1 JUMP
JUMP allows a user to login exactly  as another user without a password.
It  also  allows a more restricted (non-exact) impersonation of  another
user.

Use of JUMP  is  restricted  to  specific  categories  of users: Systems
Programmers, Operators and any specifically authorised users.

JUMP provides fine-grained access  specifications  and secure logging of
exact  jumps.   All users are validated against an Access List  file  to
determine any specific access to be granted or denied in addition to any
default access (e.g.  for Operators).  The Access  List  file  also  may
contain options relating to security monitoring of exact JUMP sessions.

By default, all users can JUMP to themselves.

The general syntax of the JUMP command is

  $ JUMP [username] [qualifiers]

2 Parameter
JUMP takes a single optional parameter which is a username.  This is the
username which will be  used  (after  validation)  as the target user to
which  to  change.

If no username is specified,  the  username  is defaulted to the current
username  of  the  process.   If a non-exact jump  without  username  is
specified, JUMP returns all values of items  to  those  of  the  current
username.

Only Systems Programmers and users specifically authorised in the Access
List file can jump in any manner to  a user with privileges in excess of
those defined by the logical name JUMP_MINOR_PRIVS.

2 Qualifiers
/ALL

  /ALL
  /NOALL	(Default)

Use of /ALL is restricted to Systems Programmers. It causes all "normal"
actions of a non-exact jump _and_ the action of the SETUSER qualifier.

/AUDIT

  /AUDIT	(Default)
  /NOAUDIT

By default, use of JUMP is audited  to a site-specific audit trail file.
Systems Programmers  may use /NOAUDIT to prevent auditing of  successful
jumps.

/ESCAPE_CHARACTER

  /ESCAPE_CHARACTER[=<valid escape character>]
  /NOESCAPE_CHARACTER       (Default)

When jumping EXACT, an escape character can be defined, which will cause
immediate termination of the  pseudo-terminal  process.  To generate the
escape character when logged in to the pseudo-terminal, simply hold down
the control key (Ctrl) and press the defined letter, e.g., Ctrl-K if the
letter 'K' is the defined escape character.

The following letters are the only valid escape characters:
  D,F,G,I,K,L,N,P,U,V

By default, there is no escape character.  If the qualifier is specified
without providing a specific character,  the default escape character is
the letter 'D'.

Example:  $ JUMP FRED /EXACT /ESCAPE_CHARACTER=F

/EXACT

  /EXACT
  /NOEXACT	(Default)

Login exactly as the targeted user without  a password.  This is done by
creating  a pseudo-terminal logged in as the target user.  The result is
identical to logging in as the user with the correct password.

The RECORD, SECURE_MODE and NOTIFY  qualifiers  can also be specified to
generate,  save  and  distribute  a log of the session  running  on  the
pseudo-terminal.

See also the help on the JUMP_SECURE_MODE logical name.

/LOG

  /LOG	(Default)
  /NOLOG

By default, successful jumps are  logged  to  SYS$OUTPUT.  Use /NOLOG to
change "quietly"!

/NOTIFY

  /NOTIFY
  /NONOTIFY	(Default)
  /NOTIFY=([NO]BEFORE,[NO]AFTER,[NO]INCLUDE,[NO]MAIL,[NO]OPCOM)

This qualifier is used  with  /EXACT  to  notify  specific users that an
exact jump is being performed.  Notification may be by OPCOM messages or
via  mail  messages  sent  to the users specified by  the  logical  name
JUMP_NOTIFY_MAILLIST.

  /NOTIFY=BEFORE     Issue notification before the JUMP is initiated.
  /NOTIFY=AFTER      Issue notification after the JUMP has completed.
  /NOTIFY=INCLUDE    When used with the RECORD and AFTER qualifiers,
                       include a copy of the session log with the
                       completion mail notification.
  /NOTIFY=MAIL       Issue notification via mail messages.
  /NOTIFY=OPCOM      Issue notification via OPCOM.
  /NOTIFY=EXIT_ON_MAIL_ERROR
                     Terminate JUMP when MAIL notification fails

If the NOTIFY qualifier is  specified  without any keywords, the default
keywords  are (BEFORE, AFTER, INCLUDE, MAIL, OPCOM, EXIT_ON_MAIL_ERROR).
Individual keywords may be specifically negated as required.

If NOTIFY=EXIT_ON_MAIL_ERROR is set (explicitly, or implicitly by JUMP),
NOTIFY=BEFORE  will  also  be   set   mandatorily.   This  ensures  that
identifiable  problems  with  MAILing  are flagged *before*  a  JUMP  is
performed.

See also the help on the JUMP_SECURE_MODE logical name.

/OVERRIDE_UAF

  /OVERRIDE_UAF
  /NOOVERRIDE_UAF	(Default)

Systems Programmers may use this qualifier  to set their username to one
which  is  not in the UAF when performing non-exact jumps, and  to  jump
EXACT to users who have the DISUSER flag set in the UAF.

*** WARNING!!!  Jumping /EXACT to  a  username with the DISUSER flag ***
*** set  causes the  pseudo-terminal  process  to be logged in  with ***
*** the username and UIC  of the target user,  but  ALL  other  user ***
*** profile information is that of the invoking user.  BEWARE!!!     ***
*** Avoid jumping to a DISUSERed account.  If you must do this,  use ***
*** a non-exact jump.                                                ***

/RECORD

  /RECORD
  /NORECORD	(Default)

This qualifier can be  specified  with  /EXACT  to generate a transcript
(session  log)  of the actions performed whilst JUMPed to the  specified
user.  The log file specification will be of the form

    JUMP_<user1>-<user2>.<date>_<time>

where <user1> is the username of the user executing JUMP/EXACT,
      <user2> is the username being JUMPed to,
      <date>  is the date when the jump is performed,
  and <time>  is the time when the jump is performed.

For example,  JUMP_FRED-HARRY.20010529_093113.

When jumping  in  Secure  mode  (either  /SECURE_MODE  is specified, the
JUMP_SECURE_MODE logical name is defined as "TRUE", or the Secure option
has  been  specified  in  the Access List file), the log  file  will  be
created in the directory specified by the logical name  JUMP_SECURE_DIR.
The default value of this logical name is "SYS_MANAGER:".

When not jumping in Secure  mode,  the  log  file will be created in the
directory  specified  by  the logical name JUMP_USER_DIR.   The  default
value of this logical name is "SYS$LOGIN:" (the login directory  of  the
user  executing  the  JUMP command).  A common alternative value for the
JUMP_USER_DIR  logical  name  is   "SYS$DISK:[]"  (the  current  default
directory of the user executing the JUMP command).

See also the help on the JUMP_SECURE_MODE logical name.

/SECURE_MODE

  /SECURE_MODE
  /NOSECURE_MODE	(Default)

This qualifier can be  used  with  the  EXACT  qualifier.  It causes the
equivalent action to specifying the following qualifiers:

  /SECURE_MODE /RECORD -
  /NOTIFY=(BEFORE,AFTER,INCLUDE,MAIL,OPCOM,EXIT_ON_MAIL_ERROR)

The log file will be created in a 'secure' directory.  This directory is
specified by the logical name JUMP_SECURE_DIR.

See also the help on  the  JUMP_SECURE_MODE  logical name and the RECORD
qualifier.

/SETUSER

  /SETUSER
  /NOSETUSER	(Default)

Systems Programmers may use this qualifier to change ONLY their username.

/UPDATE_UAF

  /UPDATE_UAF
  /NOUPDATE_UAF    (Default)

By default, the  non-interactive login timestamp in  the UAF is  updated
when an  EXACT JUMP is performed.   The UPDATE_UAF qualifier  will force
the interactive login timestamp also to be updated and the login failure
count to be reset to zero.

/VERSION

  /VERSION
  /NOVERSION	(Default)

Display the current version  identification  of JUMP.  If this qualifier
is  specified, any other qualifiers and parameters are ignored, and JUMP
will perform no action other than to display the version information.

2 User_Categories
There are three categories of JUMP users:

 Systems Programmers:  Users with SETPRV privilege or
                       in an implicit system UIC group.
                       Systems Programmers can target any user.

 Operators: Users with OPER privilege.
            Operators cannot target users who have more than a certain
            set of privileges unless specifically authorised to do so.

 All users who are not either Systems Programmers or Operators.
     These users can only target users for whom they have been
     specifically authorised.

2 Non-exact_jumps
Non-exact jumps simply change  characteristics  of  the current process.
Items which are changed to those of the target user are:

  UIC, Default Directory, Default Disk, LNM$GROUP.

  Username (Systems Programmers only, using the SETUSER or ALL qualifier)

Privileges and process rights are NOT changed.

Non-exact jumps  are  useful  for  allowing  Operators,  for example, to
restore user files from backup or archive tapes to the user's account.

2 Logical_Names
There are many logical  names  which  the  System Manager may define for
JUMP.  All must be defined in the SYSTEM logical name table in EXECUTIVE
mode.

NOTE: Some JUMP logical  names  define  file or directory specifications
for  JUMP files  that are secure files.  All logical names used as  part
of these specifications must also be defined in  EXECUTIVE  mode.   This
applies   to  all  logical  name  translations  for  the  specification,
including those found during  iterative  translation.   Access to secure
files will be denied if this is not so.

For example, if JUMP_SECURE_DIR is defined as "SAFE_PLACE:", the logical
name SAFE_PLACE (and  all  other  logical  names  found during iterative
translation) *must* be defined in EXECUTIVE mode.

EXCEPTION: There is one  (and  ONLY  one)  exception  to  this rule. The
           JUMP_USER_DIR  logical  name  may  be   defined  in  user  or
           supervisor  mode  by  the user.   This  allows  user-specific
           specification of the location for recorded session log  files
           for EXACT jumps when NOT in Secure mode.  NOTE, however, that
           any  explicit  System  Manager definition of JUMP_USER_DIR in
           EXECUTIVE  mode,  or  specifying  Secure  mode  will *always*
           override any user definition in outer access modes.

3 JUMP_ACCESS_LIST

The logical name JUMP_ACCESS_LIST is  the  file  specification of a file
containing  access lists to determine who is specifically authorised  to
JUMP, or prohibited from JUMPing, and to whom access is to be granted or
denied.  The file may also contain options  for  any  particular  access
list.   See  the  example  Access List file for full details of the file
format.

The default value of JUMP_ACCESS_LIST  is "SYS_MANAGER:JUMP_ACCESS.DAT".

The Access List file is OPTIONAL. JUMP does NOT support ODS-5 filenames.

3 JUMP_AUDIT_TRAIL
The logical name JUMP_AUDIT_TRAIL is the file specification of the audit
trail file for  JUMP.   This  file  contains  audit  records of all JUMP
requests  (successful and unsuccessful) except those made with /NOAUDIT.

The default value of JUMP_AUDIT_TRAIL is "SYS_MANAGER:JUMP_AUDIT.DAT".

The audit trail file is REQUIRED and  must be created before JUMP can be
run.  JUMP does NOT support ODS-5 filenames.

3 JUMP_CHAIN
The logical name JUMP_CHAIN is a string,  the only legal value for which
is  "TRUE" - all other values are treated as not "TRUE".  If  JUMP_CHAIN
is "TRUE", JUMP will allow a user to "chain" jump.  Normally, JUMP_CHAIN
would be used to prevent chaininig.

See the help for "Chaining" and the example Access List file in the JUMP
distribution for full details.

The default value of JUMP_CHAIN is "TRUE".

3 JUMP_DOUBLE_CHECK
The logical name JUMP_DOUBLE_CHECK is a string, the only legal value for
which is "TRUE" -  all  other  values  are  treated  as  not "TRUE".  If
JUMP_DOUBLE_CHECK  is  "TRUE", JUMP will ensure that when a user who  is
not a Systems Programmer or Operator attempts to use JUMP, the user must
have the JUMP_ACCESS process Rights identifier.

The default value of JUMP_DOUBLE_CHECK is "TRUE".

3 JUMP_MATCH_BOTH
This logical name is obsolete and no longer used.

JUMP requires that access list specifications for EXACT jumps explicitly
include both the calling user and the target user (wildcards allowed).

3 JUMP_MINOR_PRIVS
The logical name JUMP_MINOR_PRIVS is a string which is a space-separated
list of privileges which is the  maximum  set of privileges which may be
held by a username targeted by an Operator.  If any other privileges are
held by the username, Operators cannot jump to the user without explicit
access being granted through the Access List file.

The default value of JUMP_MINOR_PRIVS is "NETMBX TMPMBX".

3 JUMP_NOTIFY_MAILLIST
The logical name JUMP_NOTIFY_MAILLIST  is  a  string  which  is a comma-
separated  list  of  usernames  to  which  notification  by  MAIL  of  a
JUMP /EXACT session is sent. The list may contain references to  mailing
list  files  in the form @<filespec> where <filespec> is a valid OpenVMS
ODS-2 file specification.  Here are some example values for this logical
name:

  FRED
  DELORES,FRED
  @SECURE_DIR:TEAM_LEADERS.TXT
  DONNA,@MANAGEMENT_DIR:MANAGERS.LIST,ROBOCOP  ! Keep Donna in the loop.

Mailing list files must consist of  one address per line.  Address lines
must  not contain references to other mailing lists (i.e.  @<filespec>).
Comments, both full line and trailing, may  be  included  in  the  file,
starting with an exclamation mark ("!").

NOTE: JUMP checks all mail  addresses  that  are logical names to ensure
the logical names are defined securely (i.e.  /SYSTEM /EXECUTIVE).  JUMP
does  not attempt to pre-verify the validity of any mail address  before
submitting it to Callable Mail.  In Secure mode, an attempt to  mail  to
any  address  which  causes an error in Callable Mail will cause JUMP to
exit immediately.

JUMP does NOT support ODS-5 filenames.

The default value of JUMP_NOTIFY_MAILLIST is "SYSTEM".

3 JUMP_OPER_CLASSES
The logical name JUMP_OPER_CLASSES is a string which is a space-separated
list of operator message  classes  to  which  OPCOM messages generated by
JUMP  will be sent.  The valid classes are identical to those for the DCL
command REQUEST.

NOTE:  The  class  SECURITY  is   mandatory  and  is  always  implicitly
specified.  Any other classes specified will be in addition to SECURITY,
although  SECURITY  can  be  specified explicitly if  so  desired.   For
example, to direct OPCOM messages  to  operator  terminals  enabled  for
SECURITY, CENTRAL and OPER8, specify "CENTRAL OPER8".

The default value of  JUMP_OPER_CLASSES  is  "CENTRAL".  (This will send
OPCOM messages to SECURITY and CENTRAL.)

3 JUMP_SECURE_DIR
The logical name JUMP_SECURE_DIR  is  the directory specification of the
directory where log files from secure EXACT jumps will be created.

The default value of  JUMP_SECURE_DIR is "SYS_MANAGER:".  JUMP does  NOT
support ODS-5 filenames.

3 JUMP_SECURE_MODE
The logical name JUMP_SECURE_MODE is a  string, the only legal value for
which  is  "TRUE"  -  all other values are treated as  not  "TRUE".   If
JUMP_SECURE_MODE is "TRUE", the  following  qualifiers  are  mandatorily
added to the JUMP /EXACT command:

  /SECURE_MODE /RECORD -
  /NOTIFY=(BEFORE,AFTER,INCLUDE,MAIL,OPCOM,EXIT_ON_MAIL_ERROR)

It is intended for use  in  environments where exact jumps are recorded.
The  'X'  option in the Access List file can be used to override  Secure
mode.

The default value of JUMP_SECURE_MODE is "FALSE".

3 JUMP_SELF
The logical name JUMP_SELF is a  string,  the only legal value for which
is "TRUE" - all other values are treated as not "TRUE".  If JUMP_SELF is
"TRUE",  JUMP  will  allow a user to jump  to the  current  (i.e.  same)
username unless the user is explicitly prevented  from  jumping  to  the
current username in the Access List file.

If JUMP_SELF is not "TRUE",  users  cannot jump to the current username,
even if given explicit access in the Access List file.

The default value of JUMP_SELF is "TRUE".

3 JUMP_USER_DIR
The logical name  JUMP_USER_DIR  is  the  directory specification of the
directory where log files from non-secure EXACT jumps will be created.

The default value  of  JUMP_USER_DIR  is  "SYS$LOGIN:".   An alternative
value  may be, for example, "SYS$DISK:[]" to force these log files to be
created in the user's current directory.  JUMP does  NOT  support  ODS-5
filenames.

The JUMP_USER_DIR logical name may be defined in user or supervisor mode
by the user.  This  allows  user-specific  specification of the location
for  recorded session log files for EXACT jumps when NOT in Secure mode.
NOTE, however, that any explicit System Manager definition in  EXECUTIVE
mode,  or  specifying  Secure mode,  will  *always*  override  any  user
definition in outer access modes.

2 Rights_ID
To use the double check  feature  of  JUMP  to  increase the security of
checks  on authorised users, the Rightslist identifier JUMP_ACCESS  must
be created  and granted to ordinary users who are to  be given access to
JUMP.  The value of the identifier is not relevant.

If the JUMP_ACCESS Rightslist identifier  is not used, JUMP_DOUBLE_CHECK
*must* be defined to be "FALSE".

2 Access_List
The JUMP Access List  file  contains  access  lists  to determine who is
specifically authorised to JUMP, or prohibited from JUMPing, and to whom
access  is  to be granted or denied.  Lists may contain any  mixture  of
(wildcarded) usernames, (wildcarded) UICs, UIC  identifiers  and  Rights
identifiers.  Identifiers cannot be wildcarded.

Systems Programmers are validated against the Access List file, but they
are allowed access  to  all  accounts  regardless  of  whether access is
granted  or  denied.   If  access is specifically denied  to  a  Systems
Programmer, a warning is generated to this effect when the jump is made.

The JUMP Access List file may also contain options to mandatorily enable
or  disable  the  functionality   of   the  NOTIFY,  RECORD_SESSION  and
SECURE_MODE qualifiers for specific JUMP access lists.

An example Access List file is  included  in  the JUMP distribution - it
includes full details of all options and the format of the file.  Please
READ this file carefully!

Note: This file is OPTIONAL.  If the file does not exist,  all access is
considered to be unspecified.

3 Usernames_and_Identifiers
The JUMP Access List file contains access  lists made up of symbols that
can  represent usernames, UICs, UIC identifiers and Rights  identifiers.
Problems can arise when the UAF contains a username  and  an  identifier
that have the same name.  If the identifier is the UIC identifier of the
username,  there  is  no issue.  If, however, the identifier is either a
UIC identifier for a different UIC  or  a Rights identifier, there is an
ambiguity that might lead to unintended access being allowed.

To avoid ambiguity and  ensure  access  is  only granted where intended,
JUMP has adopted the following conventions.

When a username and an identifier  have  the same name, the name will be
treated  as  a  username and the identifier with the same name  will  be
ignored.  To force a name to be recognised as an identifier, rather than
a username, enclose it in square brackets.

For example, "DEVELOPMENT" will always be treated as a username.  On the
other hand, "[DEVELOPMENT]" will always be treated as an identifier.

2 Options
Options which mandatorily enable, disable or modify the functionality of
the  EXACT,  NOTIFY,  RECORD_SESSION   and  SECURE_MODE  qualifiers  for
specific  JUMP  access lists may be specified in the Access  List  file.
See the example Access List file  in  the  JUMP  distribution  for  full
details.

Chaining, i.e., JUMPing from a  process  which  is itself a JUMP pseudo-
terminal, can be prohibited with an option.  See the help for "Chaining"
and  the  example  Access List file in the JUMP  distribution  for  full
details.

2 Chaining
Chaining, i.e., JUMPing from a  process  which  is itself a JUMP pseudo-
terminal,  can  be prohibited with an option.  (See the  example  Access
List file in the JUMP distribution for full details.)

This means that once a user  has  JUMPed  to another user, further JUMPs
from  that target user's account in the current session by the  original
user can be prevented.  For example, SALLY JUMPs to  HARRY.   HARRY  has
access  to  JUMP  to EDWIN.  Setting the appropriate option will prevent
Sally from JUMPing to  EDWIN  whilst  JUMPed  to HARRY.  HARRY can still
login as HARRY and JUMP to EDWIN.

The logical name JUMP_CHAIN can also  be defined to prevent chaining for
all JUMPs by all users.

2 Facility_ID
JUMP uses a Message file  to  signal  messages.  The Message source file
specifies  a Facility ID.  This can be changed to a site-specific value.
The default value is 111.

2 Software_Versions
JUMP is written almost  entirely in  HP Pascal.   There is a  very small
Macro routine, used to parse identifiers.

JUMP supports only OpenVMS VAX, OpenVMS Alpha and OpenVMS IA64  versions
which have all of the following features:
  Pseudo-terminals
  LIB$TABLE_PARSE
  Callable MAIL

The Persona Security Block  (PSB)  and the SYSGEN parameter ARB_CONTROL,
introduced  in  OpenVMS  Alpha V7.2, are fully supported.   The  PERSONA
system services are not used.

The current version  of  JUMP  has  been  built  and  tested as follows:
  OpenVMS VAX   V7.1   (HP Pascal v5.6)
  OpenVMS Alpha V7.3-2 (HP Pascal v5.8)
  OpenVMS IA64  V8.2   (HP Pascal v5.9)

***  CAUTION: JUMP has dependencies on the underlying architecture   ***
***        (VAX, Alpha or IA64) and the version of OpenVMS.  Any     ***
***        changes to either of these REQUIRES JUMP to be re-linked. ***

Suggestions, comments, criticisms, bug reports, bug fixes ... all welcome.

2 Installation
Comprehensive  installation  instructions  can  be  found  in  the  file
INSTALL.TXT.  Refer to this file to install JUMP.

It is strongly  recommended  that  you  thoroughly  read  this HELP file
(JUMP.HLP)  and  the example Access List file  (JUMP_ACCESS.DAT)  before
installing JUMP.

2 Changes
A summary of changes in  various  versions  of  JUMP can be found in the
file CHANGES.TXT.

2 Author
The author and maintainer of JUMP is Jonathan Ridler.

JUMP is maintained on behalf of

    Information Technology Services,
    The University of Melbourne,
    Parkville, Victoria,
    AUSTRALIA, 3010.

Internet: jump-enquiries@unimelb.edu.au

COPYRIGHT NOTICE

This  software  is  COPYRIGHT  (c)  2005  Jonathan  Ridler.   ALL RIGHTS
RESERVED.   Permission  is  granted for  not-for-profit  redistribution,
provided all source code, object code and documentation remain unchanged
from the original distribution, and that all  copyright  notices  remain
intact.

2 Acknowledgements
The  author  gratefully  acknowledges  the  influence  on  JUMP  of  the
following people:

  John Wastell - first version based on John's Macro version of JUMP.
  Eric Wentz - some ideas drawn from Eric's program BECOME.
  Anthony McCracken - pseudo-terminal creation code derived from
                      Anthony's program GLOGIN.
  Jeremy Begg - secure log file code based on code supplied by Jeremy.
  Bob Beckerhof - testing of early versions and helpful suggestions.
  Hunter Goatley - some code inspired by HGLOGIN. Also, one of the best
                   OpenVMS FTP sites outside of HP! Thanks, Hunter!
  Ian Robinson - provision of facilities at the University of Melbourne
                 for continued development of JUMP. (And a great friend!)
  Others - numerous others (you know who you are) who have kindly tested,
           commented, etc.

Suggestions, comments, criticisms, bug reports, bug fixes ... all welcome.

Internet: jump-enquiries@unimelb.edu.au

2 Disclaimer
DISCLAIMER: This software is provided "AS IS".  It does NOT come with
any representations or warranties, implicit or otherwise, as to its
merchantability or fitness for any particular purpose.  The user assumes
ALL risks and responsibilities associated with installing and running
this software.

2 Version
The current version of JUMP is V5.0 2005-02-19 (19-Feb-2005).
