From:	SMTP%"RELAY-INFO-VAX@CRVAX.SRI.COM"  8-NOV-1993 09:13:55.73
To:	EVERHART
CC:	
Subj:	Re: logging remote logins

X-Newsgroups: comp.os.vms,vmsnet.misc
Subject: Re: logging remote logins
Message-Id: <1993Nov6.060708.1@spcvxb.spc.edu>
From: terry@spcvxb.spc.edu (Terry Kennedy, Operations Mgr.)
Date: Sat, 6 Nov 1993 11:07:08 GMT
Sender: news@spcuna.spc.edu (Network News)
Organization: St. Peter's College, US
Nntp-Posting-Host: spcvxa.spc.edu
Lines: 216
To: Info-VAX@CRVAX.SRI.COM
X-Gateway-Source-Info: USENET

In article <2bcm6v$osc@saturn.haverford.edu>, dkaplan@cc.brynmawr.edu (debs) writes:
> many students here like to give out their passwords to friends at other
> colleges.  sometimes it's so they can talk with our local utility SEND 
> (we don't support any variations of talk), sometimes they want to give
> their friends access to their files, sometimes it's just for the hell of
> it.  in any case, we don't like it.

  We don't like it either...

> (also, many connections to the vax are through our appletalked and etherneted
> campus computers, dynamically addressed.  would the existence of each of
> these as a separate node, of sorts, mean that any logging i could enable 
> would grab alarms from all of these logins, as well?  meaning that everytime
> some user opened up telnet on his mac and opened a connection, it would log?)

  We implemented the LOGINOUT "callouts" code and control access with two new
identifiers - DEACTIVATED and INTERNET. If an account has the DEACTIVATED 
identifier, they're told they can't log in, no matter where the login orig-
inates. If it doesn't have the INTERNET identifier, they can't log in using
a TCP/IP connection. This works quite well, and will stop other forms of access
(like FTP) which wouldn't get caught by a SYLOGIN-style check. It also happens
*before* things like expired password processing, and works with system breakin
evasion.

  If you have legitimate TCP/IP connections, you'll have to look at the actual
host name. Note that the callouts will usually see this as an IP literal, but
it may change later on as MultiNet resolves the address and updates the info.

  You should get the LOGINOUT callouts doc (from ftp.spc.edu, in [.macro32.
savesets]loginout-hooks.zip. Also, as with any change to system code (and
especially things like LOGINOUT) you should carefully study the code you're
handed to make sure it's Ok. I did this code as a quick hack to stop a pressing
security problem - it will probably be cleaned up and made generally available
at a later time.

	Terry Kennedy		Operations Manager, Academic Computing
	terry@spcvxa.bitnet	St. Peter's College, Jersey City, NJ USA
	terry@spcvxa.spc.edu	+1 201 915 9381

callouts.mar:

	.title  CALLOUTS - LOGINOUT callouts module for SPC
	.ident  \T1.0-02\
;
; Revision history
; 31-Oct-93 - tmk - T1.0-01 - Initial coding to use LOGINOUT callouts
; 01-Nov-93 - tmk - T1.0-02 - Get PPN from UAF record if username $asctoid fails
;
	.psect  $global$, noexe, 2
;
lgi$loginout_callouts::
	.long   8				; Number of callouts
	.long	0				; General init (unused)
	.long	0				; Character cell init (unused)
	.long	0				; DECwindows init (unused)
	.long	0				; Identify user (unused)
	.long	0				; Authenticate user (unused)
	.address c.chkrest			; Check restrictions
	.long	0				; Finish up (unused)
	.long	0				; Logout processing (unused)
;
	.psect  $plit$, nowrt, noexe, 2
;
err101:	.ascid	<13><10>-
		<13>/  Your account is not active. You need to go to the /-
		/Academic Computing office/<10>-
		<13>/at 121 Glenwood Avenue and fill out a Form # 101 in /-
		/order to have your access/<10>-
		<13>/enabled. We are sorry but we cannot handle activations /-
		/over the telephone./<10><13><10>-
		<13>/                                    Academic Computing /-
		/Operations/<10><10>
;
err103:	.ascid	<13><10>-
		<13>/  Your account  is not  enabled for  Internet access.  /-
		/You need to go  to the/<10>-
		<13>/Academic Computing office at  121 Glenwood Avenue and /-
		/fill out a Form #103 in/<10>-
		<13>/order to have your Internet access enabled. We are sor/-
		/ry but we cannot handle/<10>-
		<13>/activations over the telephone./<10><13><10>-
		<13>/                                    Academic Computing /-
		/Operations/<10><10>
;
	.psect  $prwdat$, wrt, noexe, 2
;
usrval:	.long	0
	.long	0
;
denam:	.ascid	/DEACTIVATED/
deval:	.long	0
;
intnam:	.ascid	/INTERNET/
intval:	.long	0
;
attrib:	.long	0
;
contxt:	.long	0
ident:	.long	0
;
netnam:	.ascii	/_NTY/
;
	.psect  $code$, nowrt, 2
;
c.chkrest:
	.entry  callout_restrictions, ^m<>
;
; See if the username string is null (subprocesses and the debugger)
;
	movl	4(ap), r1			; Argument vector
	tstw	@116(r1)
	bneq	1$
	movl	#ss$_normal, r0			; Nobody there, assume Ok
	brw	exit
;
; Convert username to value
;
1$:	movl	4(ap), r1			; Argument vector
	$asctoid_s @116(r1), usrval, attrib
	cmpl	r0, #ss$_nosuchid		; No match?
	beql	2$				; If not, use UAF record
	blbs	r0, 4$
	brw	uaferr				; Errors are fatal
;
2$:	movl	4(ap), r1			; Argument vector
	tstl	104(r1)				; Make sure we have UAF
	bneq	3$
	brw	uaferr				; What! No UAF record???
;
3$:	movl	104(r1), r1			; Offset of UAF pointer
	movl	(r1), r1			; Indirect through LOGINOUT
	movl	24(r1), usrval			; Offset of PPN in UAF record
;
; Convert deactivated identifier name to value
;
4$:	$asctoid_s denam, deval, attrib
	blbs	r0, 5$
	brw	rdberr				; Likewise
;
; Convert internet identifier name to value
;
5$:	$asctoid_s intnam, intval, attrib
	blbs	r0, loopd
	brw	rdberr				; And again
;
; See if this user holds the deactivated identifier and punt if so
;
loopd:	$find_held_s usrval, ident, attrib, contxt
	cmpl	r0, #ss$_nosuchid		; No more identifiers?
	beql	nofndd
	blbs	r0, 1$
	brw	rdberr
1$:	cmpl	ident, deval			; Do we have a match?
	beql	foundd
	brb	loopd
;
foundd:	$finish_rdb_s contxt			; Bad user, give message
	pushab	err101
	calls	#1, g^lib$put_output
	movl	#^x0d3807c, r0			; $ssdef would be nice
	brw	exit
;
; Ok, they aren't deactivated. Is this is an Internet login?
;
nofndd:	$finish_rdb_s contxt			; Clean up from $find_held
	movl	#0, contxt
	movl	4(ap), r1			; Argument vector
	tstl	72(r1)
	beql	foundi				; No terminal is Ok
	movl	72(r1), r1
	cmpl	@4(r1), netnam			; Is this an NTY device?
	bneq	foundi
;
; It's an Internet login. Do they have the identifier?
;
loopi:	$find_held_s usrval, ident, attrib, contxt
	cmpl	r0, #ss$_nosuchid		; No more identifiers?
	beql	nofndi
	blbs	r0, 1$
	brw	rdberr
1$:	cmpl	ident, intval			; Do we have a match?
	beql	foundi
	brb	loopi
;
nofndi:	pushab	err103
	calls	#1, g^lib$put_output
	movl	#^x0d3809c, r0			; $ssdef would be nice
	brb	exit
;
foundi:	$finish_rdb_s contxt
	movl	#ss$_normal, r0
	brb	exit
	
rdberr:	movl	#^x0d38c8c, r0
	brb	exit
;
uaferr:	movl	#^x0d38044, r0
	brb	exit
;
exit:	ret
;
	.end

callouts.com:

$ macro callouts
$ link/notrace/shareable callouts+sys$system:sys.stb/sel+sys$input:/options
universal=lgi$loginout_callouts
$ copy callouts.exe sys$common:[syslib]*.*/log
$ install replace sys$share:callouts.exe
$ write sys$output ""
$ write sys$output "You also need to:"
$ write sys$output "  DEF/SYS/EXEC LGI$LOGINOUT_CALLOUTS CALLOUTS"
$ write sys$output "  MCR SYSGEN; USE ACTIVE; SET LGI_CALLOUTS 1; WRITE ACTIVE"
$ write sys$output ""
$ exit

