NetNews Usenet Archive 1992 #18/NN_1992_18.iso/spool/vmsnet/misc/733

Internet Message Format | 1992-08-19 | 3.3 KB

Path: sparky!uunet!stanford.edu!rutgers!cs.utexas.edu!qt.cs.utexas.edu!yale.edu!yale!gumby!destroyer!sol.ctr.columbia.edu!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!deimos.cis.ksu.edu!mccall!mccall!tp
From: [e-mail] (Terry Poot)
Newsgroups: vmsnet.misc
Subject: Re: How to boot VMS from a failed AUDIT writingRE
Message-ID: <[e-mail]>
Date: 19 Aug 92 23:50:25 GMT
References: <[e-mail]>
 <[e-mail]> <[e-mail]> <[e-mail]>
Reply-To: [e-mail] (Terry Poot)
Organization: The McCall Pattern Co., Manhattan, KS, USA
Lines: 53
Nntp-Posting-Host: mis1
Nntp-Posting-User: tp


In article <[e-mail]>, [e-mail]
writes:
>Terry Poot complains that the default configuration of the audit server makes
>the system unbootable if the audit log fills.
>
>This is really due to the DoD!  ...

Thanks for the explanation. I'll grant that it has to start up in an
out-of-the-box system. But DEC could have made it easier and more obvious to get
rid of it for us non DOD types.

In article <[e-mail]>, [e-mail] (Donald L. Nash) writes:
>>A much more effective command which will prevent the problem from
>>reoccuring is set audit/server=stop, preferably in the system startup
>>procedure.
>
>I found out how to keep the audit server from ever starting up in the
>first place.  In the SYSMAN STARTUP database STARTUP$STARTUP_VMS, there
>is a file called VMS$CONFIG-050_AUDIT_SERVER.COM.  Disable this file (on
>all nodes, if you're in a cluster), and the audit server will never
>start.

That's pretty good, but...

>You just need
>to remember to do it every time you upgrade VMS (oops, I mean OpenVMS :-).

That isn't good at all. My method "set audit/server=exit" is permanent, if less
clean (I get audit server starting and stopping messages on each node).

DEC could have followed their existing precedents, by providing a logical name
that could be set in systartup_v5 (I could even live with it sysecurity) by
putting a commented out definition of that logical name with a comment block in
the template file that they ship. Since it'd only be looked at at system startup
time, it certainly wouldn't be a security hole.

When you set up a new system (or do an upgrade), you go through the templates as
a matter of course. If it were there, many more people would see it and read the
comments and realize that there this was something they needed to think about.
The comments could direct them to the docs. For examples, look at the current
systarup_v5.template (I'm on 5.5) and notice the logicals DECW$IGNORE_DECNET and
DECW$IGNORE_DECWINDOWS.

I know I certainly would have seen it there, and if the warning next to it were
sufficiently clear, I'd have done something about it. You don't even have to be
clear if you are ominous enough. Something like "if the auditserver starts, it
can take your system down in ways difficult to repair, so you'd better read up
on it in the security manual." would scare me enough to send me to the doc set!
--
Terry Poot <[e-mail]>                   The McCall Pattern Company
(uucp: ...!rutgers!depot!mccall!tp)          615 McCall Road
[phone], in KS [phone]           Manhattan, KS 66502, USA