why are one-to-many proxies disallowed (NAFADDERR)

[jonesd]

Anyone know the rationale for disabling the ability of a remote DECnet user to access more than one local user via the proxy mechanism?

[lastovica@sciinc.com]

Anyone know the rationale for disabling the ability of a remote DECnet user to access more than one local user via the proxy mechanism?

can you provide an example of what you're talking about? is there an example of command(s) that you've entered and the message(s) that you've received?

[jonesd]

can you provide an example of what you're talking about? is there an example of command(s) that you've entered and the message(s) that you've received?

Code: Select all

$ run authorize
UAF> show/proxy hobby::jonesd

 Default proxies are flagged with (D)

HOBBY::JONESD
    JONESD (D)
UAF> add/proxy hobby::jonesd vterm
%UAF-E-NAFADDERR, error adding proxy from HOBBY::JONESD to VTERM
UAF> show/proxy hobby::jonesd

 Default proxies are flagged with (D)

HOBBY::JONESD
    JONESD (D)
UAF> exit

$ help/message/nopage nafadderr

 NAFADDERR,  unable to add entry to network proxy database

  Facility:     UAF, Authorize Utility

  Explanation:  The specified record could not be added to the network user
                authorization file (NETPROXY.DAT). For example, this error
                occurs if you try to add a record authorizing a remote user to
                access more than one local account. Each user at a remote node
                is allowed to access the files of only one user on the local
                node.
  ...

The help text is oddly specific, there are other task-to-task things you can do besides connect to FAL. I use it to have the SYSTEM account startup up server processes on the local node under different usernames rather than via a batch queue (.submit/username=....).

[volkerhalle]

According to the 'fine' manual, try

UAF> ADD/PROXY HAL::WALTER REMOTE_MKT/DEFAULT,PROXY2,PROXY3

https://vmssoftware.com/docs/VSI_SYS_MG ... _VOL_I.PDF
7.9.5. Adding Proxy Accounts

Volker.

[jonesd]

According to the 'fine' manual, try

UAF> ADD/PROXY HAL::WALTER REMOTE_MKT/DEFAULT,PROXY2,PROXY3

https://vmssoftware.com/docs/VSI_SYS_MG ... _VOL_I.PDF
7.9.5. Adding Proxy Accounts

Under 9.2, first local user is added, second gets the NAFADDERR, third is never tried due to the preceding error.

BTW, getting this error borks the security server as well. Further attempts to add any proxies will timeout with a comm. error until you restart it (set server security/restart).

[volkerhalle]

Time to log a call ?

The example cited is straight from the most recent System Manager's Manual...

Works on VSI OpenVMS Alpha V8.4-2L2:

UAF> add/prox axpvms::halle test1/def,test2,test3
%UAF-I-NAFADDMSG, proxy from AXPVMS::HALLE to TEST1 added
%UAF-I-NAFADDMSG, proxy from AXPVMS::HALLE to TEST2 added
%UAF-I-NAFADDMSG, proxy from AXPVMS::HALLE to TEST3 added

Volker.

[arne_v]

On 9.2-2 I get:

Code: Select all

$ r authorize
UAF> show/prox *

 Default proxies are flagged with (D)

ARNE4::SYSTEM
    OSU$WWW

ARNE4::OSU$WWW
    OSU$WWW (D)
UAF> add/prox arne4::arne arne/def,osu$www,apache$www
%UAF-I-NAFADDMSG, proxy from ARNE4::ARNE to ARNE added
%UAF-I-NAFADDMSG, proxy from ARNE4::ARNE to OSU$WWW added
%UAF-I-NAFADDMSG, proxy from ARNE4::ARNE to APACHE$WWW added
UAF> show/prox *

 Default proxies are flagged with (D)

ARNE4::SYSTEM
    OSU$WWW

ARNE4::OSU$WWW
    OSU$WWW (D)

ARNE4::ARNE
    ARNE (D)                               OSU$WWW
    APACHE$WWW

Added in 4 hours 31 minutes 57 seconds:
And separately does not make a difference:

Code: Select all

$ r authorize
UAF> show/prox *

 Default proxies are flagged with (D)

ARNE4::SYSTEM
    OSU$WWW

ARNE4::OSU$WWW
    OSU$WWW (D)
UAF> add/proxy arne4::arne arne/def
%UAF-I-NAFADDMSG, proxy from ARNE4::ARNE to ARNE added
UAF> add/proxy arne4::arne osu$www
%UAF-I-NAFADDMSG, proxy from ARNE4::ARNE to OSU$WWW added
UAF> add/proxy arne4::arne apache$www
%UAF-I-NAFADDMSG, proxy from ARNE4::ARNE to APACHE$WWW added
UAF> show/prox *

 Default proxies are flagged with (D)

ARNE4::SYSTEM
    OSU$WWW

ARNE4::OSU$WWW
    OSU$WWW (D)

ARNE4::ARNE
    ARNE (D)                               OSU$WWW
    APACHE$WWW

Note that I am a little behind with patches and FT versions.

I am at 9.2-2 update 2.

[jonesd]

On 9.2-2 I get: ...

I am at 9.2-2 update 2.

Applying update 2 appears to have fixed the problem, similar to the issue addressed in release note 5.14.