 |
HP OpenVMS System Management Utilities Reference
Manual
ADD/IDENTIFIER
Adds only an identifier to the rights database. It does not add a user
account.
Format
ADD/IDENTIFIER [id-name]
Parameter
id-name
Specifies the name of the identifier to be added to the rights
database. If you omit the name, you must specify the /USER qualifier.
The identifier name is a string of 1 to 32 alphanumeric characters. The
name can contain underscores and dollar signs. It must contain at least
one nonnumeric character.
Qualifiers
/ATTRIBUTES=(keyword[,...])
Specifies attributes to be associated with the new identifier. The
following keywords are valid:
|
DYNAMIC
|
Allows unprivileged holders of the identifier to remove and to restore
the identifier from the process rights list by using the DCL command
SET RIGHTS_LIST.
|
|
HOLDER_HIDDEN
|
Prevents people from getting a list of users who hold an identifier,
unless they own the identifier themselves.
|
|
NAME_HIDDEN
|
Allows holders of an identifier to have it translated, either from
binary to ASCII or from ASCII to binary, but prevents unauthorized
users from translating the identifier.
|
|
NOACCESS
|
Makes any access rights of the identifier null and void. If a user is
granted an identifier with the No Access attribute, that identifier has
no effect on the user's access rights to objects. This attribute is a
modifier for an identifier with the Resource or Subsystem attribute.
|
|
RESOURCE
|
Allows holders of an identifier to charge disk space to the identifier.
Used only for file objects.
|
|
SUBSYSTEM
|
Allows holders of the identifier to create and maintain protected
subsystems by assigning the Subsystem ACE to the application images in
the subsystem. Used only for file objects.
|
By default, none of these attributes is associated with the new
identifier.
/USER=user-spec
Scans the UAF record for the specified user and creates the
corresponding identifier. Specify user-spec by user name or
UIC. You can use the asterisk wildcard to specify multiple user names
or UICs. Full use of the asterisk and percent wildcards is permitted
for user names; UICs must be in the form [*,*], [n,*], [*,n], or [n,n].
A wildcard user name specification (*) creates identifiers
alphabetically by user name; a wildcard UIC specification ([*,*])
creates them in numerical order by UIC.
/VALUE=value-specifier
Specifies the value to be attached to the identifier. The following
formats are valid for the value-specifier:
|
IDENTIFIER:n
|
An integer value in the range of 65,536 to 268,435,455. You can also
specify the value in hexadecimal (precede the value with %X) or octal
(precede the value with %O).
The system displays this type of identifier in hexadecimal. To
differentiate general identifiers from UIC identifiers, the system adds
%X80000000 to the value you specify.
|
|
GID:n
|
GID is the POSIX group identifier. It is an integer value in the range
0 to 16,777,215 (%XFFFFFF). The system will add %XA400.0000 to the
value you specify and then enter this new value into the system
RIGHTSLIST as an identifier.
|
|
UIC:uic
|
A UIC value in standard UIC format consists of a member name and,
optionally, a group name enclosed in brackets. For example, [360,031].
In numeric UICs, the group number is an octal number in the range
of 1 to 37776; the member number is an octal number in the range of 0
to 177776. You can omit leading zeros when you are specifying group and
member numbers.
Regardless of the UIC format you use, the system translates a UIC
to a 32-bit numeric value.
Alphanumeric UICs are not allowed.
|
Typically, system managers add identifiers as UIC values to represent
system users; the system applies identifiers in integer format to
system resources.
Examples
| #1 |
UAF> ADD/IDENTIFIER/VALUE=UIC:[300,011] INVENTORY
%UAF-I-RDBADDMSGU, identifier INVENTORY value: [000300,000011]
added to RIGHTSLIST.DAT
|
The command in this example adds an identifier named INVENTORY to the
rights database. By default, the identifier is not marked as a resource.
| #2 |
UAF> ADD/IDENTIFIER/ATTRIBUTES=(RESOURCE) -
_/VALUE=IDENTIFIER:%X80011 PAYROLL
%UAF-I-RDBADDMSGU, identifier PAYROLL value: %X80080011 added to
RIGHTSLIST.DAT
|
This command adds the identifier PAYROLL and marks it as a resource. To
differentiate identifiers with integer values from identifiers with UIC
values, %X80000000 is added to the specified code.
Adds an entry to the network proxy authorization files, NETPROXY.DAT
and NET$PROXY.DAT, and signals DECnet to update its volatile database.
Proxy additions take effect immediately on all nodes in a cluster that
share the proxy database.
Format
ADD/PROXY node::remote-user local-user[,...]
Parameters
node
Specifies a DECnet node name. If you provide a wildcard character (*),
the specified remote user on all nodes is served by the account defined
as local-user.
remote-user
Specifies the user name of a user at a remote node. If you specify an
asterisk, all users at the specified node are served by the local user.
For systems that are not OpenVMS and that implement DECnet, specifies
the UIC of a user at a remote node. You can specify a wildcard
character (*) in the group and member fields of the UIC.
local-user
Specifies the user names of 1 to 16 users on the local node. If you
specify an asterisk, a local-user name equal to
remote-user name will be used.
Positional Qualifier
/DEFAULT
Establishes the specified user name as the default proxy account. The
remote user can request proxy access to an authorized account other
than the default proxy account by specifying the name of the proxy
account in the access control string of the network operation.
Description
The ADD/PROXY command adds an entry to the network proxy authorization
files, NETPROXY.DAT and NET$PROXY.DAT, and signals DECnet to update its
volatile database. Proxy additions take effect immediately on all nodes
in a cluster that share the proxy database.
You can grant a remote user access to one default proxy account and up
to 15 other local accounts. To access proxy accounts other than the
default proxy account, remote users specify the requested account name
in an access control string. To change the default proxy account, use
the AUTHORIZE command MODIFY/PROXY.
Proxy login is an effective way to avoid specifying (and, possibly,
revealing) passwords in command lines. However, you must use caution in
granting access to remote users. While logged in to the local system,
remote users can apply the full DCL command set (with the exception of
SET HOST). A remote user receives the default privileges of the local
user and, therefore, becomes the owner of the local user's files when
executing any DCL commands.
To avoid potential security compromises, HP recommends that you create
proxy accounts on the local node that are less privileged than a user's
normal account on the remote node. By adding an extension such as _N,
you can identify the account as belonging to a remote user, while
distinguishing it from a native account with the same name on the local
node. For example, the following command creates a JONES_N proxy
account on the local node that allows the user JONES to access the
account from the remote node SAMPLE:
UAF> ADD/PROXY SAMPLE::JONES JONES_N/DEFAULT
%UAF-I-NAFADDMSG, record successfully added to NETPROXY.DAT
|
For more information about creating proxy accounts, see the
HP OpenVMS Guide to System Security.
Examples
| #1 |
UAF> ADD/PROXY SAMPLE::WALTER ROBIN/DEFAULT
%UAF-I-NAFADDMSG, record successfully added to NETPROXY.DAT
|
Specifies that user WALTER on remote node SAMPLE has proxy access to
user ROBIN's account on local node AXEL. Through proxy login, WALTER
receives the default privileges of user ROBIN when he accesses node
AXEL remotely.
| #2 |
UAF> ADD/PROXY MISHA::* MARCO/DEFAULT, OSCAR
%UAF-I-NAFADDMSG, record successfully added to NETPROXY.DAT
|
Specifies that any user on the remote node MISHA can, by default, use
the MARCO account on the local node for DECnet tasks such as remote
file access. Remote users can also access the OSCAR proxy account by
specifying the user name OSCAR in the access control string.
| #3 |
UAF> ADD/PROXY MISHA::MARCO */DEFAULT
%UAF-I-NAFADDMSG, record successfully added to NETPROXY.DAT
|
Specifies that user MARCO on the remote node MISHA can use only the
MARCO account on the local node for remote file access.
| #4 |
UAF> ADD/PROXY TAO::MARTIN MARTIN/D,SALES_READER
%UAF-I-NAFADDMSG, proxy from TAO:.TWA.RAN::MARTIN to MARTIN added
%UAF-I-NAFADDMSG, proxy from TAO:.TWA.RAN::MARTIN to SALES_READER
added
|
Adds a proxy from TAO::MARTIN to the local accounts MARTIN (the
default) and SALES_READER on a system running DECnet-Plus.
Creates a new SYSUAF record that duplicates an existing UAF record.
Format
COPY oldusername newusername
Parameters
oldusername
Name of an existing user record to serve as a template for the new
record.
newusername
Name for the new user record. The user name is a string of 1 to 12
alphanumeric characters.
Qualifiers
/ACCESS[=(range[,...])]
/NOACCESS[=(range[,...])]
Specifies hours of access for all modes of access. The syntax for
specifying the range is:
/[NO]ACCESS=([PRIMARY], [n-m], [n], [,...],[SECONDARY], [n-m], [n], [,...])
|
Specify hours as integers from 0 to 23, inclusive. You can specify
single hours (n) or ranges of hours (n-m). If the ending hour of a
range is earlier than the starting hour, the range extends from the
starting hour through midnight to the ending hour. The first set of
hours after the keyword PRIMARY specifies hours on primary days; the
second set of hours after the keyword SECONDARY specifies hours on
secondary days. Note that hours are inclusive; that is, if you
grant access during a given hour, access extends to the end of that
hour.
By default, a user has full access every day. See the DCL command SET
DAY in the HP OpenVMS DCL Dictionary for information about overriding the defaults
for primary and secondary day types.
All the list elements are optional. Unless you specify hours for a day
type, access is permitted for the entire day. By specifying an access
time, you prevent access at all other times. Adding NO to the qualifier
denies the user access to the system for the specified period of time.
See the following examples.
|
/ACCESS
|
Allows unrestricted access
|
|
/NOACCESS=SECONDARY
|
Allows access on primary days only
|
|
/ACCESS=(9-17)
|
Allows access from 9 A.M. to 5:59 P.M. on all days
|
|
/NOACCESS=(PRIMARY, 9-17, SECONDARY, 18-8)
|
Disallows access between 9 A.M. to 5:59 P.M. on primary days but allows
access during these hours on secondary days
|
To specify access hours for specific types of access, see the /BATCH,
/DIALUP, /INTERACTIVE, /LOCAL, /NETWORK, and /REMOTE qualifiers.
For information about the effects of login class restrictions, see the
HP OpenVMS Guide to System Security.
/ACCOUNT=account-name
Specifies the default name for the account (for example, a billing name or number). The name can be a string of 1 to 8 alphanumeric characters. By default, AUTHORIZE does not assign an account name.
/ADD_IDENTIFIER (default)
/NOADD_IDENTIFIER
Adds an identifier to the rights database file, RIGHTSLIST.DAT, and also adds a user to the user authorization file, SYSUAF. The /NOADD_IDENTIFIER qualifier does not add an identifier to the RIGHTSLIST.DAT file but does, however, add a user to the SYSUAF user record file. Note that the AUTHORIZE command ADD/IDENTIFIER is quite different: it only adds an entry to the rights database file, RIGHTSLIST.DAT.
/ALGORITHM=keyword=type [=value]
Sets the password encryption algorithm for a user. The keyword VMS
refers to the algorithm used in the operating system version that is
running on your system, whereas a customer algorithm is one that is
added through the $HASH_PASSWORD system service by a customer site, by
a layered product, or by a third party. The customer algorithm is
identified in $HASH_PASSWORD by an integer in the range of 128 to 255.
It must correspond with the number used in the AUTHORIZE command
MODIFY/ALGORITHM. By default, passwords are encrypted with the VMS
algorithm for the current version of the operating system.
| Keyword |
Function |
|
BOTH
|
Set the algorithm for primary and secondary passwords.
|
|
CURRENT
|
Set the algorithm for the primary, secondary, both, or no passwords,
depending on account status. CURRENT is the default value.
|
|
PRIMARY
|
Set the algorithm for the primary password only.
|
|
SECONDARY
|
Set the algorithm for the secondary password only.
|
The following table lists password encryption algorithms:
| Type |
Definition |
|
VMS
|
The algorithm used in the version of the operating system that is
running on your system.
|
|
CUSTOMER
|
A numeric value in the range of 128 to 255 that identifies a customer
algorithm.
|
The following example selects the VMS algorithm for Sontag's primary
password:
UAF> MODIFY SONTAG/ALGORITHM=PRIMARY=VMS
|
If you select a site-specific algorithm, you must give a value to
identify the algorithm, as follows:
UAF> MODIFY SONTAG/ALGORITHM=CURRENT=CUSTOMER=128
|
/ASTLM=value
Specifies the AST queue limit, which is the total number of
asynchronous system trap (AST) operations and scheduled wake-up
requests that the user can have queued at one time. The default is 40
on VAX systems and 300 on Alpha and I64 systems.
/BATCH[=(range[,...])]
Specifies the hours of access permitted for batch jobs. For a
description of the range specification, see the /ACCESS qualifier. By
default, a user can submit batch jobs any time.
/BIOLM=value
Specifies a buffered I/O count limit for the BIOLM field of the UAF
record. The buffered I/O count limit is the maximum number of buffered
I/O operations, such as terminal I/O, that can be outstanding at one
time. The default is 40 on VAX systems and 150 on Alpha and I64 systems.
/BYTLM=value
Specifies the buffered I/O byte limit for the BYTLM field of the UAF
record. The buffered I/O byte limit is the maximum number of bytes of
nonpaged system dynamic memory that a user's job can consume at one
time. Nonpaged dynamic memory is used for operations such as I/O
buffering, mailboxes, and file-access windows. The default is 32768 on
VAX systems and 128,000 on Alpha and I64 systems.
/CLI=cli-name
Specifies the name of the default command language interpreter (CLI)
for the CLI field of the UAF record. The cli-name is a string
of 1 to 31 alphanumeric characters and should be DCL, which is the
default. This setting is ignored for network jobs.
/CLITABLES=filespec
Specifies user-defined CLI tables for the account. The
filespec can contain 1 to 31 characters. The default is
SYS$LIBRARY:DCLTABLES. Note that this setting is ignored for network
jobs to guarantee that the system-supplied command procedures used to
implement network objects function properly.
/CPUTIME=time
Specifies the maximum process CPU time for the CPU field of the UAF
record. The maximum process CPU time is the maximum amount of CPU time
a user's process can take per session. You must specify a delta time
value. For a discussion of delta time values, see the OpenVMS User's Manual. The
default is 0, which means an infinite amount of time.
/DEFPRIVILEGES=([NO]privname[,...])
Specifies default privileges for the user; that is, those enabled at
login time. A NO prefix removes a privilege from the user. By
specifying the keyword [NO]ALL with the /DEFPRIVILEGES qualifier, you
can disable or enable all user privileges. The default privileges are
TMPMBX and NETMBX. Privname is the name of the privilege.
/DEVICE=device-name
Specifies the name of the user's default device at login. The
device-name is a string of 1 to 31 alphanumeric characters. If
you omit the colon from the device-name value, AUTHORIZE
appends a colon. The default device is SYS$SYSDISK.
If you specify a logical name as the device-name (for example,
DISK1: for DUA1:), you must make an entry for the logical name in the
LNM$SYSTEM_TABLE in executive mode by using the DCL command
DEFINE/SYSTEM/EXEC.
/DIALUP[=(range[,...])]
Specifies hours of access permitted for dialup logins. For a
description of the range specification, see the /ACCESS qualifier. The
default is full access.
/DIOLM=value
Specifies the direct I/O count limit for the DIOLM field of the UAF
record. The direct I/O count limit is the maximum number of direct I/O
operations (usually disk) that can be outstanding at one time. The
default is 40 on VAX systems and 150 on Alpha and I64 systems.
/DIRECTORY=directory-name
Specifies the default directory name for the DIRECTORY field of the UAF
record. The directory-name can be 1 to 39 alphanumeric
characters. If you do not enclose the directory name in brackets,
AUTHORIZE adds the brackets for you. The default directory name is
[USER].
/ENQLM=value
Specifies the lock queue limit for the ENQLM field of the UAF record.
The lock queue limit is the maximum number of locks that can be queued
by the user at one time. The default is 200 on VAX systems and 4000 on
Alpha and I64 systems.
/EXPIRATION=time (default)
/NOEXPIRATION
Specifies the expiration date and time of the account. The
/NOEXPIRATION qualifier removes the expiration date on the account. If
you do not specify an expiration time when you add a new account,
AUTHORIZE copies the expiration time from the DEFAULT account. (The
expiration time on the DEFAULT account is "none" by default.)
/FILLM=value
Specifies the open file limit for the FILLM field of the UAF record.
The open file limit is the maximum number of files that can be open at
one time, including active network logical links. The default is 300 on
VAX systems and 128 on Alpha and I64 systems.
/FLAGS=([NO]option[,...])
Specifies login flags for the user. The prefix NO clears the flag. The
options are as follows:
|
AUDIT
|
Enables or disables mandatory security auditing for a specific user. By
default, the system does not audit the activities of specific users
(NOAUDIT).
|
|
AUTOLOGIN
|
Restricts the user to the automatic login mechanism when logging in to
an account. When set, the flag disables login by any terminal that
requires entry of a user name and password. The default is to require a
user name and password (NOAUTOLOGIN).
|
|
CAPTIVE
|
Prevents the user from changing any defaults at login, for example,
/CLI or /LGICMD. It prevents the user from escaping the captive login
command procedure specified by the /LGICMD qualifier and gaining access
to the DCL command level. See "Guidelines for Captive Command
Procedures" in the HP OpenVMS Guide to System Security.
The CAPTIVE flag also establishes an environment where Ctrl/Y
interrupts are initially turned off; however, command procedures can
still turn on Ctrl/Y interrupts with the DCL command SET CONTROL=Y. By
default, an account is not captive (NOCAPTIVE).
|
|
DEFCLI
|
Restricts the user to the default command interpreter by prohibiting
the use of the /CLI qualifier at login. By default, a user can choose a
CLI (NODEFCLI).
|
|
DISCTLY
|
Establishes an environment where Ctrl/Y interrupts are initially turned
off and are invalid until a SET CONTROL=Y is encountered. This could
happen in SYLOGIN.COM or in a procedure called by SYLOGIN.COM. Once a
SET CONTROL=Y is executed (which requires no privilege), a user can
enter a Ctrl/Y and reach the DCL prompt ($). If the intent of DISCTLY
is to force execution of the login command files, then SYLOGIN.COM
should issue the DCL command SET CONTROL=Y to turn on Ctrl/Y interrupts
before exiting. By default, Ctrl/Y is enabled (NODISCTLY).
|
|
DISFORCE_PWD_CHANGE
|
Removes the requirement that a user must change an expired password at
login. By default, a person can use an expired password only once
(NODISFORCE_PWD_CHANGE) and then is forced to change the password after
logging in. If the user does not select a new password, the user is
locked out of the system.
To use this feature, set a password expiration date with the
/PWDLIFETIME qualifier.
|
|
DISIMAGE
|
Prevents the user from executing RUN and foreign commands. By default,
a user can execute RUN and foreign commands (NODISIMAGE).
|
|
DISMAIL
|
Disables mail delivery to the user. By default, mail delivery is
enabled (NODISMAIL).
|
|
DISNEWMAIL
|
Suppresses announcements of new mail at login. By default, the system
announces new mail (NODISNEWMAIL).
|
|
DISPWDDIC
|
Disables automatic screening of new passwords against a system
dictionary. By default, passwords are automatically screened
(NODISPWDDIC).
|
|
DISPWDHIS
|
Disables automatic checking of new passwords against a list of the
user's old passwords. By default, the system screens new passwords
(NODISPWDHIS).
|
|
DISPWDSYNCH
|
Suppresses synchronization of the external password for this account.
See bit 9 in the SECURITY_POLICY system parameter for systemwide
password synchronization control.
|
|
DISRECONNECT
|
Disables automatic reconnection to an existing process when a terminal
connection has been interrupted. By default, automatic reconnection is
enabled (NODISRECONNECT).
|
|
DISREPORT
|
Suppresses reports of the last login time, login failures, and other
security reports. By default, login information is displayed
(NODISREPORT).
|
|
DISUSER
|
Disables the account so the user cannot log in. For example, the
DEFAULT account is disabled. By default, an account is enabled
(NODISUSER).
|
|
DISWELCOME
|
Suppresses the welcome message (an informational message displayed
during a local login). This message usually indicates the version
number of the operating system that is running and the name of the node
on which the user is logged in. By default, a system login message
appears (NODISWELCOME).
|
|
EXTAUTH
|
Considers user to be authenticated by an external user name and
password, not by the SYSUAF user name and password. (The system still
uses the SYSUAF record to check a user's login restrictions and quotas
and to create the user's process profile.)
|
|
GENPWD
|
Restricts the user to generated passwords. By default, users choose
their own passwords (NOGENPWD).
|
|
LOCKPWD
|
Prevents the user from changing the password for the account. By
default, users can change their passwords (NOLOCKPWD).
|
|
PWD_EXPIRED
|
Marks a password as expired. The user cannot log in if this flag is
set. The LOGINOUT.EXE image sets the flag when both of the following
conditions exist: a user logs in with the DISFORCE_PWD_CHANGE flag set,
and the user's password expires. A system manager can clear this flag.
By default, passwords are not expired after login (NOPWD_EXPIRED).
|
|
PWD2_EXPIRED
|
Marks a secondary password as expired. Users cannot log in if this flag
is set. The LOGINOUT.EXE image sets the flag when both of the following
conditions exist: a user logs in with the DISFORCE_PWD_CHANGE flag set,
and the user's password expires. A system manager can clear this flag.
By default, passwords are not set to expire after login
(NOPWD2_EXPIRED).
|
|
PWDMIX
|
Enables case-sensitive and extended-character passwords.
After PWDMIX is specified, you can then use mixed-case and extended
characters in passwords. Be aware that before the PWDMIX flag is
enabled, the system stores passwords in all upper-case. Therefore,
until you change passwords, you must enter your pre-PWDMIX passwords in
upper-case.
To change the password after PWDMIX is enabled:
- You (the user) can use the DCL command SET PASSWORD, specifying the
new mixed-case password (omitting quotation marks).
- You (the system manager) can use the AUTHORIZE command
MODIFY/PASSWORD, and enclose the user's new mixed-case password in
quotation marks
" "
.
|
|
RESTRICTED
|
Prevents the user from changing any defaults at login (for example, by
specifying /LGICMD) and prohibits user specification of a CLI with the
/CLI qualifier. The RESTRICTED flag establishes an environment where
Ctrl/Y interrupts are initially turned off; however, command procedures
can still turn on Ctrl/Y interrupts with the DCL command SET CONTROL=Y.
Typically, this flag is used to prevent an applications user from
having unrestricted access to the CLI. By default, a user can change
defaults (NORESTRICTED).
|
|
VMSAUTH
|
Allows account to use standard (SYSUAF) authentication when the EXTAUTH
flag would otherwise require external authentication. This depends on
the application. An application specifies the VMS domain of
interpretation when calling SYS$ACM to request standard VMS
authentication for a user account that normally uses external
authentication.
|
/GENERATE_PASSWORD[=keyword]
/NOGENERATE_PASSWORD (default)
Invokes the password generator to create user passwords. Generated
passwords can consist of 1 to 10 characters. Specify one of the
following keywords:
|
BOTH
|
Generate primary and secondary passwords.
|
|
CURRENT
|
Do whatever the DEFAULT account does (for example, generate primary,
secondary, both, or no passwords). This is the default keyword.
|
|
PRIMARY
|
Generate primary password only.
|
|
SECONDARY
|
Generate secondary password only.
|
|
