f. OpenVMS FAQ -&- page 10)b @5z

HP OpenVMS Systems Documentation

 q> $"b,
Content starts here"D

The OpenVMS Frequently Asked Questions (FAQ)


 l n  
PreviousContentsIndex

~

5.27 How can I prevent a serial terminal line from initiating a login?



(In SYSTARTUP_VMS.COM, issue the command:

 

"
*$ SET TERMINAL/NOTYPEAHEAD/PERMANENT ddcu:




CThis will prevent any unsolicited terminal input on ddcu:, and thisFunsolicited input is what triggers JOB_CONTROL to start up LOGINOUT onEthe terminal. Once LOGINOUT starts up on the serial line, you can seeFinteresting behaviour (eg: audits, process creations, etc) as LOGINOUTAtries to "chat" with whatever device is hooked onto the'remote end of the serial terminal line.k

5.28 How does PCSI use the image BUILD_IDENT field?



EThe (undocumented) build ident field in an OpenVMS Alpha image headerDis 16 bytes long, and is used as a counted string of 0-15 charactersF(ie, as an .ASCIC string, a string with the character count in byte 0)?and was originally introduced to provide information for use byEVMSINSTAL patch kits to determine whether an image should be replacedor not.

EStarting with OpenVMS Alpha V7.1-2, OpenVMS Engineering uses the PCSIButility to package and install ECO kits for OpenVMS. PCSI uses theGgeneration attribute (a 32-bit unsigned integer) specified for files inAthe product description file (PDF) of a PCSI kit as the basis forDperforming file conflict detection and resolution. When a product isEinstalled, PCSI modifies the build ident field of Alpha image headersGto store an encoded form of the generation number. It also looks at the>build ident field of previously installed images to obtain theDgeneration information for those files as input to the file conflict?processing algorithm. (Only images have this field, obviously.)

EPCSI interprets the build ident field of a previously installed image as follows:

    H
  • if the string length is 15, the 5th character is a hyphen, and theI last ten characters are a ten digit number with leading zeros, then the? last ten characters are treated as a valid generation number.H
  • for V7.1-2 through V7.2-1, inclusive, if the above test fails, the9 information is obtained from the PCSI product database.E
  • in releases after V7.2-1 and with current PCSI ECO kits, if theI above test fails, an invalid generation number is treated as 0000000000H so that the ECO kit will simply replace the image rather than assuming the PCSI database is in error.


CSo, what will you see in the image identification displayed via theANALYZE/IMAGE command?

BFor an image that has been built as part of an OpenVMS EngineeringDsystem build, you will generally see a build ID string in the formatD"X6TE-SSB-0000"---X6TE is the build number for the OpenVMSFAlpha V7.2-1 release. This id format is used within the OpenVMS systemFbuild, and can generally only be seen associated with images that have not yet been processed via PCSI.

GDuring the installation of V7.2-1, PCSI will modify the image header to@have a build ident string of "X6TE-0050120000". DuringBinstallation of an ECO kit containing this image with a generationFnumber of 50130052, for example, PCSI would determine that 50130052 isAgreater than 50120000, and will replace the existing image on theBtarget disk with the version of the image included in the ECO kit.

BRanges of PCSI generation numbers for various OpenVMS releases arezincluded in Table 5-1. The use of xxxx indicates a range ofFgenerations is available, from 0000 to 9999, inclusive. The formatFof, the particular operation of, and the assignment of PCSI generation5numbers is subject to change without notice.

e  , ,                                                                                  
Table 5-1 PCSI Generation Number
Generation Number Generation Source
 0040100000 V7.1-2
 004011xxxx  V7.1-2 ECOs
 0050100000 V7.2
 005011xxxx  V7.2 ECOs
 0050120000 V7.2-1
 005013xxxx  V7.2-1 ECOs
 0050140000  V7.2-1H1
 005015xxxx  V7.2-1H1 ECOs
 0050160000 V7.2-2
 005017xxxx  V7.2-2 ECOs
 0060000000 V7.3
 006001xxxx  V7.3 ECOs
 0060020000 V7.3-1
 006003xxxx  V7.3-1 ECOs
 0060100000 V7.3-2
 006011xxxx  V7.3-2 ECOs
 0070040000 V8.2
 007005xxxx  V8.2 ECOs
 0070060000 V8.2-1
 007007xxxx  V8.2-1 ECOs
u

5.29 How can I tell what software (and version) is installed?



@There is unfortunately no consistent nor single way to make this>determination---this is one of the reasons that a move to PCSIinstallations is underway.

@On OpenVMS Alpha, you can use VMSINSTAL.HISTORY and PRODUCT SHOW>PRODUCT to determine what packages have been installed via the'VMSINSTAL and PCSI tools, respectively.

>To see which OpenVMS Alpha ECO kits have been applied, look inCVMSINSTAL.HISTORY on OpenVMS Alpha prior to V7.1-2, and use PRODUCT4SHOW PRODUCT/FULL on OpenVMS Alpha V7.1-2 and later.

GOn OpenVMS VAX, you can use PRODUCT SHOW PRODUCT and (for software thatCis installed via VMSINSTAL on V7.3 and later) in VMSINSTAL.HISTORY.

DFor products installed on OpenVMS VAX prior to V7.3 using VMSINSTAL,=there is no reliable way to determine what products have beenEinstalled. If the product provides a RELEASE_NOTES file (as many do),6you can look for the list of these files via DIRECTORYDSYS$HELP:*.RELEASE_NOTES. Again, this approach is NOT reliable: someDkits do not provide release notes, some system managers will installGonly the release notes, some system managers will delete release notes,7and release notes for multiple versions can be present.

COn most packages, you can generally use ANALYZE/IMAGE on one of theBcore images, looking at the image identification area. Some of the*product-specific mechanisms available are:

    "
  • DQS DQS$VERSION logical name
  • C CC/VERSION
  • C++ CXX/VERSION'
  • TCP/IP TCPIP SHOW VERSION command
p

5.30 What file checksum tools are available for OpenVMS?



,The undocumented (prior to V8.2) DCL command@CHECKSUM is the usual means, and provides a rather simple-mindedGchecksum suitable to detect basic file corruptions. Starting with V8.2,,additional algorithms beyond the classic XOR scheme are available.

NOne of the most common schemes beyond the CHECKSUM XOR scheme is MD5, and information and a source code example are available via the MD5 RFC. As of this writing, pre-built versions of MD5 are expected to be made available at or via the OpenVMS Freeware website ( ,http://www.hp.com/go/openvms/freeware/ B), and MD5 is expected to be made available on an OpenVMS Freeware release after V7.0. Also see the9CHECKSUM/ALGORITHM=MD5 command on OpenVMS V8.2 and later.

@The OpenVMS Alpha ECO (patch) kit checksums available at the ECO@website are determined using the following DCL command sequence:

 

"
"$ CHECKSUM kitname.pcsi-dcx_axpexe$ SHOW SYMBOL CHECKSUM$CHECKSUM




|See Section 5.17 for information on acquiring OpenVMS ECO (patch) kits.p

5.31 What (and where) is the OpenVMS Management Station?



CFor information and current kits for the OpenVMS Management StationD(OMS), a PC-based tool that permits you to manage an OpenVMS system, please see:

o

5.32 How to determine current disk fragmentation level?



@The HP OpenVMS Disk File Optimizer (DFO) defragmentation package;provides a fragmentation monitoring tool, and a DFO productGauthorization key (PAK) is not required for the fragmentation reportingtool:

 

"
$ DEFRAG SHOW/VOLUME ddcu:




GThe DFU tool available on the OpenVMS Freeware can generate a report onthe disk fragmentation:

 

"
DFU> REPORT ddcu:


u

5.33 SYSBOOT-I-FILENOTLOC, Unable to locate SYS$CPU_ROUTINES?



?A message at the OpenVMS Alpha bootstrap such as the following:

 

"
'%SYSBOOT-I-FILENOTLOC, Unable to locate  SYS$CPU_ROUTINES_1C02.EXE*%SYSBOOT-E-LDFAIL, failed to load execlet,  status = 00000910




Dindicates that the particular OpenVMS Alpha release does not contain?support for the target platform. In this case, OpenVMS does notDrecognize Alpha family 1C member 02 as a supported platform. A laterCversion of OpenVMS might support the platform, or there might be noGsupport on any release. Ensure that you have the most current firmware,=and review the minimum version requirements for the platform.

FThe execlet load failure and other similar bootstrap status values can:often be decoded using either of the following techniques:

 

"
$ exit %x910"%SYSTEM-W-NOSUCHFILE, no such file$$ x = f$message(%x910)$ show symbol x*  X = "%SYSTEM-W-NOSUCHFILE, no such file"$




QAlso see Section 14.4.4.1.{

5.34 How can I customize the DCPS device control for a new printer?



GTo customize DCPS for an otherwise unsupported printer, you can try thefollowing sequence:

    I
  • Extract the most closely-associated setup modules from the existingA device control library, DCPS$DEVCTL.TLB. (For instance, you canF probably extract and use the HP LaserJet 4000 series definitions forI the HP LaserJet 4050 series. Each printer will vary, please consult the8 printer documentation for specifics and requirements.)<
  • rename each extracted setup module to a corresponding:

     

    "
    LPS$$UNRECOGNIZED_*
    
    
    H

  • Insert all of the above-renamed setup modules into a newly-created5 device control library specific to the new printer:

     

    "
    $ LIBRARY/TEXT/CREATE -(    SYS$COMMON:[SYSLIB]HP4050_DEVCTL.TLB    LPS$$UNRECOGNIZED*
    
    
    L
    The above assumes the filename HP4050_DEVCTL.TLB, alter as required.B

  • Set up your DCPS startup procedures to include a search-list logical name such as:

     

    "
    ,$ DEFINE/SYSTEM/EXECUTIVE DCPS_HP4050_LIB  -$    SYS$LIBRARY:HP4050_DEVCTL.TLB, -    SYS$LIBRARY:DCPS$DEVCTL.TLB
    
    
    B

  • Supply DCPS_HP4050_LIB as the library parameter in the queueC startup for this printer, this is the P3 parameter to the commandO1 procedure SYS$STARTUP:DCPS$EXECUTION_QUEUE.COM.aI
  • The HP4050_DEVCTL library may/will need to be recreated and modules>D re-edited and replaced with each DCPS upgrade, particularly if anyD modules are updated in the original library. You will also want toA determine if the upgraded version of DCPS directly supports thea particular printer.=D
  • To customize the processing of file extensions within DCPS (toF enable or disable graybar output, for instance), use the information available in: 

    " 
    !
    "
    5SYS$LIBRARY:DCPS$FILE_EXTENSION_DATA_TYPE.DAT_DEFAULTA
    
    
    

e

f!to create your own site-specific:e

= 
!
"
-SYS$LIBRARY:DCPS$FILE_EXTENSION_DATA_TYPE.DATs

e


gKAlso see Section 5.15.ey

5.35 Why do $GETDEV MOUNTCNT and SHOW DEVICE mount counts differ?

c

lEMOUNTCNT returns the local mount count, while SHOW DEVICE returns thelcluster-wide mount count.em

5.36 What software is needed for Postscript printers?

l

"GThe NorthLake PrintKit (www.nls.com) and DECprint Supervisor (DCPS) areo=common choices for support of Postscript printers on OpenVMS._

i

?You may also require the installation of an IP transport stack.S

VAlso please see Section 15.2.2 and Section 15.2.3.Ln

5.37 How do I remove a PCSI-installed patch (ECO) kit?



n1You cannot PRODUCT REMOVE a PCSI patch (ECO) kit.U

hDIn order to remove an ECO kit, PCSI would have to have copies of allGthe other version of the files from all other patches and products thatrEpreviously were installed. This can clearly involve a large number ofe@files and a large archive of old file versions and a substantial>quantity of disk space. While removal is clearly theoretically*possible, it is not currently implemented.

DThe following is the supported mechanism to remove a PCSI patch kit.

    oE
  1. Execute a PRODUCT SHOW PRODUCT product-name. /FULL command. TheIE "maintenance" column (132 column width) shows the patchesl8 that have been installed. Keep a copy of this listing.:
  2. Acquire kits for all of the maintenance kits listed.H
  3. Re-install the prior FULL version of the product. This will removeA all patch kits, setting to product back to "original"n condition.F
  4. Re-install all the patches in the list from step 1, except those4 patches which you have determined you do not want.
h

8The above information also applies to PCSI PARTIAL kits.u

5.38 SYSINIT-E, error mounting system device, status=0072832C



<This message can arise during an OpenVMS system bootstrap...

 

"
C%MOUNT-F-DIFVOLMNT, different volume already mounted on this devicei

l


9For details and further information, use the DCL command:h

h 
e
"
$ HELP/MESSAGE /STATUS=%X72832Cs

o
\

5.39 Resolving License PAK Problems?



eGThe PAK release date, the PAK termination date, and the PAK version areGthe usual culprits when a license product authorization key (PAK) check0failure occurs. 

FThe PAK termination date is the date when the license PAK will expire.

rGThe PAK release date is the date of the most recent release date of theiFsoftware package that will be permitted by the particular license PAK.E(The release date check is analogous to a product version check.) ThenGPAK version indicates the most recent product version that is permitted6by the license.u

rCHaving multiple license PAKs registered (and active) can also cause @problems if an expired PAK gets loaded. You will want to DISABLE,license PAKs you do not wish to have loaded.

.DOther problems include a failure to register each PAK in all licenseFdatabases throughout a multiple-system-disk cluster, with a consistentCset of /INCLUDE lists specified across each of the duplicated PAKs.a

u@Additionally, you could have an invalid LMF$LICENSE logical nameAdefined. (If no LMF$LICENSE logical name is defined, the standardh@license database named SYS$SYSTEM:LMF$LICENSE.LDB will be used.)

HYou can display license failures by defining the following logical name:

d 
n
"
0$ DEFINE/SYS/EXEC LMF$DISPLAY_OPCOM_MESSAGE TRUE

>


hBEnable your terminal as a license operator (REPLY/ENABLE=LICENSE),Cdefine the LMF$DISPLAY_OPCOM_MESSAGE logical name, and then try the=Bfailing operation again. You should see one or more OPCOM messages displayed.

oGIf you have the LMF$DISPLAY_OPCOM_MESSAGE logical name defined, you cannC(will?) see spurious license check failures---various products will Ccheck for multiple licenses, and a few products will check for PAKs Dthat either have not yet been or will not be issued. Once you figureDout which license has failed, you will want to deassign this logicalname.1



/  E 
Note

CThat there are no license check failures does not indicaterBthat the particular product or operation or use is permissible per>applicable licensing agreements. Please consult the applicableHagreement(s) for licensing-related information and requirements.
t

oGTo register a license PAK on a DECwindows system when DECwindows cannot Astart (because of an expired license or other licensing problem), wfollow the steps outlined in section Section 5.6 up through the useDof the AUTHORIZE command. In place of the AUTHORIZE command, use thetconsole to register the license PAKs. Also see Section 12.4 for*licensing and troubleshooting information.

d@For information on licensing and on the numbers of license unitsErequired for various products and various platforms, the License Unit0*Requirements Table (LURT) is available at:

a

5.40 Changing the OpenVMS Version Number?



GFool your friends, baffle your enemies, run the OpenVMS version of your>choice!0

xOn OpenVMS Alpha systems: 

2 

"
"$ SET DEFAULT SYS$COMMON:[SYS$LDR]$ RUN SYSVERREPLACE V9.9WRITE $ EXIT




tOn OpenVMS VAX systems: 

 
0
"
"$ set default SYS$COMMON:[SYS$LDR]%$ copy SYS.EXE SYS.EXE_IN-CASE-I-FAILx$ patch SYS.EXE define sys$gq_version=800044b8set mode ascii!examine sys$gq_versionm!examine sys$gq_version+4>!deposit sys$gq_version   = "V9.9"a!deposit sys$gq_version+4 = "    "1updateexit$ Exit

p


r'Then reboot the system at your leisure.mr

5.41 How to prevent users from choosing obvious passwords?



aFTo prevent users from selecting obvious passwords on OpenVMS, you willAwant to use the reserved password (password screening) mechanism. ?Effectively, you merge your list of reserved passwords into the>Eexisting reserved words database maintained by OpenVMS. (You can alsooEthen require all users to reset their passwords---via the pre-expiredCEpassword mechanism---thus forcing users to select new passwords.) ForeEdetails on the password screening mechanism, of the reserved passwordiDdatabase (VMS$PASSWORD_DICTIONARY.DATA), and details of how to mergeCyour list of prohibited passwords into the database, please see theAEassociated chapter in the OpenVMS security manual. For details of thetBpassword expiration mechanism, see the AUTHORIZE command qualifier /PWDEXPIRED.

l?You can also implement a site-specific password filter with the,Dinformation provided in the back of the OpenVMS Programming ConceptsCmanual. The password filter permits you to establish particular andsGsite-specific password requirements. For details, please see the systemvparameter LOAD_PWD_POLICY<and the programming concepts manual, and see the examples inDSYS$EXAMPLES:. (Examples and documentation on V7.3 and later reflectBboth platforms, the examples are found only on OpenVMS VAX kits onCearlier releases. The capabilities have existed on both the VAX and#Alpha platforms for some time now.)r

0BTo verify current passwords, you can also use a technique known tosystem crackers as theE"dictionary attack" -- the mechanism that makes this attacka@somewhat more difficult on OpenVMS is the hashing scheme used onCOpenVMS, and the file protections used for the SYSUAF authorizationaEdatabase. Given a dictionary of words and the unprotected contents ofhthes=SYSUAF file, a search for obvious passwords can be performed. GInterestingly, a "dictionary attack" also has the unfortunateo@side-effect of exposing the password to the user---while this is?clearly the goal of a system cracker, authorized privileged andvBnon-privileged system users should not know nor have access to the%(cleartext) passwords of other users. 

eDAccordingly, OpenVMS does not store the cleartest password. Further,GOpenVMS uses a password hashing algorithm, not an encryption algorithm.lGThis means that storage of a cleartext password is deliberated avoided,dEand the cleartext value is deliberately very difficult to obtain. The hash is based on aFPurdy Polynomial, and the hash itself includes user-specific values inFaddition to the password, values that make the results of the passwordhash unique to each user.S

5ERegardless of the use of a password hashing scheme, if a copy of yourmCpassword file should become available to a system cracker, you willS9want to force all users to use new passwords immediately.>

DIf you should require a user to verify a password, use the username,Bthe user's salt value (this value is acquired via $getuai) and theEuser's specified cleartext password, and compare the resulting hashedwvalue (using a call toC$hash_password) against the saved hashed password value (this valueaalso acquired via<D$getqui). For reasons of security, avoid saving a cleartext passwordFvalue in any data files, and do not maintain the cleartext password in$memory longer than required. (Use of- sys$acm on V7.3-1 and later is recommended.)n

iKerberosD authentication (client and server) is available on OpenVMS V7.3 andD later. Integration of Kerberos support into various Compaq and into" third-party products is expected.

pFExternal authentication is available in V7.3-1 and later, with support=for user-written external authentication in V7.3-2 and later.>

tCIf you are simply looking for OpenVMS access and the SYSTEM and allSection 5.6 and/or the OpenVMS documentation set.

7Also please see thes2NCSC C2 guidelines in the OpenVMS security manual.l

r


 i pl n  m
PreviousNextContentsIndex

 

n#e6rbtrap status values can:often be decoded using either of the following techniques:

   r

"
/a>

 

V#i6ieerror message:

 

"
4%BACKUP-E-INVRECTYP, invalid record type in save set




Dand the upgrade will fail. Acquire and applyIS DISK$WEB3  .2CB(y筗HH B)_FILES.DIR;BEAVIS DISK$WEB3 .2CB(y筗II H$!DESCRIP_KPC.HTML;BEAVIS DISK$WEB3 .2CB(y筗JJ G#"II_COE_FAQ.HTML;BEAVIS DISK$WEB3 .2CB(y筗KK E!!FEEDBACK.HTML;BEAVIS DISK$WEB3  .2CB(y筗筗 筗 A/KL hM  fB.HTDOCS.SOLUTIONS.GOVERNMENT.COE'ICDANDSOW.DOC;BEAVIS DISK$WEB3 .2CB(y筗 B"MAGE55.GIF;BEAVIS DISK$WEB3 .2CB(y筗 A"NDEX.HTML;BEAVIS DISK$WEB3 .2CB(y筗 K'!KPC_CERTIFICATE.PPT;BEAVIS DISK$WEB3 .2CB(y筗 D %PROGRAM.HTML;BEAVIS DISK$WEB3 .2CB(y筗 F"!LEFT-LOCAL.INC;BEAVIS DISK$WEB3 .2CB(y筗 L(!OVMS_726C1_NF_RN.PDF;BEAVIS DISK$WEB3 .2CB(y筗 E!'3_RTL_LIB.PDF;BEAVIS DISK$WEB3 .2CB(y筗 ?-STR.PDF;BEAVIS DISK$WEB3 .2CB(y筗 [7&ALPHA_V726C2_COE_PATCH_CL_RPVAC.PDF;BEAVIS DISK$WEB3 .2CB(y筗 C!SKYDIVE.JPG;BEAVIS DISK$WEB3 .2CB(y筗 ;!X.X;BEAVIS DISK$WEB3 .2CB(y筗