| Previous | \Contents | ^Index |
E There is no such command integrated within OpenVMS, though there are H (optional) timers available within certain terminal servers and similar H devices, and there is an integrated time-of-day mechanism that provides , control over when a user can access OpenVMS.
C As for available tools, there are DECUS, freeware, and third-party C tools known variously as "idle process killers" (IPK) or G "terminal timeout" programs, as well as various other names. 9 Examples include: Saiga Systems Hitman, Watchdog, MadGoat D Watcher (via the MadGoat site or the OpenVMS Freeware), Kblock, the C Networking Dynamics tool known as Assassin, and the Zap tool. Also @ available is the XLNperformance system management utility, from XLNsystems.
9 A related package (for DECwindows sessions) is xtermlock.
H If the forgetful users are in an application menu environment, the menu 7 can potentially be extended to provide this capability. p 5.24 Do I need a PAK for the DECevent (HP Analyze) tool?
A DECevent and HP (Compaq) Analyze are available to customers with G support contracts. The PAK is required only for the advanced functions F of DECevent, the basic bits-to-text translation of the error log does G not require a license PAK. Ignore the prompt, in other words. (The PAK F should be available to you if you have a hardware support contract or F warrantee, and the PAK enables the use of the advanced error analysis / and notification capabilities within DECevent.)
; Please see the following website for details and downloads: Analyze)
kC A change was made (back in 1988) to (as it was then known) VAX/VMS D V5.1-1 that added support for the then-new ANSI X3.27-1987 magnetic E tape label standard. Prior to the ANSI X3.27-1987 standard, the date F field in the ANSI HDR1 record permits dates only as far as the end of H Year 1999. With ANSI X3.27-1987, dates through Year 1999 and dates from ! Years 2000 to 2099 are permitted.
B Versions of INIT.EXE and MTAACP.EXE from VAX/VMS releases prior to H V5.1-1 will potentially have problems properly processing ANSI magnetic tapes when Y2K F and later dates are involved---the DCL INITIALIZE command is known to + encounter access violation (ACCVIO) errors.
D The available solutions include upgrades, or setting the date back. E Direct initialization of the tape with the new headers (via $qio) is G also clearly possible, though the limitation within the old MTAACP.EXE 2 magtape ACP image is not nearly so easy to bypass. d 5.26 How do I recover from INSVIRMEM errors?
= Prior to OpenVMS Alpha V7.0 and on all OpenVMS VAX releases, G VIRTUALPAGECNT and PGFLQUOTA limit the amount of virtual address space " that is available to each process.
C Further limiting the amount of address space is the size of system H space (S0 and S1 space). On OpenVMS Alpha versions prior to V7.0 and on D all OpenVMS VAX releases, VIRTUALPAGECNT and MAXPROCESSCNT together G determine the size of the page table data structures that occupy large @ tracts of system space. When no system virtual address space is G available for the stuff that needs it---this includes the page tables, B non-paged pool, and various other structures---then the values of 5 VIRTUALPAGECNT and MAXPROCESSCNT cannot be increased.
E In OpenVMS Alpha V7.0 and later, the page table data structures have H been moved out of S0 and S1 space and into page table space. In OpenVMS G Alpha V7.2 and later, certain large data structures found in non-paged B pool (eg: lock management structures) have been moved into 64-bit E space, thus freeing up room in non-paged pool and in S0 and S1 space F (where non-paged pool resides) while also permitting much larger data structures. ~ 5.27 How can I prevent a serial terminal line from initiating a login?
( In SYSTARTUP_VMS.COM, issue the command:
|
" + $ SET TERMINAL/NOTYPEAHEAD/PERMANENT ddcu: |
D This will prevent any unsolicited terminal input on ddcu:, and this G unsolicited input is what triggers JOB_CONTROL to start up LOGINOUT on F the terminal. Once LOGINOUT starts up on the serial line, you can see G interesting behaviour (eg: audits, process creations, etc) as LOGINOUT F tries to "chat" with whatever device is hooked onto the remote end of the serial terminal line. k 5.28 How does PCSI use the image BUILD_IDENT field?
F The (undocumented) build ident field in an OpenVMS Alpha image header E is 16 bytes long, and is used as a counted string of 0-15 characters G (ie, as an .ASCIC string, a string with the character count in byte 0) @ and was originally introduced to provide information for use by F VMSINSTAL patch kits to determine whether an image should be replaced or not.
F Starting with OpenVMS Alpha V7.1-2, OpenVMS Engineering uses the PCSI C utility to package and install ECO kits for OpenVMS. PCSI uses the H generation attribute (a 32-bit unsigned integer) specified for files in B the product description file (PDF) of a PCSI kit as the basis for E performing file conflict detection and resolution. When a product is F installed, PCSI modifies the build ident field of Alpha image headers H to store an encoded form of the generation number. It also looks at the ? build ident field of previously installed images to obtain the E generation information for those files as input to the file conflict ? processing algorithm. (Only images have this field, obviously.)
F PCSI interprets the build ident field of a previously installed image as follows:
D So, what will you see in the image identification displayed via the ANALYZE/IMAGE command?
C For an image that has been built as part of an OpenVMS Engineering E system build, you will generally see a build ID string in the format H "X6TE-SSB-0000"---X6TE is the build number for the OpenVMS Alpha V7.2-1 E release. This id format is used within the OpenVMS system build, and D can generally only be seen associated with images that have not yet been processed via PCSI.
H During the installation of V7.2-1, PCSI will modify the image header to G have a build ident string of "X6TE-0050120000". During installation of G an ECO kit containing this image with a generation number of 50130052, @ for example, PCSI would determine that 50130052 is greater than F 50120000, and will replace the existing image on the target disk with 1 the version of the image included in the ECO kit. u 5.29 How can I tell what software (and version) is installed?
A There is unfortunately no consistent nor single way to make this ? determination---this is one of the reasons that a move to PCSI installations is underway.
A On OpenVMS Alpha, you can use VMSINSTAL.HISTORY and PRODUCT SHOW ? PRODUCT to determine what packages have been installed via the ' VMSINSTAL and PCSI tools, respectively.
? To see which OpenVMS Alpha ECO kits have been applied, look in D VMSINSTAL.HISTORY on OpenVMS Alpha prior to V7.1-2, and use PRODUCT 4 SHOW PRODUCT/FULL on OpenVMS Alpha V7.1-2 and later.
H On OpenVMS VAX, you can use PRODUCT SHOW PRODUCT and (for software that C is installed via VMSINSTAL on V7.3 and later) in VMSINSTAL.HISTORY.
E For products installed on OpenVMS VAX prior to V7.3 using VMSINSTAL, > there is no reliable way to determine what products have been F installed. If the product provides a RELEASE_NOTES file (as many do), 7 you can look for the list of these files via DIRECTORY E SYS$HELP:*.RELEASE_NOTES. Again, this approach is NOT reliable: some E kits do not provide release notes, some system managers will install H only the release notes, some system managers will delete release notes, 7 and release notes for multiple versions can be present.
D On most packages, you can generally use ANALYZE/IMAGE on one of the C core images, looking at the image identification area. Some of the * product-specific mechanisms available are:
G The undocumented DCL command CHECKSUM is the usual means, and provides > a rather simple-minded checksum suitable to detect basic file H corruptions. For information and an OpenVMS version of the MD5 checksum tool, see:
A The OpenVMS Alpha ECO (patch) kit checksums available at the ECO @ website are determined using the following DCL command sequence:
|
" # $ CHECKSUM kitname.pcsi-dcx_axpexe $ SHOW SYMBOL CHECKSUM$CHECKSUM |
l See Section 5.17 for information on acquiring OpenVMS ECO (patch) kits. p 5.31 What (and where) is the OpenVMS Management Station?
D For information and current kits for the OpenVMS Management Station E (OMS), a PC-based tool that permits you to manage an OpenVMS system, please see:
oA The HP OpenVMS Disk File Optimizer (DFO) defragmentation package < provides a fragmentation monitoring tool, and a DFO product H authorization key (PAK) is not required for the fragmentation reporting tool:
|
" $ DEFRAG SHOW/VOLUME ddcu: |
H The DFU tool available on the OpenVMS Freeware can generate a report on the disk fragmentation:
|
" DFU> REPORT ddcu: |
? A message at the OpenVMS Alpha bootstrap such as the following:
|
" B %SYSBOOT-I-FILENOTLOC, Unable to locate SYS$CPU_ROUTINES_1C02.EXE = %SYSBOOT-E-LDFAIL, failed to load execlet, status = 00000910 |
E indicates that the particular OpenVMS Alpha release does not contain @ support for the target platform. In this case, OpenVMS does not E recognize Alpha family 1C member 02 as a supported platform. A later D version of OpenVMS might support the platform, or there might be no H support on any release. Ensure that you have the most current firmware, = and review the minimum version requirements for the platform.
G The execlet load failure and other similar bootstrap status values can : often be decoded using either of the following techniques:
|
" $ exit %x910 # %SYSTEM-W-NOSUCHFILE, no such file $ $ x = f$message(%x910) $ show symbol x + X = "%SYSTEM-W-NOSUCHFILE, no such file" $ |
A Also see Section 14.4.4.1. { 5.34 How can I customize the DCPS device control for a new printer?
H To customize DCPS for an otherwise unsupported printer, you can try the following sequence:
|
" LPS$$UNRECOGNIZED_* |
|
" $ LIBRARY/TEXT/CREATE - ) SYS$COMMON:[SYSLIB]HP4050_DEVCTL.TLB LPS$$UNRECOGNIZED* |
|
" - $ DEFINE/SYSTEM/EXECUTIVE DCPS_HP4050_LIB - % SYS$LIBRARY:HP4050_DEVCTL.TLB, - SYS$LIBRARY:DCPS$DEVCTL.TLB |
|
" 6 SYS$LIBRARY:DCPS$FILE_EXTENSION_DATA_TYPE.DAT_DEFAULT |
! to create your own site-specific:
|
" . SYS$LIBRARY:DCPS$FILE_EXTENSION_DATA_TYPE.DAT |
; Also see Section 5.15. y 5.35 Why do $GETDEV MOUNTCNT and SHOW DEVICE mount counts differ?
F MOUNTCNT returns the local mount count, while SHOW DEVICE returns the cluster-wide mount count. m 5.36 What software is needed for Postscript printers?
H The NorthLake PrintKit (www.nls.com) and DECprint Supervisor (DCPS) are = common choices for support of Postscript printers on OpenVMS.
? You may also require the installation of an IP transport stack.
{ Also please see Section 15.2.2 and Section 15.2.3. n 5.37 How do I remove a PCSI-installed patch (ECO) kit?
1 You cannot PRODUCT REMOVE a PCSI patch (ECO) kit.
E In order to remove an ECO kit, PCSI would have to have copies of all H the other version of the files from all other patches and products that F previously were installed. This can clearly involve a large number of A files and a large archive of old file versions and a substantial ? quantity of disk space. While removal is clearly theoretically * possible, it is not currently implemented.
D The following is the supported mechanism to remove a PCSI patch kit.
8 The above information also applies to PCSI PARTIAL kits. u 5.38 SYSINIT-E, error mounting system device, status=0072832C
< This message can arise during an OpenVMS system bootstrap...
|
" D %MOUNT-F-DIFVOLMNT, different volume already mounted on this device |
9 For details and further information, use the DCL command:
|
" $ HELP/MESSAGE /STATUS=%X72832C |
H The PAK release date, the PAK termination date, and the PAK version are H the usual culprits when a license product authorization key (PAK) check failure occurs.
F The PAK termination date is the date when the license PAK will expire.
H The PAK release date is the date of the most recent release date of the G software package that will be permitted by the particular license PAK. F (The release date check is analogous to a product version check.) The H PAK version indicates the most recent product version that is permitted by the license.
D Having multiple license PAKs registered (and active) can also cause A problems if an expired PAK gets loaded. You will want to DISABLE , license PAKs you do not wish to have loaded.
E Other problems include a failure to register each PAK in all license G databases throughout a multiple-system-disk cluster, with a consistent C set of /INCLUDE lists specified across each of the duplicated PAKs.
A Additionally, you could have an invalid LMF$LICENSE logical name B defined. (If no LMF$LICENSE logical name is defined, the standard @ license database named SYS$SYSTEM:LMF$LICENSE.LDB will be used.)
H You can display license failures by defining the following logical name:
|
" 1 $ DEFINE/SYS/EXEC LMF$DISPLAY_OPCOM_MESSAGE TRUE |
C Enable your terminal as a license operator (REPLY/ENABLE=LICENSE), D define the LMF$DISPLAY_OPCOM_MESSAGE logical name, and then try the C failing operation again. You should see one or more OPCOM messages displayed.
H If you have the LMF$DISPLAY_OPCOM_MESSAGE logical name defined, you can D (will?) see spurious license check failures---various products will D check for multiple licenses, and a few products will check for PAKs E that either have not yet been or will not be issued. Once you figure E out which license has failed, you will want to deassign this logical name.
D That there are no license check failures does not indicate C that the particular product or operation or use is permissible per ? applicable licensing agreements. Please consult the applicable H agreement(s) for licensing-related information and requirements. |
H To register a license PAK on a DECwindows system when DECwindows cannot B start (because of an expired license or other licensing problem), k follow the steps outlined in section Section 5.6 up through the use of B the AUTHORIZE command. In place of the AUTHORIZE command, use the e console to register the license PAKs. Also see Section 12.5 for * licensing and troubleshooting information.
A For information on licensing and on the numbers of license units F required for various products and various platforms, the License Unit * Requirements Table (LURT) is available at:
aH Fool your friends, baffle your enemies, run the OpenVMS version of your choice!
On OpenVMS Alpha systems:
|
" # $ SET DEFAULT SYS$COMMON:[SYS$LDR] $ RUN SYSVER REPLACE V9.9 WRITE $ EXIT |
On OpenVMS VAX systems:
|
" # $ set default SYS$COMMON:[SYS$LDR] & $ copy SYS.EXE SYS.EXE_IN-CASE-I-FAIL $ patch SYS.EXE define sys$gq_version=800044b8 set mode ascii !examine sys$gq_version !examine sys$gq_version+4 " deposit sys$gq_version = "V9.9" " deposit sys$gq_version+4 = " " update exit $ Exit |
' Then reboot the system at your leisure. r 5.41 How to prevent users from choosing obvious passwords?
G To prevent users from selecting obvious passwords on OpenVMS, you will B want to use the reserved password (password screening) mechanism. @ Effectively, you merge your list of reserved passwords into the F existing reserved words database maintained by OpenVMS. (You can also F then require all users to reset their passwords---via the pre-expired F password mechanism---thus forcing users to select new passwords.) For F details on the password screening mechanism, of the reserved password E database (VMS$PASSWORD_DICTIONARY.DATA), and details of how to merge D your list of prohibited passwords into the database, please see the F associated chapter in the OpenVMS security manual. For details of the C password expiration mechanism, see the AUTHORIZE command qualifier /PWDEXPIRED.
@ You can also implement a site-specific password filter with the E information provided in the back of the OpenVMS Programming Concepts D manual. The password filter permits you to establish particular and H site-specific password requirements. For details, please see the system parameter LOAD_PWD_POLICY = and the programming concepts manual, and see the examples in E SYS$EXAMPLES:. (Examples and documentation on V7.3 and later reflect C both platforms, the examples are found only on OpenVMS VAX kits on D earlier releases. The capabilities have existed on both the VAX and # Alpha platforms for some time now.)
C To verify current passwords, you can also use a technique known to F system crackers as the "dictionary attack"---the mechanism that makes E this attack somewhat more difficult on OpenVMS is the hashing scheme > used on OpenVMS, and the file protections used for the SYSUAF H authorization database. Given a dictionary of words and the unprotected C contents of the SYSUAF file, a search for obvious passwords can be = performed. Interestingly, a "dictionary attack" also has the E unfortunate side-effect of exposing the password to the user---while H this is clearly the goal of a system cracker, authorized privileged and C non-privileged system users should not know nor have access to the % (cleartext) passwords of other users.
E Accordingly, OpenVMS does not store the cleartest password. Further, H OpenVMS uses a password hashing algorithm, not an encryption algorithm. H This means that storage of a cleartext password is deliberated avoided, F and the cleartext value is deliberately very difficult to obtain. The B hash is based on a Purdy Polynomial, and the hash itself includes G user-specific values in addition to the password, values that make the 1 results of the password hash unique to each user.
F Regardless of the use of a password hashing scheme, if a copy of your D password file should become available to a system cracker, you will 9 want to force all users to use new passwords immediately.
E If you should require a user to verify a password, use the username, C the user's salt value (this value is acquired via $getuai) and the F user's specified cleartext password, and compare the resulting hashed @ value (using a call to $hash_password) against the saved hashed F password value (this value also acquired via $getqui). For reasons of E security, avoid saving a cleartext password value in any data files, A and do not maintain the cleartext password in memory longer than ; required. (Use of $ACM on V7.3-1 and later is recommended.)
D Kerberos authentication (client and server) is available on OpenVMS H V7.3 and later. Integration of Kerberos support into various Compaq and & into third-party products is expected.
G External authentication is available in V7.3-1 and later, with support = for user-written external authentication in V7.3-2 and later.
D If you are simply looking for OpenVMS access and the SYSTEM and all C other privileged passwords are forgotten or otherwise unavailable, h please see section Section 5.6 and/or the OpenVMS documentation set.
A Also please see the C2 guidelines in the OpenVMS security manual.
| Previous | YNext | \Contents | ^Index |