Network Security Considerations

If both a Table of Contents and Search form are not displayed in separate frames along with this one, you may wish to redisplay this book in a frameset, beginning with the first page.

HP OpenVMS Guide to System Security

Security for the User

Using the System Responsibly

Guidelines for Protecting Your Password

Auditing Access to Your Account and Files

Network SecurityConsiderations

This section describes how to use access control strings infile specifications and how to use proxy logins to help make networkaccess more secure.

Protecting Informationin Access Control Strings

Network access control strings can be included in the filespecifications of DCL commands working across the DECnet for OpenVMSnetwork. They permit a user on a local node to access a file ona remote node.

An access control string consists ofthe user name for the remote account and the user's password enclosed withinquotation marks, as follows: NODE"username password"::disk:[directory]file.typ

Because access control strings include sufficient informationto allow someone to break in to the remote account, they createserious security exposure. To protect access control string information,do the following:

Avoidrevealing the information on either hardcopy or video terminals.If you use a hardcopy terminal, dispose of the output properly.If you use a video terminal, clear the screen, and empty the recallbuffer with the DCL command RECALL/ERASE when the network job iscompleted. This prevents another user from seeing the password,either by displaying the command line with the Ctrl/B key sequenceor with the DCL command RECALL/ALL. DECwindowsusers can clear the screen with the Clear Lines Off Top option fromthe Commands menu. Otherwise, a DECwindows user could use the scrollbar to view previously entered text.

Do not place networking commands that include accesscontrol strings in command procedures where they would be likelytargets for discovery.

If you must put access control strings in your commandprocedures, provide these files with optimum file protection byusing the techniques described in Protecting Data.

The use of access control strings in not permittedin an evaluated configuration. Please see your system administratorto determine if your system is running in an evaluated configuration.

To avoid the need for access control strings, you might preferto use proxy login accounts, which are described in Using Proxy Login Accounts to Protect Passwords.

Using Proxy Login Accounts to Protect Passwords

Proxy logins let you access files acrossa network without specifying a user name or password in an access controlstring. Thus, proxy logins have the following security benefits:

Passwords are not echoed on the terminalwhere the request originates.

Passwords are not passed between systems where theymight be intercepted in unencrypted form.

Passwords are not needed in command files to performthe remote access steps.

Before you can initiate a proxy login, the system or securityadministrator at the remote node must create a proxy account foryou. Proxy accounts, like regular accounts, are created with theAuthorize utility (AUTHORIZE). They are usually nonprivileged accounts.Security administrators can allow you access to one default proxyaccount and up to 15 other proxy accounts. Whileproxy logins require more setup effort on the part of system managers,they provide more secure network access and eliminate the need forusers to enter access control strings.

The following examples illustrate the differences betweena normal network login request and a proxy login request. For eachexample, the following conditions exist:

The user KMAHOGANY has two user accounts:

KMAHOGANY has logged in to node BIRCH.

KMAHOGANY wants to copy the file BIONEWS.MEM fromthe default device and directory of the account on the node WALNUT.

The following diagram illustrates these conditions:

tbs

The user KMAHOGANY could use an access control string to copythe file BIONEWS.MEM, as follows:

$ COPY WALNUT"KMAHOGANY A25D3255"::BIONEWS.MEM  BIONEWS.MEM

Notice that the password A25D3255 echoes. Anyone who observesthe screen can see it. In contrast, if KMAHOGANY has proxy accessfrom node BIRCH to the account on node WALNUT, the command for copyingthe file BIONEWS.MEM is as follows:

$ COPY WALNUT::BIONEWS.MEM   BIONEWS.MEM

KMAHOGANY does not need to specify a password in an accesscontrol string. Instead, the system performs a proxy login fromthe account on node BIRCH into the account on node WALNUT. Thereis no exchange of passwords.

Using a General Access Proxy Account

Your security administrator can also authorize groups of usersfrom foreign nodes to share in the use of a general access proxyaccount. For example, the security administrator at node WALNUTcan create a general access account with the following conditions:

The user name GENACCESS.

Access limited to network logins.

A password known only to the owner of the account.(None of the remote users need to know it.) This helps to protectthe account.

The default device and directory STAFFDEV:[BIOSTAFF].

If the security administrator grants BIRCH::KMAHOGANY proxyaccess to the GENACCESS account, the user KMAHOGANY can copy thefile BIONEWS.MEM by entering the following command:

$ COPY WALNUT::[KMAHOGANY]BIONEWS.MEM   BIONEWS.MEM

Note that KMAHOGANY must specify the directory [KMAHOGANY]because the file BIONEWS.MEM is not in the default device and directoryfor the GENACCESS account (STAFFDEV:[BIOSTAFF]). In addition, the protectionfor the file BIONEWS.MEM must permit access to the GENACCESS account.Otherwise, the command fails.

When You Need to Specify the Name of a Proxy Account

If you have access to more than one proxy account on a givennode and you do not want to use the default proxy account, specifythe name of the proxy account. For example, to use a proxy accountcalled PROXY2 instead of the GENACCESS account (the default), KMAHOGANYenters the following command:

$ COPY WALNUT"PROXY2"::[KMAHOGANY]BIONEWS.MEM BIONEWS.MEM

This command uses the PROXY2 account to copy the file BIONEWS.MEMfrom the [KMAHOGANY] directory on node WALNUT.

Guidelines for Protecting Your Password

Auditing Access to Your Account and Files