Determine whether presence of DECnet Default Outgoing Account conforms to policy.

Violation reports

Description

A DECnet default outgoing account is an older form of default DECnet account which involves storing a password for one node on another node. It is thus even less secure than the DECnet default incoming account, without providing the added features of the DECnet default privileged account.

Limits

Exemptions

Determine whether presence of DECnet Default Privileged Account conforms to policy.

Violation reports

Description

DECnet default privileged accounts are implemented by storing the password to one node on another node, and transmitting that password on behalf of the user if certain privileges are held. It is most often used for special-purpose applications or in system management.

Limits

Exemptions

Ensure that usage of FAL routing conforms to local policy.

Violation reports

Description

Poor man's routing through FAL is used when a user provides multiple node specifications in a filespec, such as:

NODE1::NODE2::DISK$USER:[SMITH]FINANCE.DAT

It can be used to circumvent normal access paths in some situations.

If the DECnet FAL object finds logical name FAL$LOG to contain the substring "/DISABLE=8", poor man's routing will be prevented.

Limits

Exemptions

The logical name FAL$LOG is interpreted in the context of each FAL server process, and there is no requirement that logical names be in executive mode, so an individual user can override the FAL$LOG value specified on a system-wide basis. This mechanism is useful, however, for accounts where a user does not have interactive access or the ability to define logical names.

This feature of FAL$LOG is not documented and supported by VMS Development. Although VMS Development has gone to some trouble to implement it, they reserve the right to change or remove the feature at any time. 

6.4 DEVICE tests

Exemptions are based on node name and device name. 

Ensure that identifier types used in access control lists conform to policy.

Violation reports

Description

Use of UIC identifiers directly in access control lists leads to problems if user responsibilities are changed, since control of the access they have been granted is distributed throughout the system.

The purpose of this test is to ensure that identifiers used in Identifier Access Control Entries are of acceptable types.

Limits

Exemptions

Ensure that ownership of devices is retained by the system and not by an individual user, except when the device is in use.

Violation reports

Description

If an individual user account gains ownership of a device, it also gains access to any information that is stored on it or transmitted through it. A particular concern is the case of terminal ports, in which this ownership would allow one user to read another user's password as it is typed. Another concern is that other users would be unable to use a device owned by an individual user, even when the ownership is acquired inadvertently.

The purpose of this test is to ensure that the system retains ownership of devices that are not in use. This test checks the ownership of any device not currently in use and reports any instance in which the owner is not the system.

For limits only (not exemptions), owner matching string of [SYSTEM] will match (as a special case) against UIC's which are represented as [1,4] (due, for instance, to absence of a Rights Database (RIGHTSLIST.DAT)).

Limits

Exemptions

Ensure that each device's protection setting meets the minimum setting defined by policy.

Violation reports

Description

Under VMS, a protection setting can be applied to a device in the same way that it can be applied to files. This allows a given user (or group of users) to have exclusive access to a given disk, for example. Conversely, it can be set to keep a device open for access by all users, or to limit them to read access.

The purpose of this test is to ensure that the protection settings for devices remain at the levels established by policy.

The ABSOLUTLO and ABSOLUTHI tests measure the UIC-based protection mask directly. The PERCENTLO and PERCENTHI tests measure the result of protection (including ACL protection) in terms of the percentage of usernames given access.

By default, a minimum of 0 percent of users must have access and a maximum of 10 percent of users may have access. Customizing The default limit values for these tests leave device protection "wide open", so changes should be made to obtain any value from this test. selector Limits for constraints PERCENTLO and PERCENTHI can take a selector consisting of a VMS device access type: READ, WRITE, LOGICAL, PHYSICAL or CONTROL. If no selector is specified, customization commands apply to all possible selector values.

Limits

Exemptions

6.5 DISK Tests

Exemptions are based on node name and volume name or file specification.

Disk served by the Distributed File Service product from HP (DECdfs) will not be tested on the client machine, but only on the serving machine. This is different from the approach taken with MSCP served disks in a cluster, because in the cluster situation a common security domain is present and testing file ownership and protection is meaningful. In the DFS case, all access is via proxy logins, so testing file ownership and protection can only be done from the serving machine.

In cases where a violation is detected on a file which happens to be the target of alias directory entries, the violation is reported only for the main file specification.

The following elements are tested in concert:

• DBMSPROT
• DIRPROT
• FILEPROT
• HELPPROT
• MAILPROT
• NOTESPROT
• RDBVMSPROT
• SYSEXEPROT

The FILEPROT element covers files which do not fit one of the other categories.

In the case of CD-ROM disks, the ABSOLUTLO, ABSOLUTHI and PERCENTHI constraints are tested with compensation for the fact that the disk cannot be written. In the case of the PERCENTLO constraint, however, no such compensation is made, so there will be violations reported if access percentages (for Write and Delete) calculated from nominal file protections are less than specified in the policy, even though a different setting would not change the actual protection of the CD-ROM files. This approach is taken to avoid a situation where two tests would provide conflicting reports as to the percentage of users with Write or Delete access.

That general approach to exhaustive disk file scanning is to hold files of similar nature to the same standard, adding exemptions for files allowed to exceed that standard. If you have particular files you want held to a tighter standard than others, designate them in exemptions for the CHECKPROT constraints. The CHECKPROT and CHECKSUM elements perform no processing based on the limits, but instead exclusively test files that are indicated for exemptions for their constraints. 

Ensure that identifier types used in access control lists conform to policy.

Violation reports

Description

Use of UIC identifiers directly in access control lists leads to problems if user responsibilities are changed, since control of the access they have been granted is distributed throughout the system.

The purpose of this test is to ensure that identifiers used in Identifier Access Control Entries are of acceptable types.

Limits

Exemptions