBAing, system/network manageing (badly) ,sweeping and getting coffee. Quite frankly , handing off the user management stuff is a blessing! I just it hope it dosent cause me headaches down the road. Sound like Management Station will do the trick.

[Jan van den Ende]

Kendall,

>>>
The stuff to be managed is user related security and password / rights stuff.
<<<

The way _WE_ do that (and that may or may not suit your site) is to have Captive account for our "authorisations service guys"
The run simple DCL scripts that do all kinds of validations (and the kind of logging we like) and if validations are passed, then a dedicated INSTALLed image is run, which checks correct startup, and then LIB$SPAWNS a .COM file (using its exec mode logical name). The .COM file enables SYSPRV, gets all input for AUTHORIZE from the master pid symbols that were set up after validation.

We are (for a long time already) considering Protected Subsystem for this (and various other such) images, but we never yet got to that. Which does not mean it could not be done if security wishes should reach that level.
The whole point is, to have pne image per functionality. (making more is simplicity itself: define the LNM for the command file to be spawned, and that one word is all you change to the source(.

And the (should be very few) cases that do not pass validation but are needed nevertheless, should and are being done by trained system managers.

Works very well for us; your milaage may vary.

hth

Proost.

Have one on me.

jpe