To learn details on controlling LJK/Security, read one of:

• Chapter 3, Window Interface
• Chapter 4, Menu Interface
• Chapter 5, Command Interface

This chapter describes how to control LJK/Security using the DECwindows graphic user interface. For those with a DECwindows workstation available, the LJK/Security Window Interface is usually the easiest mechanism for using the software.

Descriptions of the Window Interface is divided into five sections:

• Windowing Terminology
• Context Sensitive Help
• Using the Window Interface on a New Installation
• Overview of LJK/Security Pulldown Menus
• Using the Window Interface for Day-to-Day Tasks

3.1 Windowing Terminology

• window
  In this chapter the term window means a rectangular area on the screen which has a title bar across the top and a menu bar just below it.
• dialog box
  In this chapter the term dialog box means a rectangular area on the screen which may or may not have a title bar across the top, but has no menu bar.
• mouse
  The puck usually provided to cause cursor motion on the workstation screen. In some cases a different pointing device such as a tablet and stylus or a trackball is provided, but this chapter will use the term "mouse" to refer to whatever pointing device is present.
• mouse button
  One of the buttons on the mouse used to perform operations in conjunction with cursor movement.
• click
  To depress and release a mouse button without moving the mouse between the two actions.
• drag
  To depress a mouse button, move the mouse with the button still depressed, and then release the mouse button.
• double-click
  To click a mouse button twice in rapid succession, without moving the mouse. The critical timing is that between the first release of the button and the second depression. The maximum time interval which counts as a double click defaults to 250 milliseconds (one quarter of a second), but can be modified through the DECwindows session manager.
• selection
  To click mouse button 1 on a single line within a window, or to drag mouse button 1 across a range of lines within a window. The subject lines remain highlighted in reverse video. Technically this is "primary selection".
• incremental selection
  While holding the keyboard Shift key depressed, to click mouse button 1 on a single line within a window, or to drag mouse button 1 across a range of lines within a window. The subject lines have their highlighting status reversed from what it used to be.
• secondary selection
  To drag mouse button 3 across a range of lines within a window. On color displays the subject lines will have their segments outlined for the duration of time the button is depressed. Secondary selection is used for DECwindows QuickCopy operations, a method of copying between windows without using the clipboard.
• menu
  In the simplest form, a "pulldown menu", displayed by depressing mouse button 1 on a name listed across the "menu bar" across the top of a window.
• command
  One of the selections made available in a pulldown menu.
• selecting a command
  Depressing mouse button 1 to cause a menu to be displayed, dragging the cursor down to the desired command and releasing the mouse button while it is on that command.

3.2 Context Sensitive Help

This section discusses the minimal set of actions required for a security officer to set up LJK/Security on a new system using the Window Interface. The description presumes the system manager has already installed the software using VMSINSTAL, as described in steps a-e of Section 2.2, Installation on the Master Node.

Tremendous numbers of violation reports can be generated by the DISK facility, so as a brand new user of LJK/Security you will likely have an easier time devising your initial policies if you start with the DISK facility disabled. Enable the DISK facility again after you are happy with results from the rest of your policy.

3.3.1 Starting LJK/Security

To run at a workstation entirely in a terminal emulator window without using the Window Interface, use the qualifier /INTERFACE=. The possible values are:

/INTERFACE=DECWINDOWS or /INTERFACE=CHARACTER_CELL

As always, DECwindows terminal emulator users can specify use of the Command Interface rather than the Menu Interface by using the qualifier /NOSMG in addition to the /INTERFACE=CHARACTER_CELL qualifier.

3.3.2 Creating a Policy

Selecting the New Policy command from the File Menu of the Main Window creates a series of dialog boxes.

In the first dialog box you must type the name¹ you want to use for the new policy. The second dialog box asks whether you want to include values from an existing policy named DEFAULT. This is immaterial in this case since your first policy has yet to be created, but the dialog box is presented anyway to provide a consistent interface.

When you have clicked on the "OK" button in each of the two dialog boxes, a policy is created and displayed in a new window on the screen.

After creation of the policy window, there is a slight delay while the message "Reading Policy File" is displayed in a Work In Progress box in the center of the new window. When that message disappears the regular contents of the policy will be displayed.

Policy windows contain additional columns (the rightmost of which is only filled for exemptions), so you may wish to drag on the resize button to make the window wider.

3.3.3 Adding an Exemption

This section shows how to add such an exemption for the username "SYSTEM".

Select the test (UAF, PRIVLEVEL, ABSOLUTHI) from the Policy Window causing it to be highlighted in reverse video.

While the desired test is highlighted, select the Exempt command from the Edit menu of the Policy window creating a dialog box for adding an exemption.

Enter the desired value for the Exemption (Category-all, in this case) by clicking the appropriate radio button, or by selecting the Value field within the dialog box and typing th text if you prefer.

In the field for the Exemption Node, enter an asterisk "*" as a wildcard indicator, since this particular exemption you are adding should apply to all nodes covered by this policy. If you were adding a similar exemption for an individual user authorized extreme privileges, such as the system manager, you would enter separate exemptions for each node on which that individual was permitted to have extreme privileges.

In the field for the Exemption String, enter the username for which the exemption is to be granted, in this case "SYSTEM".

The Comment field allows you to make a notation explaining the reason why a particular policy change was made. For example, "January 14, 1990 memo from vice-president Mary Smith". Especially in cases where multiple individual security officers will be running LJK/Security, it is important to leave a record of why particular changes were made so actions can be taken in a coordinated fashion.

Since LJK/Security keeps a record of which username made the change, it will be quite obvious which member of the team is failing to fill in the comment field!

3.3.4 Creating an Assessment

The specification of which policies apply to which tributary nodes is stored as an LJK/Security assessment. The assessment thus also provides a list of which nodes are to be tested, excluding for instance, any which do not have the LJK/Security software installed.

Select the New Assessment command from the File Menu of the Main Window to create a series of dialog boxes. In the first dialog box you must type the name² you want to use for the new assessment. The second dialog box asks whether you want to include values from an existing assessment named DEFAULT. This is immaterial in this case since your first assessment has yet to be created, but the dialog box is presented anyway to provide a consistent interface.

When you have clicked on the "OK" button in each of the two dialog boxes, an assessment is created and displayed in a new window on the screen.

The new assessment contains only one entry called "< Prototype >". This entry does not actually represent a node to be assessed, but is present to be used as a template for creating assessment entries.

Select the < Prototype > entry from the Assessment Window causing it to be highlighted in reverse video.

While the entry is highlighted, select the Modify command from the Edit menu of the Assessment window creating a dialog box modifying an Assessment entry. The same thing can be accomplished by double-clicking on the < Prototype > entry, since the default action for the Assessment window is Modify.

The dialog box displays the fields of an existing entry so they can be viewed or changed. If they are changed and accepted with the Apply or OK button, there are two possibilities:

1. If the node name field was not changed, then the assessment values on disk for the subject node are changed.
2. If the node name field was one of those changed, then the values of the other fields are applied for some other node, either adding a new node to the assessment or some set of existing values for that node. In all cases where a change is made, LJK/Security maintains a history record of the previous values.

In this case (initial setup of an assessment) you should change the node name³ from < Prototype > to the node name you are going to test. For single-node licenses, this will be the same as the name of the master node on which you are running LJK/Security. Select the entire text of the Node field by clicking three times in rapid succession, or else by dragging across the field. The selected portion will be highlighted with reverse video. Typing in the desired node name will replace the existing text.

Another change you will want to make is to specify the proper policy (unless the policy name you want to use happens to match the one in the policy field). Click once on the policy field and you will be shown a list of available policies.

Select a policy from the list and it will be highlighted. Then clicking the OK button will return you to the assessment dialog box with your new choice in place. (It is also possible to double-click in the list of policies to save time.)

As with the policy dialog box, the assessment dialog box contains a comment field where you can record the reason for assessment changes. When you are satisfied with the contents of the assessment dialog box you can click on Apply or OK to make your changes take effect. (OK will also cause the box to disappear, while Apply leaves it in place for further actions such as creating more new node entries.)

3.3.5 Running the Assessment

Select the Run command from the Control menu on the Main window. This creates a dialog box from which you can select which assessment to run.

The list of available assessments is displayed, and you can double-click on any of them to cause them to run. You can also select the text field at the bottom of the dialog box and type an assessment name in manually, but it must match one of the names from the list.

When you have specified which assessment is to be run, an Option dialog box is displayed to allow you to specify any delay or repetition in the running of the assessment. To use the After field you must specify an Absolute Time in the standard VMS format (dd-mmm-yyyy hh:mm). To use the Interval field you must specify a Delta Time in the standard VMS format (ddd hh:mm). For your initial efforts it is probably better to leave both fields blank and just click on the OK button.

3.3.6 Reviewing Assessment Results

Select the Report command from the Control menu of the Main window. A dialog box will be created with a list of possible assessments to be reviewed. (It may be shorter than the list for the Run command, since it does not include assessments for which the Run command has never been issued). Double click on the desired assessment, and a Result window will be created.

In the result window you will see a list of all violations reported from the running of the assessment. They are arranged in alphabetic order by node name and then in alphabetic order by test name. Use the scroll bar slider on the right hand side to move up and down the list if it is longer than can be shown on the screen at once.

3.4 Overview of LJK/Security Pulldown Menus

Formalizing some of the information in the previous section, there are four types of LJK/Security windows provided:

• Main
• Assessment
• Policy
• Result

3.4.1 Main Window Menus

The File menu contains commands to create new assessments and policies and to open existing new assessments and policies for review and modification.

The Kit menu contains commands to generate VMSINSTAL kits to be used to install software on tributary nodes.

The DECwindows menu contains commands to save and restore user preferences.

The Help menu contains commands to get further information on operation of the LJK/Security Window Interface.

3.4.2 Assessment Window Menus

The Edit menu contains commands to transfer information to and from the clipboard and to show or modify the contents of individual Assessment records. Double-clicking on an individual record performs a default action which is equivalent to the Modify command on the Edit menu.

The Help menu contains commands to get further information on operation of the LJK/Security Window Interface.

3.4.3 Policy Window Menus

The Edit menu contains commands to transfer information to and from the clipboard and to show or modify the contents of existing Policy records, and to create new Exemption records. Double-clicking on an individual record performs a default action which is equivalent to the Modify command on the Edit menu.

The Help menu contains commands to get further information on operation of the LJK/Security Window Interface.

3.4.4 Result Window Menus

The Edit menu contains commands to transfer information to the clipboard.

The Help menu contains commands to get further information on operation of the LJK/Security Window Interface.

3.5 Using the Window Interface for Day-to-Day Tasks

For information on specific portions of LJK/Security Window Interface displays, use the mechanism described in Section 3.2, Context Sensitive Help.

3.5.1 Viewing Multiple Assessments

3.5.2 Copying an entry to another assessment

After the records have been copied to the DECwindows clipboard, they can be pasted back into a different assessment window by using the Paste command from the Edit menu of the target assessment window. The information copied is the full detailed assessment record, not just what is displayed in the assessment window.

Note that when a Paste command is used on an LJK/Security window, a dialog box is created asking for entry into the comment field. Whether such a field must be filled in depends on your local rules, but in any case, LJK/Security does keep track of which user performed the Paste operation, since that is the same as modifying a record directly.

Information copied to the clipboard from LJK/Security Assessment Windows can also be pasted into text windows of other DECwindows applications. That information is passed to those applications in summary text form (as shown in the assessment window) rather than in the binary form used between LJK/Security windows.

For advanced DECwindows users, all four forms of QuickCopy are also available between LJK/Security assessment windows. See the DECwindows documentation from VMS Development for details.