| Previous | \Contents | ^Index |
H To set the time on an AlphaServer ES47, AlphaServer ES80 or AlphaServer G GS1280 series system, you must access the platform management utility. D In particular, this is how OpenVMS obtains its system time on these systems.
|
" ) MBM - (PMU, Platform Management Utility) ) From SRM P00> enter {Esc} {Esc} MBM 6 CTRL/[ CTRL/[ MBM (MBM must be uppercase) 2 MBM> connect (to exit to SRM) |
E The serial PMU is a command line interface for a serial communication G (MBM) port or to the telnet session. Commands entered on this line are G forwarded to the PMU server, and the serial PMU is responsible for the following tasks:
D Use an escape key sequence to enter the PMU. You can access the PMU D through a modem or from a terminal emulator connected to the server management LAN. w 4.6 UTC vs GMT vs vs UT1/UT1/UT2 TDF? What are these acronyms?
F The results of an international compromise---though some would say an C international attempt to increase confusion---UTC is refered to as F "Coordinated Universal Time" (though not as CUT) in English H and as "Temps Universel Coordinné" (though not as TUC) D in French. (No particular information exists to explain why UTC was A chosen over the equally nonsensical TCU, according to Ulysses T. = Clockmeister, one of the diplomats that helped establish the international compromise.)
D Universal Time UT0 is solar time, UT1 is solar time corrected for a C wobble in the Earth's orbit, and UT2 is UT1 corrected for seasonal A rotational variations in rotation due to the Earth's solar orbit.
H GMT---Greenwich Mean Time---is UT1. GMT is the time at the classic site @ of the since-disbanded Royal Greenwich Observatory; at the most 6 widely-known tourist attraction of Greenwich, England.
F UTC is based on an average across multiple atomic clocks, and is kept A within 0.9 seconds of GMT, through the insertion (or removal) of A seconds. In other words, UTC matches GMT plus or minus up to 0.9 seconds, but UTC is not GMT.
F TDF is the Timezone Differential Factor, the interval of time between C the local time and UTC. Areas that celebrate daylight savings time G (DST) will see periodic changes to the TDF value, when the switch-over H between daylight savings time and standard time occurs. The switch-over E itself is entirely left to local governmental folks, and can and has H varied by political entity and politics, and the switch-over has varied ) over the years even at the same location.
F If your local OpenVMS system time is off by one hour (or whatever the E local DST change) for some or all applications, you probably need to @ reset your local TDF. (For related details, please see sections k Section 4.3 and Section 10.22.1.)
B Further discussions of history and politics, the Royal Observers' E outbuildings, and the compromise that left the English with the Time C Standard (the Prime Meridian) and the French with the standards for H Distance and Weight (the Metric System) are left to other sources. Some 2 of these other sources include the following URLs:
C The term "install" has two distinct meanings in OpenVMS. The first A relates to "installing a product", which is done with either the F SYS$UPDATE:VMSINSTAL.COM command procedure or the POLYCENTER Software B Installation (PCSI) utility (PRODUCT command). The second meaning E relates to the use of the INSTALL utility, which is what concerns us here.
F The INSTALL utility is used to identify to OpenVMS a specific copy of H an image, either executable or shareable, which is to be given some set E of enhanced properties. For example, when you issue the SET PASSWORD D command, the image SYS$SYSTEM:SETP0.EXE is run. That image needs to 1 have elevated privileges to perform its function.
D The other important attribute is /SHARED. This means that shareable G parts of the image (typically read-only code and data) are loaded into H memory only once and are shared among all users on a system. Executable E images can be installed /SHARED as well as shareable library images. G (The term "shareable" has dual meanings here, too. See the OpenVMS 6 Programming Concepts Manual for further details.)
D It's important to note that there is no such thing as "installing a F shareable image with privileges". The INSTALL utility will let you do G it, but the privileges you specify will be ignored. To have a callable C routine run with enhanced privileges that are not available to its A caller, you must construct your routines as "user-written system G services" and install the shareable image with the /PROTECT qualifier. > See the OpenVMS Programming Concepts Manual for more D information on user-written system services. Note also that in many H cases the need to grant privileges to an image can be replaced with the ? use of the "Protected Subsystems" feature that grants a rights < identifier to an image. See the OpenVMS Guide to System 6 Security for information on Protected Subsystems. c 5.2 Are there any known viruses for OpenVMS?
? Viruses and worms are common on personal computers because the F operating systems involved, such as the Microsoft MS-DOS, Windows 95, D Windows 98 and Windows ME variants, do not particularly protect the H operating system or the file system against hostile action by programs. ? Microsoft Windows NT, Windows 2000 and Windows XP do implement @ protections for specific configurations and do implement memory E protection models, but many users of these systems choose to operate E with full adminstrator access and thus the available protections are F entirely defeated and entirely not relevent, and any program that can G activate itself or can cause the user to activate the code can subvert D the operating system and take over the hardware, at which point the G malicious code can do most anything it wishes, including hiding copies B of itself in other programs or in the file system, redistributing H itself via mail, IM, or network connections, or can be used as a zombie $ in staging attacks on other systems.
C This is less likely with multi-user systems such as OpenVMS, Unix, ? Linux, MVS and other platforms for various reasons. First, the G operating system runs in a privileged mode in memory that is protected H against modification by normal user programs. Any program cannot simply G take over the hardware as it can on operating systems without security G and particularly without memory page protections. Secondly, multi-user D systems can be set up so that non-privileged programs cannot modify ? system programs and files on disk, and this is normal for most F installations. Both of these protection schemes mean that traditional G viral infections don't work on these OSes. Third, typical applications A and configurations tend to prevent the uncontrolled execution of G untrusted code as part of received mail messages or web access; one of G the central vulnerabilities of the Microsoft Windows platform involves B its intentionally easy ability to dynamically (and transparently) D activate code and macros that are embedded within mail messages and within data files.
B It is possible for OpenVMS and other multi-user systems to become G infected by viruses or worms, but to do so, the program containing the H virus must be run from a user account that has amplified privileges. So > long as the system administrator is careful that only trusted C applications are run from such accounts (and this is generally the H case) and so long as there are no OpenVMS system security breaches (due A to malicious operator activity, OpenVMS errors, or errors within F trusted and privileged product packages) there is no of modifications G to the operating system or other protected files from the virus or the worm.
F The FAQ maintainer is aware of a few (and very old) DECnet worms that E have affected OpenVMS systems on DECnet networks, but is aware of no , OpenVMS viruses that are loose in the field.
H To protect against viruses and other attempts at system interference or F misuse, please follow the security recommendations in the OpenVMS H Guide to System Security. Additionally, you will want to keep your G OpenVMS ECOs current and you will want to apply all mandatory ECO kits and any security MUPs H for OpenVMS and OpenVMS products, and you will want to keep to OpenVMS C releases with Prior Version Support (PVS) or with Current Version : Support. (This is obviously a general system maintenance = recommendation, in addition to being a good system security I recommendation---new security features and capabilities are implemented F in more recent OpenVMS releases, for instance.) You may also want to G consider optional software products which can monitor your system for : intrusion or infection attempts. Computer Associates (CA) : offers various products in this area, as to other vendors.
H Rocksoft offers the Veracity data integrity tool (for info, send mail to demo@rocksoft.com). MD5 tools are also available.
H Tools to scan OpenVMS file systems for Microsoft Windows infections are ; also available, including a commercial package from Sophos. G These scanning tools are particularly useful for systems running Samba G or Advanced Server (PATHWORKS), as these servers tend to have a higher F population of files intended for Microsoft Windows systems users, and G as common virus and worm attacks can find and infect files on the file ' shares that these products can provide. B These infections do not target OpenVMS itself, though the OpenVMS G server (and any other platform and any other server capable of storing E files for Windows systems) can silently host files containing common Microsoft Windows infections. j 5.3 Sources of OpenVMS security information?
7 Where can I get information on OpenVMS system security?
5 ISO-9660 support was added in the following releases:
H An add-on ISO-9660 kit was also available for OpenVMS VAX V5.5, V5.5-1, F V5.5-2, and V5.5-2H4. This requires the installation of the F11CD kit H from the InfoServer CD, from the Consolidated Distribution CD under the E InfoServer area, Customer Support Center kit CSCPAT #1071012, or the C F11CD ECO kit. (Upgrades to V6 and later are strongly recommended.)
B By default, OpenVMS senses the specific type of media. If you are D working with dual-format media---media that uses both the ODS-2 and G ISO-9660 formats on the same CD-ROM---then MOUNT will first detect and C then default to the ODS-2 format. If you wish to override this and ; explicitly mount the media using ISO-9660, use the command:
|
" : $ MOUNT/MEDIA_FORMAT=CDROM device-name[:] [volume-label] |
F In most circumstances, you will not need nor will you want to include B an explicit /MEDIA_FORMAT specification. For further information, H please refer to the OpenVMS MOUNT Utility Manual. Particularly note the E information on the MOUNT /MEDIA_FORMAT and /UNDEFINED_FAT qualifiers.
C The MOUNT /UNDEFINED_FAT qualifier is of interest because ISO-9660 G media can be mastered on a wide variety of operating system platforms, H and these platforms do not necessarily support the semantics needed for F files containing predefined record formats. The /UNDEFINED_FAT allows F you to specify the default attributes for files accessed from volumes using the ISO-9660 format.
+ An example which works for most CD-ROMs is:
|
" D $ MOUNT/MEDIA_FORMAT=CDROM/UNDEFINED_FAT=STREAM:2048 DUA0: FREEWARE |
F This particular MOUNT command forces access to the CD-ROM media using G the ISO-9660 volume structure, and the use of the MOUNT /UNDEFINED_FAT F qualifier causes any file whose file attributes are "undefined" to be D returned with "stream" attributes with a maximum record length 2048.
E On OpenVMS, the ISO-9660 format is (internally) considered to be the G ODS-3 file structure, while the High Sierra extensions to the standard > are considered to be the ODS-4 file structure. The Rock Ridge 2 extensions are not currently available on OpenVMS.
F For details on ODS-1 and ODS-2 file specifications, see Kirby McCoy's G VMS File System Internals Manual (published by Digital Press, ' but potentially out of print), and see:
@ A growing number of OpenVMS products are being provided in PCSI F (POLYCENTER Software Installation) kits which are installed using the F PRODUCT INSTALL command. These are alternatives to or replacement for D VMSINSTAL kits which were BACKUP savesets. PCSI kits are not BACKUP < savesets and are structured differently from VMSINSTAL kits.
? If you want to extract product files from a PCSI kit, create a F directory into which the kit should be expanded and use the following command:
|
" 5 $ PRODUCT COPY prodname /SOURCE=[where-the-kit-is] - 4 /DEST=[destination-directory] /FORMAT=REFERENCE |
? A PCSI kit file has a file specification of the following form:
|
" $ DEC-VAXVMS-FORTRAN-V0603-141-1.PCSI |
G In this example, "FORTRAN" is the "prodname". PCSI will expand the kit H files into the directory you specify and subdirectories beneath such as G [SYSEXE], [SYSLIB], etc., reflecting the eventual destination of files H found there. Most of the actual product files (images, etc.) will be in G the subdirectories. In the top-level directory will be a file with the E file type PCSI$DESCRIPTION that specifies where various files should C go. For more details, see the POLYCENTER Software Installation F Developer's Guide for OpenVMS, which can be found in the OpenVMS > documentation on the Consolidated Online Documentation CD-ROM. e 5.6 Emergency (Conversational) System Startup?
B If you need to perform system management operations on an OpenVMS H system and cannot access the system through normal means---the password G on the SYSTEM username was forgetten and no other privileged usernames D are available, or one or more core system product authorization key C (PAK) software licenses are unavailable or expired---then you must / perform a conversational (emergency) bootstrap.
Here are the steps:
|
" B/R5:1 B/1 @GENBOO |
|
" b -flags 0,1 |
|
" B/E0000001 B/R5:E0000001 4 @<console media procedure name varies widely> |
|
" b -flags e,1 |
|
" SET/STARTUP OPA0: SET WINDOW_SYSTEM 0 SET WRITESYSPARAMS 0 CONTINUE |
|
" $ SPAWN $ @SYS$SYSTEM:STARTUP |
B Some system managers will suggest a method using the UAFALTERNATE A system parameter rather than the SET/STARTUP OPA0: command shown. G This approach is not always available and is accordingly less commonly D recommended, as there can easily be an alternate user authorization E database (SYS$SYSTEM:SYSUAFALT.DAT) configured on the system. With a H system manager that has configured an alternate SYSUAFALT.DAT file, the C UAFALTERNATE method will fail---well, assuming you do not know the B password of a privileged username stored within SYSUAFALT.DAT, of course.
G The UAFALTERNATE system parameter is used to trigger what is sometimes known as the console backdoor. E The OPA0: system console is critical to system operations and system E security, and will allow access when the SYSUAF system authorization E database is unavailable or corrupted, when core product license PAKs ; are not registered, expired or disabled (NOLICENSE errors), . or in various other cases of system failures. E All this is in addition to the role of the console in the display of H certain system-critical event messages. Access to the OPA0: console C has a security exposure that is equivalent to direct access to the system hardware.
B When LOGINOUT detects an error (such as a SYSUAF corruption, by a E missing SYSUAF, missing product licenses, or other trigger), it will C prevent access to the OpenVMS system from all terminals except the system console. C The OPA0: system console will be allowed access, and the resulting D process will be fully privileged. Resetting the UAFALTERNATE system G parameter---in the absence of an alternate SYSUAF system authorization G database---will cause the console backdoor to be opened simply because LOGINOUT cannot locate D SYS$SYSTEM:SYSUAFALT.DAT. When the authorization database cannot be 6 located, access will be granted from the console only.
F For further information on emergency startup and shutdown, as well as C for the official OpenVMS documentation on how to change the SYSTEM F password from the console in an emergency, please see the OpenVMS > System Manager's Manual in the OpenVMS documentation set.
A For information and recommendations on setting up OpenVMS system 6 security, please see the NCSC Class C2 appendix of the = Guide to OpenVMS System Security manual, also in the OpenVMS documentation set.
F You can also use the conversational bootstrap technique shown earlier E (the steps until SET/STARTUP) to alter various system parameters, as well. At the SYSBOOT , prompt, you can enter new parameters values:
|
" SHOW MAXPROCESSCNT SET . 64 CONTINUE |
E The "." is a shorthand notation used for the last parameter examined within SYSGEN and SYSBOOT.
| Previous | YNext | \Contents | ^Index |