(PYVMS LOGO) Python on OpenVMS

(go to: table of contents, index, list of vms_sys, prev: REVOKID, next: SCHDWK)


SCAN_INTRUSION - Scan Intrusion Database


Format:
    status = vms_sys.scan_intrusion
                (logfail_status, failed_user, job_type,
                [source_terminal], [source_node], [source_user],
                [source_addr], [failed_password], [parent_user],
                [parent_id], [flags])
Returns:
status
Condition value after return of SYS$SCAN_INTRUSION().
Arguments:
logfail_status
Reason why the user's login attempt failed - an OpenVMS condition value like SS$_NOSUCHUSER. Note that no module named 'vms_ssdef' exists.
failed_user
User name associated with the unsuccessful login attempt.
1 - 32 alphanumeric character string.
job_type
Python integer. Job types like JPI_K_BATCH are available in module 'vms_jpidef'.
source_terminal
Source terminal where the login attempt is occurring. 1 - 64 alphanumeric character string including '_' and ':'.
source_node
Name of the node from which the user's login attempt originates. 1 - 1024 characters (can be OSI full names).
source_user
User name associated with the login attempt. 1 - 32 alphanumeric character string including '$' and '_'.
source_addr
Source DECnet for OpenVMS address from which the login attempt originates. Character string - no length defined in OpenVMS VAX V6.1 system reference manual.
failed_password
Password the user entered for the login attempt. 0 - 32 characters.
parent_user
Parent process(!, not user) name of the failed login - only for failed spawn commands. 1 - 15 character string.
parent_id
Process identification of the parent process from which the login was attempted. On OpenVMS PID is represented as a Python integer.
flags
Operational instructions for the service. Bitmasks like CIA_M_NOAUDIT are available in module 'vms_ciadef.
Examples:
>>> import vms_ciadef
>>> import vms_sys
>>> 
>>> logfail_status  = 0x2c           # SS$_ABORT
>>> failed_user     = 'PY_BREAKIN'
>>> job_type        = vms_jpidef.JPI_K_NETWORK
>>> source_terminal = 'PYB0:'
>>> source_node     = 'PYBRK'        # leave off '::'
>>> source_user     = 'PY_INTRUDER'
>>> source_addr     = 'PY.BREAK.IN'
>>> failed_password = 'PY_PWD'
>>> parent_user     = None  # this is not a subprocess breakin
>>> parent_id       = None
>>> flags           = None
>>> 
>>> status = vms_sys.scan_intrusion \
...          (logfail_status, failed_user, job_type, \
...          source_terminal, source_node, source_user, \
...          source_addr, failed_password, parent_user, \
...          parent_id, flags)
>>> 
>>> print vms_sys.getmsg (status) [0]
'%SECSRV-I-SUSPECT, matching Suspect found'
>>>

$
%%%%%%%%%%%  OPCOM   1-JUN-1999 19:04:21.03  %%%%%%%%%%%
Message from user AUDIT$SERVER on HERE
Security alarm (SECURITY) and security audit (SECURITY)
 on HERE, system id: 52199
Auditable event:          Network login failure
Event time:                1-JUN-1999 19:04:20.95
PID:                      000000D7
Process name:             ZESSIN_FTA11
Username:                 ZESSIN
Terminal name:            FTA11:, PYB0:
Remote nodename:          PYBRK
Remote node id:           50592E425245414B2E494E
Remote username:          PY_INTRUDER
Status:                   %SYSTEM-F-ABORT, abort

$ show intrusion
Intrusion       Type       Count  Expiration   Source
   NETWORK      SUSPECT       1   19:09:20.95  PYBRK::PY_INTRUDER
$

@@ more SYS$SCAN_INTRUSION examples

(go to: table of contents, index, list of vms_sys, prev: REVOKID, next: SCHDWK)

01-JUN-1999 ZE.