🚀 go-pugleaf

In article <1992Dec18.145352.16583@vax5.cit.cornell.edu>,
yqdx@vax5.cit.cornell.edu writes:

>   Lately, several users of our VAXStation 3200 have been reporting that
> when they log in, it often says "one unsuccessful attempt since last
> login."  It is not on every account, and it is not as distressing as if
> it said "10000 failed attempts"  or whatever.  However, our computer's
> address is not broadcast to the world, so we do not expect any random
> "noise."
>   It has happened enough that I am concerned.  Are there techniques for
> logging the origin of attempted logins, and/or all logins in general?
> I apologize if this is common knowledge, for I am still a novice system
> administrator.  We are currently running VMS 5.3. Any help would be greatly
> appreciated.

I personally always leave auditing enabled for failed logins and breakins. I
also have a .COM file in a batch queue that runs EVERY night, which reports the
time/terminal/userID of every failed login attempts during the previous 24
hrs... and I read this file RELIGEOUSLY.... I know when something "random" is
happening, and when it's becoming "systematic".  I have *almost* caught people
trying to break into privileged accounts... I HAVE scared them off!  <grin>

Ray
-----
Ray Harwood           |Data Basix           |Adjunct Faculty, East Campus,
Voice: (602)721-1988  |PO Box 18324         |   Pima Community College
FAX:   (602)721-7240  |Tucson, AZ 85731     |Instructor in Ada and Pascal
CompuServe: 76645,1370|AppleLink: DATA.BASIX|Internet: rharwood@east.pima.edu

In article <1992Dec21.215631.1@east.pima.edu>, I write:

> I personally always leave auditing enabled for failed logins and breakins. I
> also have a .COM file in a batch queue that runs EVERY night, which reports the
> time/terminal/userID of every failed login attempts during the previous 24
> hrs... and I read this file RELIGEOUSLY.... I know when something "random" is
> happening, and when it's becoming "systematic".  I have *almost* caught people
> trying to break into privileged accounts... I HAVE scared them off!  <grin>

Since several of you have asked for it,  I have placed this file on
min.pima.edu in the \vms\sysmgt directory under the name SECAUDIT.COM.  You
can get it there via anonymous ftp, or I'll EMail you a copy directly if you so
request.  I am compiling a list of people interested, so that as I collect
comments and suggestions for improvement, I can easily let everyone who's
interested know via EMail.

Ray
-----
Ray Harwood           |Data Basix           |Adjunct Faculty, East Campus,
Voice: (602)721-1988  |PO Box 18324         |   Pima Community College
FAX:   (602)721-7240  |Tucson, AZ 85731     |Instructor in Ada and Pascal
CompuServe: 76645,1370|AppleLink: DATA.BASIX|Internet: rharwood@east.pima.edu

In article <1992Dec22.124421.1@east.pima.edu>, I write:
> Since several of you have asked for it,  I have placed this file on
> min.pima.edu in the \vms\sysmgt directory under the name SECAUDIT.COM.  You
> can get it there via anonymous ftp  [...]

As several of you have noted, the file I placed there had no world read
access... that problem is now fixed (I am publicly humiliated now in front of
my peers!).  The offer to EMail the file still stands, in case I have somehow
still forgotten some minor yet non-trivial detail!

Ray
-----
Ray Harwood           |Data Basix           |Adjunct Faculty, East Campus,
Voice: (602)721-1988  |PO Box 18324         |   Pima Community College
FAX:   (602)721-7240  |Tucson, AZ 85731     |Instructor in Ada and Pascal
CompuServe: 76645,1370|AppleLink: DATA.BASIX|Internet: rharwood@east.pima.edu

In article <1992Dec18.145352.16583@vax5.cit.cornell.edu>, yqdx@vax5.cit.cornell.edu writes:
>   Are there techniques for
> logging the origin of attempted logins, and/or all logins in general?

Yes, and it's already being done for you, unless someone has disabled it. 

Try the ACCOUNTING command.  HELP ACCOUNTING should give you an idea of the
possibilities.  ACCOUNTING/TYPE=(LOGFAIL,PROCESS) is probably a good place to
start.  Add /FULL to get more information.  Add /SINCE=time and /BEFORE=time
to bracket a particular time period.  Add /USER=username to see entries for
just one user.  (Note that this will suppress login failure messages where no
username was recorded.)

(One thing which is not recorded, unfortunately, is the terminal server and 
port name for logins (and attempted logins) via LAT ports.)

While we're on the subject, you should do 

	$ set accounting/new

periodically, say once a day or once a week or so.  This closes out the current
accounting file (SYS$SPECIFIC:[SYSMGR]:ACCOUNTNG.DAT - note that it is not
...:ACCOUNTING.DAT) and starts a new one.  Unless you do this periodically 
you will have one giant file which will take forever to search through (unless
you have a very quiet system). 

It is almost always a good idea to back these files up to special archive tapes
which are explicitly kept forever (rather than relying on the regular system
backups) and then delete the ones that are too old to be of interest most of
the time. 

There are several manuals in the System Management portion of the VMS Extended
Documentation Set which you should read.  _Guide to VMS System Security_ and
the _VMS Accounting Utility_ manual come to mind.  Check the _System Management
Master Index_ for other references to the accounting log file. 

	--- Jamie Hanrahan, Kernel Mode Consulting, San Diego CA
drivers, internals, networks, applications, and training for VMS and Windows-NT
uucp 'g' protocol guru and release coordinator, VMSnet (DECUS uucp) W.G., and 
Chair, Programming and Internals Working Group, U.S. DECUS VMS Systems SIG 
Internet:  jeh@cmkrnl.com, hanrahan@eisner.decus.org, or jeh@crash.cts.com
Uucp:  ...{crash,eisner,uunet}!cmkrnl!jeh