(9851) Protecting a Serial Terminal Port?
(9851) Protecting a Serial Terminal Port?
Is there a way to disable the ability of setting Altypeahd on a terminal? Something in sysgen? The worst part being the system needs to be rebooted to undo it. We have an old sensitive async real-time application that does not work when it is enabled. Can you please address this for vms v7.3-2 also?
Last edited by marty.stu on Thu Aug 25, 2022 7:50 am, edited 2 times in total.
Re: (9851) Protecting a Serial Terminal Port?
The usual approach is to SET TERMINAL/[NO]TYPE_AHEAD/PERMANENT in the system startup, and /ALTYPEAHD to select the alternate (and usually larger) typeahead buffer. Use of /PERMANENT will requires LOG_IO or PHY_IO; full ALL-class OpenVMS privileges.
The mechanism used to control this (permanent) setting is the OpenVMS privilege, and specifically LOG_IO, PHY_IO, or (obviously) write access to the system startup procedures. Only privileged users can reset the attribute permanently. If the settings are changing (permanently), you will want to review the activities of the privileged users, and will potentially want to remote privileges from one or more users.
You can also choose to explicitly protect the port against most (non-privileged) access, using the SET SECURITY command or similar.
The OpenVMS Wizard is not aware of a problem here that would require a reboot, but might tend to assume that resetting the attribute either trips into a flow-control problem, or into a sequence of attempted logins. In either case, there is generally no need for a reboot.
Setting the required terminal characteristics in SYCONFIG.COM or SYSTARTUP_VMS.COM is the normal and recommended means for establishing the default settings.
The OpenVMS Wizard is aware of no way to disable changes by an application that might wish to temporarily adjust the
terminal settings. The settings will revert on image exit, however. (This access can be blocked by protecting the port
with a protection mask or an ACL, obviously.)
These mechanisms have been in place for multiple major releases of OpenVMS.
The mechanism used to control this (permanent) setting is the OpenVMS privilege, and specifically LOG_IO, PHY_IO, or (obviously) write access to the system startup procedures. Only privileged users can reset the attribute permanently. If the settings are changing (permanently), you will want to review the activities of the privileged users, and will potentially want to remote privileges from one or more users.
You can also choose to explicitly protect the port against most (non-privileged) access, using the SET SECURITY command or similar.
The OpenVMS Wizard is not aware of a problem here that would require a reboot, but might tend to assume that resetting the attribute either trips into a flow-control problem, or into a sequence of attempted logins. In either case, there is generally no need for a reboot.
Setting the required terminal characteristics in SYCONFIG.COM or SYSTARTUP_VMS.COM is the normal and recommended means for establishing the default settings.
The OpenVMS Wizard is aware of no way to disable changes by an application that might wish to temporarily adjust the
terminal settings. The settings will revert on image exit, however. (This access can be blocked by protecting the port
with a protection mask or an ACL, obviously.)
These mechanisms have been in place for multiple major releases of OpenVMS.
Last edited by marty.stu on Thu Aug 25, 2022 7:51 am, edited 1 time in total.