HP OpenVMS Systems Documentation
OpenVMS Programming Concepts Manual
31.7 Security Auditing
Auditing is the recording of security-relevant activity as it occurs on a system. See the OpenVMS Guide to System Security for a list of all types of security-relevant activity or classes of events that are audited. The following table describes the security services that provide security auditing:
The system service SYS$AUDIT_EVENT is used to report security events to
the auditing system. It examines the settings of the DCL command SET
AUDIT to determine if an event is enabled for auditing. If the event is
enabled for alarms or audits, SYS$AUDIT_EVENT generates an audit record
and appends it to the system audit log file (or sends an alarm to a
security operator terminal) that identifies the process involved and
lists information supplied by its caller.
The operating system provides two system services that allow a process to check access to objects on the system: SYS$CHKPRO and SYS$CHECK_ACCESS. The SYS$CHKPRO service performs the system access protection check on a user attempting direct access to an object on the system; SYS$CHECK_ACCESS performs a similar check on a third party attempting access to an object. The following table describes the security services that provide access checking:
The SYS$CHKPRO and SYS$CHECK_ACCESS system services have been extended
to support auditing. The OpenVMS Guide to System Security describes how to use the
auditing function. The OpenVMS System Services Reference Manual: A--GETUAI describes how to use the two
system services. These services are described in the following sections.
The SYS$CREATE_USER_PROFILE system service returns a user profile,
using information in the rights database and the system authorization
database to generate the profile. The system services SYS$CHECK_ACCESS
or SYS$CHKPRO accept as input the profile from SYS$CREATE_USER_PROFILE.
The SYS$CHKPRO system service invokes the access protection check used by the system. The service does not grant or deny access; rather, it performs the protection check. Subsequently, an application might grant or deny access to the specified object.
To pass the input and output information to SYS$CHKPRO, use the itmlst argument, which is the address of an item list of descriptors. The SYS$CHKPRO service compares the item list of the rights and privileges of the accessor to a list of the protection attributes of the object to be accessed. If the accessor can access the object, SYS$CHKPRO returns the status SS$_NORMAL; if the accessor cannot access the object, SYS$CHKPRO returns the status SS$_NOPRIV. The SYS$CHKPRO service does not grant or deny access. The subsystem itself must grant or deny access based on the output (SS$_NORMAL or SS$_NOPRIV) from SYS$CHKPRO.
The SYS$CHKPRO service also returns an item list of the rights or privileges that allowed the accessor access to the object, as well as the names of security alarms raised by the access attempt. For information about the item codes defined for SYS$CHKPRO, see the description of SYS$CHKPRO in the OpenVMS System Services Reference Manual.
See the OpenVMS Guide to System Security for a flowchart describing how SYS$CHKPRO
evaluates an access request attempt.
The SYS$CHECK_ACCESS service performs a protection check on a third-party accessor. An example of this is a file server program that uses SYS$CHECK_ACCESS to ensure that an accessor (the third party) requesting a file has the required privileges to do so.
You pass the input and output information to SYS$CHECK_ACCESS by using the itmlst argument, which is the address of an item list of descriptors. You also pass the name of the accessor and the name and type of the object being accessed by using the usrnam, objnam, and objtyp arguments, respectively. The SYS$CHECK_ACCESS service compares the rights and privileges of the accessor to a list of the protection attributes of the object to be accessed. If the accessor can access the object, SYS$CHECK_ACCESS returns the status SS$_NORMAL; if the accessor cannot access the object, SYS$CHECK_ACCESS returns the status SS$_NOPRIV.
The SYS$CHECK_ACCESS service does not grant or deny access. The subsystem itself must explicitly grant or deny access based on the output (SS$_NORMAL or SS$_NOPRIV) from SYS$CHECK_ACCESS.
The SYS$CHECK_ACCESS service also returns an item list of the rights or
privileges that allowed the accessor to access the object, as well as
the names of security alarms raised by the access attempt. For
information about the item codes defined for SYS$CHECK_ACCESS, see the
description of SYS$CHECK_ACCESS in the OpenVMS System Services Reference Manual.
The SYS$CHECK_PRIVILEGE system service determines whether the caller has the specified privileges or identifiers. The service performs the privilege check and looks at the SET AUDIT settings to determine whether the system administrator enabled privilege auditing. When privilege auditing is enabled, SYS$CHECK_PRIVILEGE generates an audit record. The audit record identifies the process (subject) and privilege involved, provides the result of the privilege check, and lists supplemental event information supplied by its caller. Privilege audit records usually contain either the DCL command line or the system service name associated with the privilege check.
SYS$CHECK_PRIVILEGE completes asynchronously; that is, it does not wait
for final status. For synchronous completion, use the
Occasionally, you may need to write routines that implement
site-specific policies or special algorithms. The routines that you
write can either replace or augment built-in operating system policies.
This section contains instructions for replacing key operating system
security routines with routines that are specific to your site. Two
types of routines are discussed: loadable system services and shareable
This section describes how to create a system service image and how to update the SYS$LOADABLE_IMAGES:VMS$SYSTEM_IMAGES.DATA file, which controls site-specific loading of system images. These procedures update the loading of system images for all nodes of a cluster.
Currently, you can replace the following three system services with services specific to your site:
When you create the system service, you code the source module and define the vector offsets, the entry point, and the program sections for the system service. Then, you can assemble and link the module to create a loadable image.
Once you have created the loadable image, you install it. First, you copy the image into the SYS$LOADABLE_IMAGES directory and add an entry for it in the operating system's images file using the System Management utility (SYSMAN). Next, you invoke the system images command procedure to generate a new system image data file. Finally, you reboot the system to load your service.
The following sections describe how to create and load the the Get Security Erase Pattern (SYS$ERAPAT) system service.
On VAX only systems, you can find an example of the SYS$ERAPAT system
service in SYS$EXAMPLES:DOD_ERAPAT.MAR on the operating system. The
description here also applies to the Hash Password (SYS$HASH_PASSWORD)
and Magnetic Tape Accessibility (SYS$MTACCESS) system services. You can
find an example of how to prepare and load the SYS$HASH_PASSWORD
service in SYS$EXAMPLES:HASH_PASSWORD.MAR.
With the following VAX only example, use this procedure to prepare and load a system service, in this case SYS$ERAPAT:
126.96.36.199 Removing an Executive Loaded Image
With the following VAX only example, use this procedure to remove an executive loaded image; in this case, SYS$ERAPAT.EXE:
31.10.2 Installing Filters for Site-Specific Password Policies
A site security administrator can screen new passwords to make sure they comply with a site-specific password policy. (See the OpenVMS Guide to System Security for more information.) This section describes how a security administrator can encode the policy, create a shareable image and install it in SYS$LIBRARY, and enable the policy by setting a SYSGEN parameter.
Installing and enabling a site-specific password policy image requires
both SYSPRV and CMKRNL privileges.
To compile and link a shareable image that filters passwords for words that are sensitive to your site, perform the following steps:
188.8.131.52 Installing a Shareable Image
To install a shareable image, perform the following steps:
|System Service||Meaning||DCL Command||Meaning|
|SYS$CRELNM||Create Logical Name||ALLOCATE||Optionally associates a logical name with a device|
|ASSIGN||Creates a logical name and assigns an equivalence string to a specific logical name|
|DEFINE||Associates an equivalence name with a logical name|
|MOUNT||Allows the optional naming of a logical name for a disk or magnetic tape volume|
|SYS$CRELNT||Create Logical Name Table||CREATE/NAME_TABLE||Creates a new logical name table|
|SYS$DELLNM||Delete Logical Name||DEASSIGN||Cancels a logical name assignment|
|SYS$TRNLNM||Translate Logical Name||SHOW LOGICAL||Displays translations and the logical name table for a specified logical name|
|SHOW TRANSLATION||Displays the first translation found for the specified logical name|
The following sections describe various concepts you should be aware of
when you use the logical name system services. For further discussion
of logical names, see the OpenVMS User's Manual.
32.1.1 Logical Names, Equivalence Names, and Search Lists
A logical name is a user-specified character string that can represent a file specification, device name, logical name table name, application-specific information, or another logical name. Typically, for process-private purposes, you specify logical names that are easy to use and to remember. System managers and privileged users choose mnemonics for files, system devices, and search lists that are frequently accessed by all users.
An equivalence string, or an equivalence name, is a character string that denotes the actual file specification, device name, or character string. An equivalence name can also be a logical name. In this case, further translation is necessary to reveal the actual equivalence name.
A multivalued logical name, commonly called a search list, is a logical name that has more than one equivalence string. Each equivalence string in the search list is assigned an index number starting at zero.
Logical names and their equivalence strings are stored in logical name tables. Logical names can have a maximum length of 255 characters. Equivalence strings can have a maximum of 255 characters. You can establish logical name and equivalence string pairs as follows:
For example, you could use the symbolic name TERMINAL to refer to an output terminal in a program. For a particular run of the program, you could use the DEFINE command to establish the equivalence name TTA2.