f- OpenVMS FAQ -&- page 7)b @5z

HP OpenVMS Systems Documentation

 q> $ť "b,
Content starts here"D

The OpenVMS Frequently Asked Questions (FAQ)


 ‚ l n  
PreviousContentsIndex

m

4.8 Using w32time or an SNTP as a time provider?



BNo standards-compliant NTP or SNTP server is reportedly capable of:synchronizing with the Microsoft Windows w32time services.

GFurther, NTP clients are not generally capable of synchronizing with an SNTP server.

>Open Source (Free) NTP servers (qv: OpenNTP) are available for@Microsoft Windows platforms, and TCP/IP Services and third-partyFpackages all provide NTP servers for OpenVMS, and NTP and SNTP clients"can synchronize with these srvers.


P

Chapter 5
System Management Information


@

If you are searching for something here, please(consider using the text-format FAQ.

V

5.1 What is an installed image?



FThe term "install" has two distinct meanings in OpenVMS. TheEfirst relates to "installing a product", which is done withGeither the SYS$UPDATE:VMSINSTAL.COM command procedure or the POLYCENTERBSoftware Installation (PCSI) utility (PRODUCT command). The second!meaning relates to the use of the1 INSTALL utility, which is what concerns us here.

EThe INSTALL utility is used to identify to OpenVMS a specific copy ofGan image, either executable or shareable, which is to be given some setDof enhanced properties. For example, when you issue the SET PASSWORDCcommand, the image SYS$SYSTEM:SETP0.EXE is run. That image needs to1have elevated privileges to perform its function.

CThe other important attribute is /SHARED. This means that shareableFparts of the image (typically read-only code and data) are loaded intoGmemory only once and are shared among all users on a system. ExecutableDimages can be installed /SHARED as well as shareable library images.D(The term "shareable" has dual meanings here, too. See theBOpenVMS Programming Concepts Manual for further details.)

5It's important to note that there is no such thing asE"installing a shareable image with privileges". The INSTALLButility will let you do it, but the privileges you specify will beEignored. To have a callable routine run with enhanced privileges thatDare not available to its caller, you must construct your routines as?"user-written system services" (UWSS) and install the shareableBimage with the /PROTECT qualifier. See the OpenVMS Programming@Concepts Manual for more information on user-written systemFservices. Note also that in many cases the need to grant privileges to,an image can be replaced with the use of the="Protected Subsystems" feature that grants a rights< identifier to an image. See the OpenVMS Guide to System7 Security for information on Protected Subsystems.c

5.2 Are there any known viruses for OpenVMS?



>Viruses and worms are common on personal computers because theEoperating systems involved, such as the Microsoft MS-DOS, Windows 95,CWindows 98 and Windows ME variants, do not particularly protect theGoperating system or the file system against hostile action by programs.>Microsoft Windows NT, Windows 2000 and Windows XP do implement?protections for specific configurations and do implement memoryDprotection models, but many users of these systems choose to operateDwith full adminstrator access and thus the available protections areEentirely defeated and entirely not relevent, and any program that canFactivate itself or can cause the user to activate the code can subvertCthe operating system and take over the hardware, at which point theFmalicious code can do most anything it wishes, including hiding copiesAof itself in other programs or in the file system, redistributingGitself via mail, IM, or network connections, or can be used as a zombie$in staging attacks on other systems.

BThis is less likely with multi-user systems such as OpenVMS, Unix,>Linux, MVS and other platforms for various reasons. First, theFoperating system runs in a privileged mode in memory that is protectedGagainst modification by normal user programs. Any program cannot simplyFtake over the hardware as it can on operating systems without securityFand particularly without memory page protections. Secondly, multi-userCsystems can be set up so that non-privileged programs cannot modify>system programs and files on disk, and this is normal for mostEinstallations. Both of these protection schemes mean that traditionalFviral infections don't work on these OSes. Third, typical applications@and configurations tend to prevent the uncontrolled execution ofFuntrusted code as part of received mail messages or web access; one ofFthe central vulnerabilities of the Microsoft Windows platform involvesAits intentionally easy ability to dynamically (and transparently)Cactivate code and macros that are embedded within mail messages andwithin data files.

AIt is possible for OpenVMS and other multi-user systems to becomeFinfected by viruses or worms, but to do so, the program containing theGvirus must be run from a user account that has amplified privileges. So=long as the system administrator is careful that only trustedBapplications are run from such accounts (and this is generally theGcase) and so long as there are no OpenVMS system security breaches (due@to malicious operator activity, OpenVMS errors, or errors withinEtrusted and privileged product packages) there is no of modificationsFto the operating system or other protected files from the virus or theworm.

EThe FAQ maintainer is aware of a few (and very old) DECnet worms thatFhave affected OpenVMS systems on DECnet networks ("WANK" wasEone), but is aware of no OpenVMS viruses that are loose in the field.

GTo protect against viruses and other attempts at system interference orEmisuse, please follow the security recommendations in the OpenVMSGGuide to System Security. Additionally, you will want to keep yourFOpenVMS ECOs current and you will want to apply all mandatory ECO kitsand any security MUPsG for OpenVMS and OpenVMS products, and you will want to keep to OpenVMSB releases with Prior Version Support (PVS) or with Current Version9 Support. (This is obviously a general system maintenance< recommendation, in addition to being a good system securityH recommendation---new security features and capabilities are implementedG in more recent OpenVMS releases, for instance. Details on PVS releases{ are available over in Section 5.10.6.) You may also want to considerG optional software products which can monitor your system for intrusion0 or infection attempts. Computer Associates (CA):offers various products in this area, as to other vendors.

HRocksoft offers the Veracity data integrity tool (for info, send mail to demo@rocksoft.com). MD5 tools are also available.

GTools to scan OpenVMS file systems for Microsoft Windows infections areCand have been available, including a commercial package from Sophos$, and a port of the open source ClamG Antivirus scanner at http://www.clamav.net/ cand with an OpenVMS port at 1http://fafner.dyndns.org/~alexey/clamav.zip .

FThese scanning tools are particularly useful for systems running SambaFor Advanced Server (PATHWORKS), as these servers tend to have a higherEpopulation of files intended for Microsoft Windows systems users, andFas common virus and worm attacks can find and infect files on the file'shares that these products can provide.AThese infections do not target OpenVMS itself, though the OpenVMSFserver (and any other platform and any other server capable of storingDfiles for Windows systems) can silently host files containing commonMicrosoft Windows infections.j

5.3 Sources of OpenVMS security information?



7Where can I get information on OpenVMS system security?

d

5.4 How do I mount an ISO-9660 CD on OpenVMS?



5ISO-9660 support was added in the following releases:

    
  • OpenVMS VAX V6.0
  • OpenVMS AXP V1.5


GAn add-on ISO-9660 kit was also available for OpenVMS VAX V5.5, V5.5-1,EV5.5-2, and V5.5-2H4. This requires the installation of the F11CD kitGfrom the InfoServer CD, from the Consolidated Distribution CD under theDInfoServer area, or the F11CD ECO kit. (Upgrades to V6 and later arestrongly recommended.)

ABy default, OpenVMS senses the specific type of media. If you areCworking with dual-format media---media that uses both the ODS-2 andFISO-9660 formats on the same CD-ROM---then MOUNT will first detect andBthen default to the ODS-2 format. If you wish to override this and;explicitly mount the media using ISO-9660, use the command:

 

"
9$ MOUNT/MEDIA_FORMAT=CDROM  device-name[:] [volume-label]




EIn most circumstances, you will not need nor will you want to includeAan explicit /MEDIA_FORMAT specification. For further information,Gplease refer to the OpenVMS MOUNT Utility Manual. Particularly note theEinformation on the MOUNT /MEDIA_FORMAT and /UNDEFINED_FAT qualifiers.

BThe MOUNT /UNDEFINED_FAT qualifier is of interest because ISO-9660Fmedia can be mastered on a wide variety of operating system platforms,Gand these platforms do not necessarily support the semantics needed forEfiles containing predefined record formats. The /UNDEFINED_FAT allowsEyou to specify the default attributes for files accessed from volumesusing the ISO-9660 format.

+An example which works for most CD-ROMs is:

 

"
C$ MOUNT/MEDIA_FORMAT=CDROM/UNDEFINED_FAT=STREAM:2048 DUA0: FREEWARE




EThis particular MOUNT command forces access to the CD-ROM media usingFthe ISO-9660 volume structure, and the use of the MOUNT /UNDEFINED_FAT3qualifier causes any file whose file attributes areG"undefined" to be returned with "stream" attributes"with a maximum record length 2048.

DOn OpenVMS, the ISO-9660 format is (internally) considered to be theFODS-3 file structure, while the High Sierra extensions to the standard=are considered to be the ODS-4 file structure. The Rock Ridge2extensions are not currently available on OpenVMS.

EFor details on ODS-1 and ODS-2 file specifications, see Kirby McCoy'sFVMS File System Internals Manual (published by Digital Press,'but potentially out of print), and see:

g

5.5 How do I extract the contents of a PCSI kit?



?A growing number of OpenVMS products are being provided in PCSIE(POLYCENTER Software Installation) kits which are installed using theEPRODUCT INSTALL command. These are alternatives to or replacement forCVMSINSTAL kits which were BACKUP savesets. PCSI kits are not BACKUP<savesets and are structured differently from VMSINSTAL kits.

>If you want to extract product files from a PCSI kit, create aEdirectory into which the kit should be expanded and use the followingcommand:

 

"
4$ PRODUCT COPY prodname /SOURCE=[where-the-kit-is] -3    /DEST=[destination-directory] /FORMAT=REFERENCE




?A PCSI kit file has a file specification of the following form:

 

"
#DEC-VAXVMS-FORTRAN-V0603-141-1.PCSI




FIn this example, "FORTRAN" is the "prodname". PCSI<will expand the kit files into the directory you specify andGsubdirectories beneath such as [SYSEXE], [SYSLIB], etc., reflecting theEeventual destination of files found there. Most of the actual productDfiles (images, etc.) will be in the subdirectories. In the top-levelAdirectory will be a file with the file type PCSI$DESCRIPTION thatBspecifies where various files should go. For more details, see the:POLYCENTER Software Installation Developer's Guide forDOpenVMS, which can be found in the OpenVMS documentation on the)Consolidated Online Documentation CD-ROM.e

5.6 Emergency (Conversational) System Startup?



AIf you need to perform system management operations on an OpenVMSGsystem and cannot access the system through normal means---the passwordsFon the SYSTEM username was forgetten and no other privileged usernamesCare available, or one or more core system product authorization keyuB(PAK) software licenses are unavailable or expired---then you must/perform a conversational (emergency) bootstrap.i

<Here are the steps:a

    tG
  1. Halt the system. Exactly how this is done depends on the specific"E system model: Depending on the model, this can involve pressing theiH [HALT] button, entering [CTRL/P] on the console,8 or pressing the [BREAK] key on the console.C
  2. At the console prompt, use a console command to boot into theiASYSBOOT utility. (SYSBOOT allows conversational changes to system=Aparameters.) (The console syntax for the conversational bootstrappBvaries by system model and by system architecture---this typicallyinvolves specifying a flag with the lowest bit set. See Section 14.3.5 Gfor related details.) For example:
    On VAX, use one of the following Hthree commands depending on the particular model of VAX system involved:

    l 

    "
    B/R5:1B/1Q@GENBOO/
    
    t
    
    On Alpha: 

    = 
    n
    "
    b -flags 0,1
    
    d
    K
    If your system has a non-zero system root (such as root SYSE, shown H here), you will have to use a console command such as the following:
    On VAX:>

    a 
    >
    "
    B/E0000001
    B/R5:E0000001n3@<console media procedure name varies widely>N
    
    r
    
    On Alpha: 

    e 
    c
    "
    b -flags e,1
    
    
    J
    On the IA-64 architecture systems, you can establish and manage anA EFI boot alias for a conversational bootstrap as discussed inP´ Section 14.3.5.1 and in Section 14.3.10, or you can use VMS_LOADER.EFI@interactively as shown here. Of the core mechanisms discussed in_Section 14.3.5.1, the following uses an EFIoE Shell command to perform a conversational bootstrap of root SYSE viaoG the partition device fsn:. There are alternative mechanisms available.x

    / 
    e
    "
    &fsn:\efi\vms\vms_loader.efi -flags e,1
    
    e
    E
    If your Alpha system has a hardware password (various systemsoI support a password that prevents unauthorized access to the console),oH you will need to know theis password and will need to enter it usingH the LOGIN or similar command at the console. If you get an "Inv Cmd"oH error trying to perform a conversational bootstrap, and you do not haveE the hardware console password for the console LOGIN command, you areSE stuck---you will need to call for hardware service for assistance in D resetting the hardware console password. The implementation and the< syntax used for the console password mechanism does vary by implementation.F

  3. Once at the SYSBOOT prompt, request that OpenVMS read the systemD startup commands directly from the system console, that the windowC system (if any) not be started, and that OpenVMS not record thesea= particular parameter changes for subsequent system reboots:a

    f 
    h
    "
    SET/STARTUP OPA0:iSET WINDOW_SYSTEM 0wSET WRITESYSPARAMS 0CONTINUE
    
    l
    H

  4. At the $ prompt, the system will now be accepting startup commandsA directly from the console. Type the following two DCL commands:r

     
    g
    "
    $ SPAWNm$ @SYS$SYSTEM:STARTUPe
    
    m
    H

  5. You should now see the dollar ($) prompt of DCL.
    The result ofG these two commands will be the normal system startup, but you will bedA left logged in on the console, running under a fully privilegedsI username. Without the use of the SPAWN command, you would be logged outmG when the startup completes.
    Perform the task(s) required, such ass? resetting the password on the SYSTEM username as described ina} Section 5.6.1 or registering one or more license product authorizationma keys (PAKs) as described in Section 5.6.2. D
  6. Once you log out of this session, the system will complete theH startup and can be used normally. You can choose to reboot the system, but that is not necessary.
s

iASome system managers will suggest a method using the UAFALTERNATEmAsystem parameter rather than the SET/STARTUP OPA0: command shown.oFThis approach is not always available and is accordingly less commonlyCrecommended, as there can easily be an alternate user authorizationvDdatabase (SYS$SYSTEM:SYSUAFALT.DAT) configured on the system. With aGsystem manager that has configured an alternate SYSUAFALT.DAT file, theiBUAFALTERNATE method will fail---well, assuming you do not know theApassword of a privileged username stored within SYSUAFALT.DAT, of,course.e

sFThe UAFALTERNATE system parameter is used to trigger what is sometimesknown as the console backdoor.DThe OPA0: system console is critical to system operations and systemDsecurity, and will allow access when the SYSUAF system authorizationDdatabase is unavailable or corrupted, when core product license PAKs;are not registered, expired or disabled (NOLICENSE errors),t. or in various other cases of system failures.DAll this is in addition to the role of the console in the display ofGcertain system-critical event messages. Access to the OPA0: consoletBhas a security exposure that is equivalent to direct access to thesystem hardware.c

eAWhen LOGINOUT detects an error (such as a SYSUAF corruption, by a Dmissing SYSUAF, missing product licenses, or other trigger), it willBprevent access to the OpenVMS system from all terminals except thesystem console.yBThe OPA0: system console will be allowed access, and the resultingCprocess will be fully privileged. Resetting the UAFALTERNATE systemwFparameter---in the absence of an alternate SYSUAF system authorizationFdatabase---will cause the console backdoor to be opened simply becauseLOGINOUT cannot locateCSYS$SYSTEM:SYSUAFALT.DAT. When the authorization database cannot beM6located, access will be granted from the console only.

yEFor further information on emergency startup and shutdown, as well asaBfor the official OpenVMS documentation on how to change the SYSTEMEpassword from the console in an emergency, please see the OpenVMSn>System Manager's Manual in the OpenVMS documentation set.

p@For information and recommendations on setting up OpenVMS system6security, please see the NCSC Class C2 appendix of the<Guide to OpenVMS System Security manual, also in the OpenVMSdocumentation set.

eEYou can also use the conversational bootstrap technique shown earliersD(the steps until SET/STARTUP) to alter various system parameters, aswell. At the SYSBOOT,prompt, you can enter new parameters values:

P 
t
"
SHOW MAXPROCESSCNTSET . 64CONTINUE

e


dFThe [.] is a shorthand notation used for the last parameter#examined within SYSGEN and SYSBOOT.eW

5.6.1 I've forgotten the SYSTEM password - what can I do?

i

h@If you have forgotten or do not have the password for the SYSTEMGusername, you must perform the conversational bootstrap as described in4tSection 5.6, and must enter the following commands once you havereached the dollar ($) prompt:

m 
k
"
@$ SET DEFAULT SYS$SYSTEM:  ! or wherever your SYSUAF.DAT resides$ RUN SYS$SYSTEM:AUTHORIZE#MODIFY SYSTEM /PASSWORD=newpasswordiEXIT

a


7You have now reset the password on the SYSTEM username.uU

5.6.2 My product licenses have expired - what can I do?

p

cFIf you have a system with no licenses for OpenVMS or for OpenVMS usersCand thus cannot log into the OpenVMS system normally, you should be"Cable to log into the console serial terminal---this is the terminalh;device known as OPA0:---and perform the commands necessary.g

EFor systems that are not configured with an accessable console serialGterminal---as can be the case with how some DECwindows workstations aresDconfigured---you must log in over the network or from a local serialEconnection. If you cannot log in over a network connection (SET HOST,aGtelnet, etc) or from another local serial terminal connection, you will Ahave to halt the system and perform a conversational bootstrap asesdescribed in Section 5.6. You must then enter licensing-relatedmEcommands once the conversational bootstrap has reached the dollar ($)cprompt.o

oAUse the following DCL command to invoke a menu that allows you tor7manage and to register new or replacement license PAKs:u

l 
c
"
$ @SYS$UPDATE:VMSLICENSE

k


?You have now registered the license PAKs. Direct use of the DCL9GIf you wish to connect a serial console on your DECwindows workstation,S please see Section 14.3.3.3, Section 14.3.6, Section 11.10, and Section 14.17.

r{For information on troubleshooting DECwindows, please see Section 11.5.yn

5.7 How do I change the node name of an OpenVMS System?



oFThe first step is to get a BACKUP of the system disk before making anyDchanges---use the system disk backup procedures as documented in theGOpenVMS System Management Manual, making sure to use the procedures and>)commands appropriate for the system disk.]

eGChanging the node name involves a number of steps---the node name tendswEto be imbedded in a number of different data files around the system.p

    I
  • Update the SCSNODE in MODPARAMS.DAT, and then run AUTOGEN as far as/+ the SETPARAMS phase. (Do not reboot yet.)D
  • Modify the DECnet node name. (NETCONFIG is the DECnet Phase IV3 tool, and NET$CONFIGURE is the DECnet-Plus tool.)aB
  • Modify the host node name on the various queues in the queueH database. (each queue has a host name, and it defaults to the SCS nodeI name of the queue's host system. See the command INIT/QUEUE/ON=node for G information.) Site-specific startup command procedures can explicitlyiI specify the (local or even the current) node on the /ON parameter in ang INIT/QUEUE/START/ON= command.>E
  • Modify the node name saved in any application databases, or anyNG local node-conditional operations present in the site-specific systemhJ startup, etc. (SEARCH for the node name, specifying all types of files.)G
  • Use the AUTHORIZE utility command RENAME/IDENTIFIER to rename theeH SYS$NODE_oldnodename rightslist identifier to match the new node name.G (Do not change the binary value of this identifier, and do not deletehG the identifier.)
    If you have erroneously deleted or duplicate thedI identifier, you can locate existing references to the binary identifiertE value using the Freeware DFU package, and specifically the commands@ SEARCH/ACE and /OWNER. You must (re)create the correctly-namedC identifier using the binary value that is often stored in various>! Access Control List Entry (ACE)mDstructures and object owner fields associated with files and objectspresent in the OpenVMS system.H
  • Reset any license PAKs that are restricted to the old node name to the new node name.}
  • If the node name is part of a disk volume label, see Section 5.13./@
  • Reboot the node or---if in a VMScluster---reboot the whole; VMScluster. (This tends to catch any errors immediately.)xF
  • Modify the IP node name. (The TCP/IP Services tool is UCX$CONFIGF prior to V5.0, and is TCPIP$CONFIG in V5.0 and later releases.) NoteI that TCP/IP Services ties the IP host name to the current SCSNODE valuec within itsBUCX$CONFIGURATION.DAT or TCPIP$CONFIGURATION.DAT database. Thus ifDSCSNODE is changed, the IP host name reconfiguration must occur, andBthe required reconfiguration can occur only after a system reboot.@Accordingly, it is best to perform the TCP/IP Services host name&reconfiguration step after the reboot.


eEThere are likely a few other areas where the nodename will be stored. GLocal procedures and data files are one such example, and various sitesaFwill have the system name loaded in the operator control panel via theDOCP_TEXT console environment variable available at the SRM prompt onsome Alpha systems is another.

i:If the system is configured in a VMScluster and you changeFeither the SCSNODE or the SCSSYSTEMID---but not bothvalues---then you;Dwill have to reboot the entire VMScluster. (The VMScluster remembers<the mapping between these two values, and will assume that aCconfiguration problem has occured if a mismatched pair appears, andtFwill refuse to let a node with a mismatched pair join the VMScluster.)

.ETo calculate the correct SCSSYSTEMID value, multiply the DECnet PhasepDIV area number by 1024, and add the DECnet Phase IV node number. ForFexample, the SCSSYSTEMID value for a DECnet node with address 19.22 is!19478. ((19 * 1024) + 22 = 19478)>

CThis may well have missed one or two configuration tools (or more!)Dthat are needed at your site---the node name tends to get stored all=over the place, in layered products, and in local software...d

m•Also see Section 15.6.3 and Section 15.6.4. o

p


 ‚ i l n  e
PreviousNextContentsIndex

 

f#i6ne