Document revision date: 15 July 2002
[Compaq] [Go to the documentation home page] [How to order documentation] [Help on this site] [How to contact us]
[OpenVMS documentation]

OpenVMS User's Manual

Previous Contents Index

1.3.2 Changing Your Initial Password

Log in to your account soon after it is created to change your password. If there is a time lapse from the moment your account is created until your first login, other users might log in to your account successfully, gaining a chance to damage the system. Similarly, if you neglect to change the password or are unable to do so, the system remains vulnerable. Possible damage depends largely on what other security measures are in effect. See Section 1.7 for more information on changing passwords.

1.3.3 Restrictions on Passwords

The system screens passwords for acceptability, as follows:

The system rejects any passwords that it finds in a system dictionary, that you have used before, and that are shorter than the minimum password length specified in your UAF.

1.3.4 Types of Passwords

There are several types of passwords recognized by the OpenVMS operating system:

1.3.5 Entering a System Password

Your security administrator will tell you if you must specify a system password to log in to one or more of the terminals designated for your use. Ask your security administrator for the current system password, how often it changes, and how to obtain the new system password when it does change.

To specify a system password, do the following:
Step Task
1 Press the Enter key until the terminal responds with the recognition character, which is commonly a bell.
2 Type the system password and press Enter. There is no prompt and the system does not display the characters you type. If you fail to specify the correct system password, the system does not notify you. (Initially, you might think the system is malfunctioning unless you know that a system password is required at that terminal.) If you do not receive a response from the system, assume that you have entered the wrong password and try again.
3 When you enter the correct system password, you receive the system announcement message, if there is one, followed by the Username: prompt. For example:
MAPLE - A member of the Forest Cluster

Unauthorized Access is Prohibited


1.3.6 Entering a Secondary Password

Your security administrator decides whether to require the use of secondary passwords for your account at the time your account is created. When your account requires primary and secondary passwords, you need two passwords to log in. Minimum password length, which the security administrator specifies in your UAF, applies to both passwords.

As with a single password login, the system allots a limited amount of time for the entire login. If you do not enter a secondary password in time, the login period expires.

The following example shows a login that requires primary and secondary passwords:

     WILLOW - A member of the Forest Cluster
         Welcome to OpenVMS on node WILLOW
Username: RWOODS
Password:           [Enter]
Password:           [Enter]
    Last interactive login on Friday, 11-DEC-2002 10:22

1.3.7 Password Requirements for Different Types of Accounts

Four types of user accounts are available on OpenVMS systems:

1.4 Reading Informational Messages

When you log in from a terminal that is directly connected to a computer, the OpenVMS system displays informational system messages, as shown in the following example.

WILLOW - A member of the Forest Cluster                        (1)
        Unlawful Access is Prohibited        
Username:  RWOODS
    You have the following disconnected process:               (2)
Terminal   Process name    Image name                              
VT320:     RWOODS          (none)
Connect to above listed process [YES]: NO
         Welcome to OpenVMS on node WILLOW                     (3)   
    Last interactive login on Wednesday,  11-DEC-2002 10:20    (4)
    Last non-interactive login on Monday, 30-NOV-2002 17:39    (5)
        2 failures since last successful login                 (6)
          You have 1 new mail message.                         (7)

Note the following about the example:

  1. The announcement message identifies the node (and, if relevant, the OpenVMS Cluster name). It may also warn unauthorized users that unlawful access is prohibited. The system manager or security administrator can control both the appearance and the content of this message.
  2. A disconnected process message informs you that your process was disconnected at some time after your last successful login but is still available. You have the option of reconnecting to the old process, in the state it was in before you were disconnected.
    The system displays the disconnected message only when the following conditions exist:
    In general, the security administrator should allow you to reconnect because this ability poses no special problems for system security. However, the security administrator can disable this function by changing the setup on terminals and by disabling virtual terminals on the system. (For information on setting up and reconnecting to virtual terminals, refer to the OpenVMS System Manager's Manual.)
  3. A welcome message indicates the version number of the OpenVMS operating system that is running and the name of the node on which you are logged in. The system manager can choose a different message or can suppress the message entirely.
  4. The last successful interactive login message provides the time of the last completed login for a local, dialup, or remote login. (The system does not count logins from a subprocess whose parent was one of these types.)
  5. The last successful noninteractive login message provides the time the last noninteractive (batch or network) login completed.
  6. The number of login failure messages indicates the number of failed attempts at login. (An incorrect password is the only source of login failure that is counted.) To attract your attention, a bell rings after the message appears.
  7. The new mail message indicates if you have any unread mail messages.

1.4.1 Suppressing Messages

A security administrator can suppress the announcement and welcome messages, which include node names and operating system identification. Because login procedures differ according to operating system, it is more difficult to log in without this information.

The last login success and failure messages are optional. Your security administrator can enable or disable them as a group. Sites with medium-level or high-level security needs display these messages because they can indicate break-in attempts. In addition, by showing that the system is monitoring logins, these messages can be a deterrent to potential illegal users.

1.4.2 Successful Login Messages

Each time you log in, the system resets the values for the last successful login and the number of login failures. If you access your account interactively and do not specify an incorrect password in your login attempts, you may not see the last successful noninteractive login and login failure messages.

1.5 Types of Logins and Login Classes

Logins can be either interactive or noninteractive. When you log in interactively, you enter a user name and a password. In noninteractive logins, the system performs the identification and authentication for you; you are not prompted for a user name and password.

In addition to interactive and noninteractive logins, the OpenVMS operating system recognizes different classes of logins. How you log in to the system determines the login class to which you belong. Based on your login class, as well as the time of day or day of the week, the system manager controls your access to the system.

1.5.1 Interactive Logins

Interactive logins include the following login classes:

1.5.2 Noninteractive Logins

Noninteractive logins include the following:

1.6 Login Failures

Logins can fail for any number of reasons. One of your passwords might have changed or your account might have expired. You might be attempting to log in over the network or from a modem but be unauthorized to do so. The following table summarizes common reasons for login failure:
Failure Indicator Reason
No response from the terminal A defective terminal, a terminal that requires a system password, or a terminal that is not powered on.
No response from any terminal The system is down.
No response from the terminal when you enter the system password The system password changed.
System messages:  
"User authorization failure" A typing error in your user name or password.

The account or password expired.

"Not authorized to log in from this source" Your particular class of login (local, dialup, remote, interactive, batch, or network) is prohibited.
"Not authorized to log in at this time" You do not have access to log in during this hour or this day of the week.
"User authorization failure" (and no known user failure occurred) An apparent break-in has been attempted at the terminal using your user name, and the system has temporarily disabled all logins at that terminal by your user name.

The following sections describe the reasons for login failure in more detail.

1.6.1 Terminals That Require System Passwords

You cannot log in if the terminal you attempt to use requires a system password and you are unaware of the requirement. All attempts at logging in fail until you enter the system password.

If you know the system password, perform the steps described in Section 1.3.5. If your attempts fail, it is possible that the system password has been changed. If you do not know the system password and you suspect that this is the problem, try to log in at another terminal or request the new system password.

1.6.2 Login Class Restrictions

If you attempt a class of login that is prohibited in your UAF record, your login will fail. For example, your security administrator can restrict you from logging in over the network. If you attempt a network login, you receive a message telling you that you are not authorized to log in from this source.

Your security administrator can restrict your logins to include or exclude any of the following classes: local, remote, dialup, batch, or network.

1.6.3 Shift Restrictions

Another cause of login difficulty is failure to observe your shift restrictions. A system manager or security administrator can control access to the system based on the time of day or the day of the week. These restrictions are imposed on classes of logins. The security administrator can apply the same work-time restrictions to all classes of logins or choose to place different restrictions on different login classes.

If you attempt a login during a time prohibited for that login class, your login fails. The system notifies you that you are not authorized to log in at this time.

1.6.4 Batch Jobs During Shift Restrictions

When shift restrictions apply to batch jobs, jobs you submit that are scheduled to run outside your permitted work times are not run. The system does not automatically resubmit such jobs during your next available permitted work time. Similarly, if you have initiated any kind of job and attempt to run it beyond your permitted time periods, the job controller aborts the uncompleted job when the end of your allocated work shift is reached. This job termination behavior applies to all jobs.

1.6.5 Failures During Dialup Logins

Your security administrator can control the number of opportunities you are given to enter a correct password during a dialup login before the connection is automatically broken.

If your login fails and you have attempts remaining, press the Enter key and try again. You can do this until you succeed or reach the limit. If the connection is lost, you can redial the access line and start again.

The typical reason for limiting the number of dialup login failures is to discourage unauthorized users attempting to learn passwords by trial and error. They already have the advantage of anonymity because of the dialup line. Of course, limiting the number of tries for each dialup does not necessarily stop this kind of break-in attempt. It only requires the perpetrator to redial and start another login.

1.6.6 Break-In Evasion Procedures

If anyone has made a number of failed attempts to log in at the same terminal with your user name, the system can respond as though a break-in attempt is in progress. That is, the system concludes that someone is attempting to gain illegal access to the system by using your user name.

At the discretion of your security administrator, break-in evasion measures can be in effect for all users of the system. The security administrator controls how many password attempts are allowed over what period of time. Once break-in evasion tactics are triggered, you cannot log in to the terminal---even with your correct password---during a defined interval. Your security administrator can tell you how long you must wait before reattempting the login, or you can move to another terminal to attempt a login.

If you suspect that break-in evasion is preventing your login and you have not personally experienced any login failures, contact your security administrator immediately. Together, you should attempt another login and check the message that reveals the number of login failures since the last login to confirm or deny your suspicion of break-in attempts. (If your system does not normally display the login message, your security administrator can use the Authorize utility (AUTHORIZE) to examine the data in your UAF record.) With prompt action, your security administrator can locate someone attempting logins at another terminal.

1.7 Changing Passwords

Changing passwords on a regular basis promotes system security. To change your password, enter the DCL command SET PASSWORD.

The system manager can allow you to select a password on your own or can require that you use the automatic password generator when you change your password. If you select your own password, note that the password must follow system restrictions on length and acceptability (see Section 1.3.3).

There is no restriction on how many times you can change your password in a given period of time.

The following example shows a password choice that is too short:

Old password: 
New password: 
%SET-F-INVPWDLEN, password length must be between 12 and 32 
characters; password not changed 

Previous Next Contents Index

  [Go to the documentation home page] [How to order documentation] [Help on this site] [How to contact us]  
  privacy and legal statement