In this section, we will explore the mechanisms and best practices for managing access control and security within the OpenVMS operating system. Ensuring that your system is secure and that access is properly controlled is crucial for maintaining the integrity and confidentiality of your data.

1. User Accounts and Privileges:

   • User Accounts: Each user on an OpenVMS system has a unique account that controls their access to system resources.
   • Privileges: Specific rights assigned to user accounts that determine what actions they can perform on the system.

2. Access Control Lists (ACLs):

   • ACLs: Lists that specify the permissions granted to users or groups for accessing files and directories.
   • Entries: Each ACL entry defines a specific permission for a user or group.

3. Security Identifiers (SIDs):

   • SIDs: Unique identifiers assigned to each user and group, used in ACLs to specify permissions.

4. Protection Codes:

   • Protection Codes: Simple mechanisms to define access permissions for files and directories using a combination of user, group, and world access levels.

To create a new user account and assign privileges, you can use the AUTHORIZE utility:

Explanation:

• SET DEFAULT SYS$SYSTEM: Changes the current directory to the system directory.
• RUN AUTHORIZE: Starts the AUTHORIZE utility.
• ADD username /PASSWORD=password /PRIVILEGES=(NETMBX, TMPMBX): Adds a new user with the specified password and privileges.
• EXIT: Exits the AUTHORIZE utility.

To set an ACL on a file, use the SET ACL command:

Explanation:

• SET ACL /ACL=(IDENTIFIER=USERNAME,ACCESS=READ+WRITE) file.txt: Grants the specified user read and write access to file.txt.

To set protection codes on a file, use the SET PROTECTION command:

Explanation:

• SET PROTECTION=(S:RWED,O:RWED,G:RE,W:RE) file.txt: Sets the protection code for file.txt where:
  • S (System): Read, Write, Execute, Delete
  • O (Owner): Read, Write, Execute, Delete
  • G (Group): Read, Execute
  • W (World): Read, Execute

Task: Create a user account named JDOE with the password welcome123 and assign the privileges NETMBX and TMPMBX.

Solution:

Task: Grant the user JDOE read and write access to the file report.txt.

Solution:

Task: Set the protection code for the file data.txt to allow the owner full access, the group read and execute access, and the world read access.

Solution:

• Mistake: Forgetting to run the AUTHORIZE utility from the system directory.

  • Tip: Always use SET DEFAULT SYS$SYSTEM before running AUTHORIZE.

• Mistake: Incorrectly specifying privileges or protection codes.

  • Tip: Double-check the syntax and available options using the HELP command.

In this section, we covered the essential aspects of access control and security in OpenVMS, including user accounts, privileges, ACLs, and protection codes. By understanding and properly implementing these mechanisms, you can ensure that your system remains secure and that access to resources is appropriately managed. In the next module, we will delve into scripting with DCL to automate and streamline various tasks on OpenVMS.