26 Mar
2002
26 Mar
'02
11:16 p.m.
As an aside to the current VMS discussion, does anyone know
of an equivalent to the Unix "su -" command for VMS?
Basically I'd like to be able to use my "normal" AL account
for messing about with but occasionally "su" to SYSTEM to get
at a protected file or directory. All the FAQs and manual pages
I've come across so far point to SPAWNing a new process and then
changing the privileges (eg SET PROC/PRIV=SYSPRV), which defeats
the object of the exercise since the "AL" account needs system
privileges in order to do the SET PROC/PRIV in the first place :-)
At the moment I'm using an ST running UNITERM hooked up to a
3100/30's console port so I'm stuck with just the one login session
at a time - occasionally I'd like to be able to flip over to SYSTEM
without having to mess about with logging out of AL and into SYSTEM
and back :-) Any ideas?
Cheers
Al.
27 Mar
27 Mar
2:35 a.m.
At 10:16 AM 27/03/2002 +0000, Alan Pearson wrote:
As an aside to the current VMS discussion, does anyone
know
of an equivalent to the Unix "su -" command for VMS?
There are a number of possibilities.
1) Install DECnet (for this application you don't need a licence) and then
execute the command
$ set host 0
You will get a Username: prompt and you can log in as SYSTEM. If you use
the command
$ set host 0 /log=filename
your session will get logged to the file 'filename'. This is the way I've
always solved this issue.
2) There are a number of programs (GLOGIN, BECOME are just two) which allow
you to become someone else. Generally these are used from the SYSTEM
account to "login" as another user.
3) I suspect that someone will have created a SU program as well - this
isn't too hard to write (not that I'm volunteering).
Hope this helps.
Huw Davies | e-mail: Huw.Davies(a)kerberos.davies.net.au
| "If God had wanted soccer played in the
| air, the sky would be painted green"
28 Mar
28 Mar
8:52 a.m.
--- Huw Davies <Huw.Davies(a)kerberos.davies.net.au> wrote:
At 10:16 AM 27/03/2002 +0000, Alan Pearson wrote:
We used to have one back in the old days. It had to be installed
with CMKRNL so that it could poke around in the process header
space. It was VMS-version specific because it poked values into
your process header using compile-time offset constants. I remember
there was one small bit of odd behavior relating to VMS privs that
was non-intuitive, but for 99.997% of what we did, you *became* that
other user.
Very dangerous stuff. VMS will crash if you do the wrong thing when
in Kernal Mode. We had a couple of utilities that had to be rebuilt
when we updated VMS - one that did an "su" and one that worked like
"w" (telling you all about the other login processes, including what
command they were running and some other stuff that SHOW PROCESS didn't
show you).
These were written in the VMS 3.6ish days and brought along to VMS 4.x.
I could dig them out, but I doubt they were ever ported to VMS 5.x,
let alone anything "modern".
-ethan
__________________________________________________
Do You Yahoo!?
Yahoo! Movies - coverage of the 74th Academy Awards®
http://movies.yahoo.com/
As an aside to the current VMS discussion, does
anyone know
of an equivalent to the Unix "su -" command for VMS?
3) I suspect that someone will have created a SU program as well - this
isn't too hard to write (not that I'm volunteering). 
27 Mar
27 Mar
4:41 a.m.
On Wed, 27 Mar 2002, Alan Pearson wrote:
As an aside to the current VMS discussion, does anyone
know
of an equivalent to the Unix "su -" command for VMS?
At the moment I'm using an ST running UNITERM
hooked up to a
3100/30's console port so I'm stuck with just the one login session
at a time - occasionally I'd like to be able to flip over to SYSTEM
without having to mess about with logging out of AL and into SYSTEM
and back :-) Any ideas?
Is there a "screen" app for VMS? Screen allows you to use "virtual
screens" - that is have several sessions going on one terminal. You
page through them by hotkey.
Doc
7:49 a.m.
As an aside to the current VMS discussion, does anyone
know
of an equivalent to the Unix "su -" command for VMS?
Cheers
Al.
There is a utility called persona that will work on recent versions of
VMS which effectively works like su. You would need to install it with
priv's in order not to be running those priv's needed to run it in your
usual account.
PERSONA.MAR, you would need to
MACRO PERSONA.MAR
LINK PERSONA.MAR (LINK/SYSEXE on alpha, as I recall)
cut
;
.TITLE PERSONA
.IDENT /V1.0/
;
;***************************************************************************
;* *
;* COPYRIGHT ? 1997 BY *
;* MIKE RECHTMAN, ISRAEL *
;* *
;***************************************************************************
;+
; Be sure and LINK against the SYSTEM's symbol table and include LIB.MLB
; during assembly.
;-
.LIBRARY "SYS$LIBRARY:LIB.MLB"
.LINK "SYS$SYSTEM:SYS.STB" /SELECTIVE_SEARCH
.PSECT DATA,RD,WRT,NOEXE,LONG
;
; First, some useful texts -
;
CTRL1: .ASCID /Spawning subprocess under username !AS /
BANN1: .ASCID / /
BLEN1: .WORD 50.
BANN2: .ASCID / - Exit by typing LOGOUT when through... /
PROMP: .ASCID /Enter Username>/
CTRL2: .ASCID /Error during system call !AS, Aborting... /
ERRMS: .ASCID / /
ELEN2: .WORD 50.
ROUT1: .ASCID /GET_FOREIGN/
ROUT2: .ASCID /PERSONA_CREATE/
ROUT3: .ASCID /PERSONA_ASSUME (1)/
ROUT4: .ASCID /SPAWN/
ROUT5: .ASCID /PERSONA_ASSUME (2)/
M_DESC: .ADDRESS ROUT1 ; Pointer to current routine name
;
; Save some space for the username -
;
P_DESC: .ASCID / /
; Space to save who we want to become
; _MUST_ be valid username
U_DESC: .ADDRESS P_DESC
;
; These two LONGS hold the PERSONA data
;
PERS: .LONG 0 ; Who we want to be
ME: .LONG 1 ; Who we are now
.PSECT CODE,RD,NOWRT,EXE,BYTE
.ENTRY PERSONA,^M<>
10$:
; MOVAB ROUT1,M_DESC ; Done at initialization
PUSHAL PROMP
PUSHAL P_DESC
CALLS #2,G^LIB$GET_FOREIGN ; Get required username
BLBS R0,20$ ; of not OK, then
BRW 100$ ; jump to error - message
20$:
MOVAB ROUT2,M_DESC
$PERSONA_CREATE_S PERSONA=PERS,-
USRNAM=P_DESC ; Setup to change
BLBS R0,30$
BRW 100$
30$:
MOVAB ROUT3,M_DESC
$PERSONA_ASSUME_S PERSONA=PERS,-
FLAGS=#7 ; Change username
BLBS R0,40$
BRW 100$
40$:
$FAO_S CTRSTR=CTRL1,-
OUTBUF=BANN1,-
OUTLEN=BLEN1,-
P1=U_DESC
PUSHAB BANN1 ; Print msg
CALLS #1,G^LIB$PUT_OUTPUT ; ...
PUSHAB BANN2 ; Print another msg
CALLS #1,G^LIB$PUT_OUTPUT ; ...
50$:
MOVAB ROUT4,M_DESC
CALLS #0,G^LIB$SPAWN ; Create a sub-process
BLBS R0,60$
BRW 100$
60$:
MOVAB ROUT5,M_DESC
$PERSONA_ASSUME_S PERSONA=ME,-
FLAGS=#7 ; Revert to being ourselves
99$:
$EXIT_S R0
100$:
PUSHL R0
$FAO_S CTRSTR=CTRL2,- ; Format routine - name
OUTBUF=ERRMS,-
OUTLEN=ELEN2,-
P1=M_DESC
PUSHAB ERRMS ; Say there was an error
CALLS #1,G^LIB$PUT_OUTPUT ; ...
POPL R0 ; get saved status
$EXIT_S R0
.END PERSONA
--
28 Mar
28 Mar
8:33 a.m.
Ahem, ...
Paul Thompson wrote:
...
Or simply
MACRO PERSONA
LINK PERSONA
After all, that's what default file types were invented for! ;-)
The PERSONA system services appeared in VMS V6.2, so this is the minimum
version for this utility to work.
--
Andreas Freiherr
Vishay Semiconductor GmbH, Heilbronn, Germany
http://www.vishay.com
There is a utility called persona that will work on
recent versions of
VMS which effectively works like su. You would need to install it with
priv's in order not to be running those priv's needed to run it in your
usual account.
Not too much of a concern for private use, but be careful if doing so in
a sensitive environment: this can open a BIG security hole!
This utility were far better off if it would ask for a password and
compare to the SYSUAF before letting you become SYSTEM, as the
originally asked-for "su -" would do, too.
LINK PERSONA.MAR (LINK/SYSEXE on alpha, as I recall)
(from another post:)
>LINK
PERSONA.MAR (LINK/SYSEXE on alpha, as I recall)
Ooops, LINK PERSONA.OBJ
8152
days inactive
8153
days old
5 comments
6 participants
participants (6)
-
alan.pearson＠cramer.com -
Andreas.Freiherr＠Vishay.com -
doc＠mdrconsult.com -
erd_6502＠yahoo.com -
Huw.Davies＠kerberos.davies.net.au -
thompson＠mail.athenet.net