On a cluster, all elements of the user authorization datashould exist in a common database. These authorization elementsinclude the system user authorization files (SYSUAF.DAT and itsbackup SYSUAFALT.DAT), the rights database (RIGHTSLIST.DAT), thenetwork authorization file (NETPROXY.DAT) and its object databasefile (NETOBJECTS.DAT), which are present on all OpenVMS systems,and optionally, the autologin file, SYSALF.DAT.
A secure cluster requires that the authorization data be synchronizedacross all nodes. If a site chooses to maintain multiple versionsof these files, then you must synchronize the data. Each user shouldhave the same UIC, group number, and set of identifiers definedon every node. Coordination of privileges and access rights is alsocritical. A shared disk is protected only as much as its least protectednode. If you maintain separate authorization files on each nodein the cluster, ensure that user privileges are common across all copiesof the system user authorization file (SYSUAF.DAT). Fields in SYSUAF.DAT Requiring Synchronization lists the fields of SYSUAF.DAT that mustbe identical on each node.
Table 4 Fields in SYSUAF.DAT Requiring Synchronization
Internal Name
$SETUAI Item Code
UAF$R_DEF_CLASS
UAI$_DEF_CLASS
UAF$Q_DEF_PRIV
UAI$_DEF_PRIV
UAF$B_DIALUP_ACCESS_P
UAI$_DIALUP_ACCESS_P
UAF$B_DIALUP_ACCESS_S
UAI$_DIALUP_ACCESS_S
UAF$B_ENCRYPT
UAI$_ENCRYPT
UAF$B_ENCRYPT2
UAI$_ENCRYPT2
UAF$Q_EXPIRATION
UAI$_EXPIRATION
UAF$L_FLAGS
UAI$_FLAGS
UAF$B_LOCAL_ACCESS_P
UAI$_LOCAL_ACCESS_P
UAF$B_LOCAL_ACCESS_S
UAI$_LOCAL_ACCESS_S
UAF$B_NETWORK_ACCESS_P
UAI$_NETWORK_ACCESS_P
UAF$B_NETWORK_ACCESS_S
UAI$_NETWORK_ACCESS_S
UAF$B_PRIME_DAYS
UAI$_PRIMEDAYS
UAF$Q_PRIV
UAI$_PRIV
UAF$Q_PWD
UAI$_PWD
UAF$Q_PWD2
UAI$_PWD2
UAF$Q_PWD_DATE
UAI$_PWD_DATE
UAF$Q_PWD2_DATE
UAI$_PWD2_DATE
UAF$B_PWD_LENGTH
UAI$_PWD_LENGTH
UAF$Q_PWD_LIFETIME
UAI$_PWD_LIFETIME
UAF$B_REMOTE_ACCESS_P
UAI$_REMOTE_ACCESS_P
UAF$B_REMOTE_ACCESS_S
UAI$_REMOTE_ACCESS_S
UAF$R_MAX_CLASS
UAI$_MAX_CLASS
UAF$R_MIN_CLASS
UAI$_MIN_CLASS
UAF$W_SALT
UAI$_SALT
UAF$L_UIC
Not applicable
Use SYSMAN if you choose to create an autologin file and maintainthe file in the common authorization database with your authorizationfiles and rights database. On clustered systems, the autologin filemust include the cluster node name as a prefix to the terminal name.For example, the terminal TTA0 on node WILLOW would be representedas WILLOW$TTA0. See Using the System Management Utility foran overview of SYSMAN.
HP OpenVMS Guide to System Security
Security for the System Administrator
