=;The OpenVMS Frequently Asked Questions (FAQ)D

The OpenVMS Frequently Asked Questions (FAQ)



 r \ ^  
PreviousContentsIndex




P

Chapter 5
System Management Information


A

If you are searching for something here, please (consider using the text-format FAQ.

V

5.1 What is an installed image?



GThe term "install" has two distinct meanings in OpenVMS. The Ffirst relates to "installing a product", which is done with Heither the SYS$UPDATE:VMSINSTAL.COM command procedure or the POLYCENTER CSoftware Installation (PCSI) utility (PRODUCT command). The second !meaning relates to the use of the1 INSTALL utility, which is what concerns us here.

FThe INSTALL utility is used to identify to OpenVMS a specific copy of Han image, either executable or shareable, which is to be given some set Eof enhanced properties. For example, when you issue the SET PASSWORD Dcommand, the image SYS$SYSTEM:SETP0.EXE is run. That image needs to 1have elevated privileges to perform its function.

DThe other important attribute is /SHARED. This means that shareable Gparts of the image (typically read-only code and data) are loaded into Hmemory only once and are shared among all users on a system. Executable Eimages can be installed /SHARED as well as shareable library images. E(The term "shareable" has dual meanings here, too. See the BOpenVMS Programming Concepts Manual for further details.)

5It's important to note that there is no such thing asF"installing a shareable image with privileges". The INSTALL Cutility will let you do it, but the privileges you specify will be Fignored. To have a callable routine run with enhanced privileges that Eare not available to its caller, you must construct your routines as @"user-written system services" (UWSS) and install the shareableCimage with the /PROTECT qualifier. See the OpenVMS Programming AConcepts Manual for more information on user-written system Gservices. Note also that in many cases the need to grant privileges to ,an image can be replaced with the use of the="Protected Subsystems" feature that grants a rights= identifier to an image. See the OpenVMS Guide to System 7 Security for information on Protected Subsystems.c

5.2 Are there any known viruses for OpenVMS?



?Viruses and worms are common on personal computers because the Foperating systems involved, such as the Microsoft MS-DOS, Windows 95, DWindows 98 and Windows ME variants, do not particularly protect the Hoperating system or the file system against hostile action by programs. ?Microsoft Windows NT, Windows 2000 and Windows XP do implement @protections for specific configurations and do implement memory Eprotection models, but many users of these systems choose to operate Ewith full adminstrator access and thus the available protections are Fentirely defeated and entirely not relevent, and any program that can Gactivate itself or can cause the user to activate the code can subvert Dthe operating system and take over the hardware, at which point the Gmalicious code can do most anything it wishes, including hiding copies Bof itself in other programs or in the file system, redistributing Hitself via mail, IM, or network connections, or can be used as a zombie $in staging attacks on other systems.

CThis is less likely with multi-user systems such as OpenVMS, Unix, ?Linux, MVS and other platforms for various reasons. First, the Goperating system runs in a privileged mode in memory that is protected Hagainst modification by normal user programs. Any program cannot simply Gtake over the hardware as it can on operating systems without security Gand particularly without memory page protections. Secondly, multi-user Dsystems can be set up so that non-privileged programs cannot modify ?system programs and files on disk, and this is normal for most Finstallations. Both of these protection schemes mean that traditional Gviral infections don't work on these OSes. Third, typical applications Aand configurations tend to prevent the uncontrolled execution of Guntrusted code as part of received mail messages or web access; one of Gthe central vulnerabilities of the Microsoft Windows platform involves Bits intentionally easy ability to dynamically (and transparently) Dactivate code and macros that are embedded within mail messages and within data files.

BIt is possible for OpenVMS and other multi-user systems to become Ginfected by viruses or worms, but to do so, the program containing the Hvirus must be run from a user account that has amplified privileges. So >long as the system administrator is careful that only trusted Capplications are run from such accounts (and this is generally the Hcase) and so long as there are no OpenVMS system security breaches (due Ato malicious operator activity, OpenVMS errors, or errors within Ftrusted and privileged product packages) there is no of modifications Gto the operating system or other protected files from the virus or the worm.

FThe FAQ maintainer is aware of a few (and very old) DECnet worms that Ghave affected OpenVMS systems on DECnet networks ("WANK" was Eone), but is aware of no OpenVMS viruses that are loose in the field.

HTo protect against viruses and other attempts at system interference or Fmisuse, please follow the security recommendations in the OpenVMS HGuide to System Security. Additionally, you will want to keep your GOpenVMS ECOs current and you will want to apply all mandatory ECO kits and any security MUPsH for OpenVMS and OpenVMS products, and you will want to keep to OpenVMS C releases with Prior Version Support (PVS) or with Current Version : Support. (This is obviously a general system maintenance = recommendation, in addition to being a good system security I recommendation---new security features and capabilities are implemented H in more recent OpenVMS releases, for instance. Details on PVS releases l are available over in Section 5.10.6.) You may also want to consider H optional software products which can monitor your system for intrusion 0 or infection attempts. Computer Associates (CA):offers various products in this area, as to other vendors.

HRocksoft offers the Veracity data integrity tool (for info, send mail to demo@rocksoft.com). MD5d tools are also available; see Section 5.30 for details on MD5.

HTools to scan OpenVMS file systems for Microsoft Windows infections are Cand have been available, including a commercial package from Sophos$, and a port of the open source Clam7 Antivirus scanner at http://www.clamav.net/ Sand with an OpenVMS port at 1http://fafner.dyndns.org/~alexey/clamav.zip .

GThese scanning tools are particularly useful for systems running Samba Gor Advanced Server (PATHWORKS), as these servers tend to have a higher Fpopulation of files intended for Microsoft Windows systems users, and Gas common virus and worm attacks can find and infect files on the file 'shares that these products can provide.BThese infections do not target OpenVMS itself, though the OpenVMS Gserver (and any other platform and any other server capable of storing Efiles for Windows systems) can silently host files containing common Microsoft Windows infections.j

5.3 Sources of OpenVMS security information?



7Where can I get information on OpenVMS system security?

d

5.4 How do I mount an ISO-9660 CD on OpenVMS?



5ISO-9660 support was added in the following releases:



HAn add-on ISO-9660 kit was also available for OpenVMS VAX V5.5, V5.5-1, FV5.5-2, and V5.5-2H4. This requires the installation of the F11CD kit Hfrom the InfoServer CD, from the Consolidated Distribution CD under the EInfoServer area, or the F11CD ECO kit. (Upgrades to V6 and later are strongly recommended.)

BBy default, OpenVMS senses the specific type of media. If you are Dworking with dual-format media---media that uses both the ODS-2 and GISO-9660 formats on the same CD-ROM---then MOUNT will first detect and Cthen default to the ODS-2 format. If you wish to override this and ;explicitly mount the media using ISO-9660, use the command:

 

"
:$ MOUNT/MEDIA_FORMAT=CDROM  device-name[:] [volume-label] 




FIn most circumstances, you will not need nor will you want to include Ban explicit /MEDIA_FORMAT specification. For further information, Hplease refer to the OpenVMS MOUNT Utility Manual. Particularly note the Einformation on the MOUNT /MEDIA_FORMAT and /UNDEFINED_FAT qualifiers.

CThe MOUNT /UNDEFINED_FAT qualifier is of interest because ISO-9660 Gmedia can be mastered on a wide variety of operating system platforms, Hand these platforms do not necessarily support the semantics needed for Ffiles containing predefined record formats. The /UNDEFINED_FAT allows Fyou to specify the default attributes for files accessed from volumes using the ISO-9660 format.

+An example which works for most CD-ROMs is:

 

"
D$ MOUNT/MEDIA_FORMAT=CDROM/UNDEFINED_FAT=STREAM:2048 DUA0: FREEWARE 




FThis particular MOUNT command forces access to the CD-ROM media using Gthe ISO-9660 volume structure, and the use of the MOUNT /UNDEFINED_FAT 4qualifier causes any file whose file attributes are H"undefined" to be returned with "stream" attributes "with a maximum record length 2048.

EOn OpenVMS, the ISO-9660 format is (internally) considered to be the GODS-3 file structure, while the High Sierra extensions to the standard >are considered to be the ODS-4 file structure. The Rock Ridge 2extensions are not currently available on OpenVMS.

FFor details on ODS-1 and ODS-2 file specifications, see Kirby McCoy's GVMS File System Internals Manual (published by Digital Press, 'but potentially out of print), and see:

g

5.5 How do I extract the contents of a PCSI kit?



@A growing number of OpenVMS products are being provided in PCSI F(POLYCENTER Software Installation) kits which are installed using the FPRODUCT INSTALL command. These are alternatives to or replacement for DVMSINSTAL kits which were BACKUP savesets. PCSI kits are not BACKUP <savesets and are structured differently from VMSINSTAL kits.

?If you want to extract product files from a PCSI kit, create a Fdirectory into which the kit should be expanded and use the following command:

 

"
5$ PRODUCT COPY prodname /SOURCE=[where-the-kit-is] - 4    /DEST=[destination-directory] /FORMAT=REFERENCE 




?A PCSI kit file has a file specification of the following form:

 

"
$DEC-VAXVMS-FORTRAN-V0603-141-1.PCSI 




GIn this example, "FORTRAN" is the "prodname". PCSI =will expand the kit files into the directory you specify and Hsubdirectories beneath such as [SYSEXE], [SYSLIB], etc., reflecting the Feventual destination of files found there. Most of the actual product Efiles (images, etc.) will be in the subdirectories. In the top-level Bdirectory will be a file with the file type PCSI$DESCRIPTION that Cspecifies where various files should go. For more details, see the ;POLYCENTER Software Installation Developer's Guide for EOpenVMS, which can be found in the OpenVMS documentation on the )Consolidated Online Documentation CD-ROM.e

5.6 Emergency (Conversational) System Startup?



BIf you need to perform system management operations on an OpenVMS Hsystem and cannot access the system through normal means---the password Gon the SYSTEM username was forgetten and no other privileged usernames Dare available, or one or more core system product authorization key C(PAK) software licenses are unavailable or expired---then you must /perform a conversational (emergency) bootstrap.

Here are the steps:

    H
  1. Halt the system. Exactly how this is done depends on the specific F system model: Depending on the model, this can involve pressing the I [HALT] button, entering [CTRL/P] on the console, 8 or pressing the [BREAK] key on the console.C
  2. At the console prompt, use a console command to boot into theBSYSBOOT utility. (SYSBOOT allows conversational changes to system Bparameters.) (The console syntax for the conversational bootstrap Cvaries by system model and by system architecture---this typically pinvolves specifying a flag with the lowest bit set. See Section 14.3.5 Hfor related details.) For example:
    On VAX, use one of the following Hthree commands depending on the particular model of VAX system involved:

     

    "
    B/R5:1 B/1 @GENBOO 
    
    
    
    On Alpha:

     

    "
    b -flags 0,1 
    
    
    L
    If your system has a non-zero system root (such as root SYSE, shown I here), you will have to use a console command such as the following: 
    On VAX:

     

    "
    B/E0000001 B/R5:E0000001 4@<console media procedure name varies widely> 
    
    
    
    On Alpha:

     

    "
    b -flags e,1 
    
    
    K
    On the IA-64 architecture systems, you can establish and manage an B EFI boot alias for a conversational bootstrap as discussed in ” Section 14.3.5.1 and in Section 14.3.10, or you can use VMS_LOADER.EFIAinteractively as shown here. Of the core mechanisms discussed in OSection 14.3.5.1, the following uses an EFIF Shell command to perform a conversational bootstrap of root SYSE via G the partition device fsn:. There are alternative mechanisms available.

     

    "
    'fsn:\efi\vms\vms_loader.efi -flags e,1 
    
    
    F
    If your Alpha system has a hardware password (various systems J support a password that prevents unauthorized access to the console), I you will need to know theis password and will need to enter it using I the LOGIN or similar command at the console. If you get an "Inv Cmd"I error trying to perform a conversational bootstrap, and you do not have F the hardware console password for the console LOGIN command, you are F stuck---you will need to call for hardware service for assistance in E resetting the hardware console password. The implementation and the = syntax used for the console password mechanism does vary by  implementation.G

  3. Once at the SYSBOOT prompt, request that OpenVMS read the system E startup commands directly from the system console, that the window D system (if any) not be started, and that OpenVMS not record these = particular parameter changes for subsequent system reboots:

     

    "
    SET/STARTUP OPA0: SET WINDOW_SYSTEM 0 SET WRITESYSPARAMS 0 	CONTINUE 
    
    
    I

  4. At the $ prompt, the system will now be accepting startup commands A directly from the console. Type the following two DCL commands:

     

    "
    $ SPAWN $ @SYS$SYSTEM:STARTUP 
    
    
    I

  5. You should now see the dollar ($) prompt of DCL.
    The result of H these two commands will be the normal system startup, but you will be B left logged in on the console, running under a fully privileged J username. Without the use of the SPAWN command, you would be logged out H when the startup completes.
    Perform the task(s) required, such as @ resetting the password on the SYSTEM username as described in n Section 5.6.1 or registering one or more license product authorization Q keys (PAKs) as described in Section 5.6.2.E
  6. Once you log out of this session, the system will complete the I startup and can be used normally. You can choose to reboot the system,  but that is not necessary.


BSome system managers will suggest a method using the UAFALTERNATE Asystem parameter rather than the SET/STARTUP OPA0: command shown.GThis approach is not always available and is accordingly less commonly Drecommended, as there can easily be an alternate user authorization Edatabase (SYS$SYSTEM:SYSUAFALT.DAT) configured on the system. With a Hsystem manager that has configured an alternate SYSUAFALT.DAT file, the CUAFALTERNATE method will fail---well, assuming you do not know the Bpassword of a privileged username stored within SYSUAFALT.DAT, of course.

GThe UAFALTERNATE system parameter is used to trigger what is sometimes known as the console backdoor.EThe OPA0: system console is critical to system operations and system Esecurity, and will allow access when the SYSUAF system authorization Edatabase is unavailable or corrupted, when core product license PAKs ;are not registered, expired or disabled (NOLICENSE errors),. or in various other cases of system failures.EAll this is in addition to the role of the console in the display of Hcertain system-critical event messages. Access to the OPA0: console Chas a security exposure that is equivalent to direct access to the system hardware.

BWhen LOGINOUT detects an error (such as a SYSUAF corruption, by a Emissing SYSUAF, missing product licenses, or other trigger), it will Cprevent access to the OpenVMS system from all terminals except the system console.CThe OPA0: system console will be allowed access, and the resulting Dprocess will be fully privileged. Resetting the UAFALTERNATE system Gparameter---in the absence of an alternate SYSUAF system authorization Gdatabase---will cause the console backdoor to be opened simply because LOGINOUT cannot locateDSYS$SYSTEM:SYSUAFALT.DAT. When the authorization database cannot be 6located, access will be granted from the console only.

FFor further information on emergency startup and shutdown, as well as Cfor the official OpenVMS documentation on how to change the SYSTEM Fpassword from the console in an emergency, please see the OpenVMS >System Manager's Manual in the OpenVMS documentation set.

AFor information and recommendations on setting up OpenVMS system 6security, please see the NCSC Class C2 appendix of the=Guide to OpenVMS System Security manual, also in the OpenVMS documentation set.

FYou can also use the conversational bootstrap technique shown earlier E(the steps until SET/STARTUP) to alter various system parameters, as well. At the SYSBOOT,prompt, you can enter new parameters values:

 

"
SHOW MAXPROCESSCNT 	SET . 64 	CONTINUE 




GThe [.] is a shorthand notation used for the last parameter #examined within SYSGEN and SYSBOOT.W

5.6.1 I've forgotten the SYSTEM password - what can I do?



AIf you have forgotten or do not have the password for the SYSTEM Husername, you must perform the conversational bootstrap as described in eSection 5.6, and must enter the following commands once you have reached the dollar ($) prompt:

 

"
A$ SET DEFAULT SYS$SYSTEM:  ! or wherever your SYSUAF.DAT resides $ RUN SYS$SYSTEM:AUTHORIZE $MODIFY SYSTEM /PASSWORD=newpassword EXIT 




7You have now reset the password on the SYSTEM username.U

5.6.2 My product licenses have expired - what can I do?



GIf you have a system with no licenses for OpenVMS or for OpenVMS users Dand thus cannot log into the OpenVMS system normally, you should be Dable to log into the console serial terminal---this is the terminal ;device known as OPA0:---and perform the commands necessary.

FFor systems that are not configured with an accessable console serial Hterminal---as can be the case with how some DECwindows workstations are Econfigured---you must log in over the network or from a local serial Fconnection. If you cannot log in over a network connection (SET HOST, Htelnet, etc) or from another local serial terminal connection, you will Bhave to halt the system and perform a conversational bootstrap as ddescribed in Section 5.6. You must then enter licensing-related Fcommands once the conversational bootstrap has reached the dollar ($) prompt.

BUse the following DCL command to invoke a menu that allows you to 7manage and to register new or replacement license PAKs:

 

"
$ @SYS$UPDATE:VMSLICENSE 




@You have now registered the license PAKs. Direct use of the DCL Gcommands LICENSE and SHOW LICENSE and such is also obviously available.

HIf you wish to connect a serial console on your DECwindows workstation, àplease see Section 14.3.3.3, Section 14.3.6, Section 11.10, and Section 14.17.

kFor information on troubleshooting DECwindows, please see Section 11.5.n

5.7 How do I change the node name of an OpenVMS System?



GThe first step is to get a BACKUP of the system disk before making any Echanges---use the system disk backup procedures as documented in the HOpenVMS System Management Manual, making sure to use the procedures and )commands appropriate for the system disk.

HChanging the node name involves a number of steps---the node name tends Eto be imbedded in a number of different data files around the system.



FThere are likely a few other areas where the nodename will be stored. HLocal procedures and data files are one such example, and various sites Gwill have the system name loaded in the operator control panel via the EOCP_TEXT console environment variable available at the SRM prompt on some Alpha systems is another.

;If the system is configured in a VMScluster and you change Geither the SCSNODE or the SCSSYSTEMID---but not both values---then youEwill have to reboot the entire VMScluster. (The VMScluster remembers =the mapping between these two values, and will assume that a Dconfiguration problem has occured if a mismatched pair appears, and Fwill refuse to let a node with a mismatched pair join the VMScluster.)

ETo calculate the correct SCSSYSTEMID value, multiply the DECnet PhaseEIV area number by 1024, and add the DECnet Phase IV node number. For Gexample, the SCSSYSTEMID value for a DECnet node with address 19.22 is !19478. ((19 * 1024) + 22 = 19478)

DThis may well have missed one or two configuration tools (or more!) Ethat are needed at your site---the node name tends to get stored all =over the place, in layered products, and in local software...

uAlso see Section 15.6.3 and Section 15.6.4.




 r Y \ ^  
PreviousNextContentsIndex