HP OpenVMS Systems Documentation
DECnet-Plus for OpenVMS
For help answering the prompts, refer to the following:
Enter the name of the base backtranslation directory. This directory is commonly called .DNA_BackTranslation.
Enter YES to create the base backtranslation directory.
Master Replica Clearinghouse
Specify the name of the clearinghouse where the master directory replicas should be created. Include any required directory information; for example, if your clearinghouse is in the root directory, you might type .MAS_CH.
If you do not specify a clearinghouse name, the parent directory's clearinghouse is used (this is the DECdns default).
Access Control Groups
Enter the names of one or more DECdns access control groups that you want to include in the access control set for the directory (or directories) you create. Using access control groups allows you to control user access to the directories by listing those users who have read, write, delete, test, and control access to directories created using decnet_register_decdns. The specified access control groups are propagated to all backtranslation soft links.
To specify more than one group name, separate them by commas. You are responsible for creating and populating any access control groups that you specify.
OSI Area Prefix
Specify the IDP (initial domain part) and preDSP (domain-specific part) value for the network. Specify either the default value (49::) or a value explicitly allocated for this network.
The format is afi:idi:predsp, where:
|afi||Two decimal digits indicating the IDP allocation authority. Press question mark (?) at the prompt to obtain a complete list of all the recognized authority format identifier (AFI) values.|
|idi||A string of decimal digits indicating the initial domain identifier (IDI) value.|
|predsp||A string of hexadecimal digits whose use might be required for this IDP. The preDSP will be prefixed to the node's local area value in the domain-specific part (DSP) of the node's network service access point (NSAP). If a predsp has not been defined for your network, do not specify a value.|
For more information on IDP and preDSP values, refer to the chapter describing how to create NSAP addresses in the DECnet-Plus Planning Guide.
The default of 49:: means that both the idi and predsp are null. When the AFI equals 49::, the network is not to be interconnected with other OSI networks.
If you specify an IDP with an AFI other than 49::, that value appears as the default the next time the prompt appears.
Enter YES to create the OSI area prefix directory.
Local Area Value
Specify the local area to use within the IDP. This is either of the following:
This function adds new members to the DECdns .DNA_Registrar access control group. The .DNA_Registrar access control group lists those users who have read, write, delete, test, and control access to all directories, objects, and soft links created using decnet_register. This group is automatically placed in the appropriate access control list for every node registered using decnet_register.
If necessary, you can also use the DECdns Control Program to add additional users and groups to individual access control lists.
To add members to the access control group, select Option 8 at the decnet_register_decdns main menu. Press the appropriate control key sequence for your platform to exit. Output is similar to the following example:
Add members to the access control group. Press Ctrl-Z when done. Enter the name of the access control group to use. The current default is "bb_ns:.biggroup". * Group name: .biggroup Enter the name of the group member to add. * Member name: .mvg460.manager
For help answering the prompt for a member name, refer to the following:
Enter the name of the member you want to add, using the format:
|node_full_name||The DECnet Phase V full name of the node on which the user has an account. This node must be registered in the namespace.|
|user_name||The account name for the user on this node.|
You can also specify members using the format:
|node_name||The Phase IV name of the node on which the user has an account. This node must be registered in the namespace, with this name as its Phase IV synonym.|
|user_name||The account name for the user on this node.|
The following example shows two members being added to the access control group, the first by specifying the node's full name, and the second by specifying the Phase IV node name. Press the appropriate control key sequence for your platform to exit.
* Member name: .Japan.Osaka.Sales.Yamamoto Adding member ".Japan.Osaka.Sales.Yamamoto" to ".DNA_Registrar" * Member name: GCsale::Obrien Adding member ".DNS$IV.GCsale.Obrien" to ".DNA_Registrar" * Member:
When you create a new namespace on an OpenVMS DECdns name server, a group called .WorldRead_Group is also created. This allows you to easily change from one namespace to another. This group allows READ and TEST access to node objects. Therefore, a node that is moving from one namespace to another can read old information from its previous namespace and move any of this information to the new namespace.
When the .WorldRead_Group is created, it contains members
LOCAL:.*... and <ns>:.*..., where
<ns> is the name of your namespace. The person
managing the namespace determines which systems (or namespaces) will
get READ and TEST access to the namespace. The namespace manager needs
to explicitly remove the members from the .WorldRead_Group if
the namespace manager does not want these members included.
18.104.22.168 Using the WorldRead_Group Access Control Group
When decnet_register_decdns is first used to set up the directories for a namespace, it checks for the existence of the .WorldRead_Group access control group. This group is generally used when multiple namespaces are in use in the network (for example, multiple DECdns namespaces, or one or more DECdns namespaces plus the local namespace). The members of this group are automatically granted read access to any created directories and objects, regardless of the namespace they are in.
Without the .WorldRead_Group access control group, users in other namespaces would need to be granted access to any appropriate directories and objects individually. Members in the .WorldRead_Group group are usually of the form namespace:.*..., where namespace is your namespace nickname (for example, ACME:.*...). Individuals can also be listed.
If decnet_register_decdns does not find the .WorldRead_Group access control group, it asks whether to create the group. If so, decnet_register_decdns does the following:
If the access control group is not created, decnet_register_decdns does not ask this question again on subsequent invocations. To have the question repeated on a later invocation, edit the decnet_register_decdns.defaults file in the login directory, find the line that contains def_worrea or nrg_def_worrea, and remove the appropriate namespace from the value list.
It is important to note that this group affects only those directories
and objects created after the group. Any directories and
objects created before the group must have the access control set (ACS)
explicitly set using the DECdns Control Program.
22.214.171.124 Removing Members from the Access Control Group
To perform this task, select Option 9 at the decnet_register_decdns main menu and the following messages appear. Press the appropriate control key sequence for your platform to exit. Output is similar to the following example:
Remove members from the access control group. Press Ctrl-Z when finished. * Member name:
For help answering the prompt, refer to the following:
Enter the name of the member you want to remove. Specify the member's name exactly as it appears when you use Option 10 to list the members of the access control group.
If the member's name was added using the format node_name::user_name, you can use this same format to remove it.
To delete all members of the group, enter an asterisk (*) at the prompt. This command re-creates the .DNA_Registrar access control group.
The following example shows two members being removed from the access control group, the first using the name as shown by Option 10, and the second using the Phase IV format. Press the appropriate control key sequence for your platform to exit. Output is similar to the following example:
* Member: .Japan.Osaka.Sales.Yamamoto Removing member ".Japan.Osaka.Sales.Yamamoto" from ".DNA_Registrar". * Member: GCsale::Obrien Removing member ".DNS$IV.GCsale.Obrien" from ".DNA_Registrar". * Member:
To perform this task, select Option 10 at the decnet_register_decdns main menu. The following messages appear:
Show members of the access control group. Press Ctrl-Z when done. Enter the name of the access control group to use. the current default is "bb_ns:.biggroup". Group name: SHOW GROUP bb_ns:.biggroup AT 05-NOV-1995:14:41:25 DNS$Members (set) = : (V) Principal = bb_ns:.mgv460.manager
Some tasks in this chapter manually register nodes in the namespace. DECnet Phase V nodes --- but not Phase IV nodes --- can automatically register themselves in the namespace when they are configured. This is called autoregistration. With this option you can enable or disable autoregistration of DECnet Phase V nodes. (Autoregistration of DECnet Phase V nodes is disabled by default.)
Although convenient, autoregistration of DECnet Phase V nodes presents a potential security risk because allowing autoregistration into a specific directory adds write access for the world (.*...) to the access control set (ACS) for that directory. Therefore, all users in the network can create child directories, objects, and soft links in that directory.
Once a node has been registered into the directory, its registration can be modified only by the node itself or by an authorized namespace manager. The security risk applies to the directory but not to the node-name objects within the directory.
If you disallow autoregistration in a directory, the namespace is more secure because only authorized users can create entries in that directory. However, node names in that directory must be registered by an authorized namespace manager.
To allow node autoregistration for a directory, select Option 11 at the decnet_register_decdns main menu. The following messages appear. Press the appropriate control key sequence for your platform to exit. Output is similar to the following example:
Allow DECnet-Plus node autoregistration in a directory. Press Ctrl-Z when done. * Directory name:
For help answering the prompt, refer to the following:
Specify the full name for the directory whose access is to be modified. This should not include a node name; for example, .Japan.Osaka.
In this example, autoregistration is enabled. Press the appropriate control key sequence for your platform to exit. Output is similar to the following example:
* Directory name: .Japan.Osaka Modifying world write access to allow node autoregistration in this directory. * Directory name:
To allow or disallow node autoregistration for a directory, select Option 12 at the decnet_register_decdns main menu. The following messages appear. Press the appropriate control key sequence for your platform to exit. Output is similar to the following example:
Allow or disallow DECnet-Plus node autoregistration in a directory. Press Ctrl-Z when done. * Directory name:
Enter the DCL logout command to terminate the subprocess and return to decnet_register.
This chapter provides information about four methods you can use to modify your network configuration:
This chapter also explains how you can create network server processes
and how to delete and disable entities on all DECnet Phase V systems.
6.1 Using the Configuration Procedure
The DECnet-Plus software provides a configuration procedure, NET$CONFIGURE.COM, that you use to set up a basic, working node. The procedure produces a set of files called NCL scripts. To modify your network, rerun your configuration procedure, make the appropriate changes, and reboot the system. This modifies the configuration scripts and makes the changes permanent.
DIGITAL recommends that you use the configuration procedure to modify your node.
NCL is a command-based tool that lets you set up, modify, and display information about any DECnet-Plus entity. You may, at times, want to manage an attribute of an entity, such as a buffer size. To perform this task, you need to use NCL to make the change interactively or you need to edit the NCL scripts produced by the configuration procedure.
You should manage your DECnet-Plus system this way only if:
NCL supports an optional initialization file and an optional key definition file:
For more information, refer to the DECnet-Plus Network Control Language Reference guide.
6.2.1 Using Interactive NCL
Interactive NCL is useful only for temporary changes to a configuration. When you make changes to the running node using NCL interactively, the changes become effective immediately, but last only until the system is rebooted. For example, you might want to monitor a set of counters for a particular entity or you might want to temporarily disable a link.
The following steps briefly explain how to use interactive NCL:
ncl> set ncl default entity node node-id
An NCL script is an ASCII file of NCL commands that sets up the network management entities. These commands reflect the configuration you specified in the configuration procedure. You can edit the script files with a text editor to make permanent changes to your configuration. You can also edit the NCL script to add features that are not covered by the configuration procedure.
create node 0 routing type endnode set node 0 routing phaseiv address = 19.5 enable node 0 routing create node 0 routing circuit csmacd-0 type = csma-cd set node 0 routing circuit csmacd-0 data link entity = - csma-cd station csmacd-0 enable node 0 routing circuit csmacd-0
The configuration procedure produces a script file for each module that it can configure. However, the configuration procedure creates more than one script file for some tasks. Therefore, manually making some changes to your configuration might require you to edit more than one NCL script. Script files have names that indicate what modules they implement.
Some common NCL scripts are:
The installation and configuration guides for your system provide full information about the configuration procedure and NCL scripts generated.
The following steps briefly explain how to edit NCL scripts:
ncl> do ncl_script_file
ncl> do sys$manager:net$nsp_transport_startup.ncl
You may also need to alter DECdns or DECdts modules and entities. Refer to DECnet-Plus DECdns Management, DECnet-Plus DECdts Management, and the installation and configuration guides for your system for this information.