$ CREATE/DIRECTORY DROPBOX:[DROPBOX]
$ SET SECURITY DROPBOX:[000000]DROPBOX.DIR/OWNER=... -
/PROTECTION=(S:WRE,O:WRE,G:WRE,W:WRE) -
/ACL=(DEFAULT_PROTECTION,SYSTEM:WRED,OWNER:R,GROUP:R,WORLD:R)
I've had a little play and it seems to work as expected. Well, as I expect it to.
I'll try that once I've had some sleep, been up far too long again..
Sampsa
On Tue, Oct 8, 2013 at 1:20 PM, Cory Smelosky <b4 at gewt.net> wrote:
On Tue, 8 Oct 2013, Tim Sneddon wrote:
On Tue, Oct 8, 2013 at 10:22 AM, Cory Smelosky <b4 at gewt.net> wrote:
On Tue, 8 Oct 2013, Sampsa Laine wrote:
On 8 Oct 2013, at 01:52, Sampsa Laine <sampsa at mac.com> wrote:
Do we have an intranet site only accessible via DECnet? I dont put any
(much) personal information on the net.
Daniel.
That's what I'm trying to do with the "Dropbox" on CHIMPY:: - anyone can
add or view files, but not delete or edit them. Just not sure what the
correct security setting for the directory should be...
Is this type of security option on a dir possible? I can't figure out how
to set it up, but somebody amongst you gurus must know :)
You can set RWE for world set on the directory by default, but have a
script periodically set all files to w:RE only. There's probably a better
way to do it, though.
That sounds pretty, well, yuck.
I prefer the "outside the box" approach to solving problems. ;) Weird > elegant in my book usually.
I can certainly appreciate your interest there. However, it just makes my skin crawl. If you do it right the first time...
Not that I have given it much thought you would likely be able to achieve
this sort of environment using ACLs. I recommend checking out the VMS
security manual.
Do ACLs like that carry over DECnet? I seem to recall Brian S. saying they don't.
You are correct, sort of. However, you wouldn't apply the ACL to the file. Rather, specify a default protection ACL on the directory to contain the files. This would configure the security attributes of any file placed in it, which to my thinking should work.
I use something similar so that when I copy stuff into my FTP directories they are immediately set up to be served via either HTTP for FTP. Here is an example of the way to set it up (assuming DROPBOX is CONCEALED logical):
$ CREATE/DIRECTORY DROPBOX:[DROPBOX]
$ SET SECURITY DROPBOX:[000000]DROPBOX.DIR/OWNER=... -
/PROTECTION=(S:WRE,O:WRE,G:WRE,W:WRE) -
/ACL=(DEFAULT_PROTECTION,SYSTEM:WRED,OWNER:R,GROUP:R,WORLD:R)
I've had a little play and it seems to work as expected. Well, as I expect it to.
Regards, Tim.
On Tue, 8 Oct 2013, Sampsa Laine wrote:
Thanks to Cory's efforts and the advice of the community, we finally rigged up a VMS box to talk to UUHECNET directly.
There's actual RS-232 involved, too. Along with a utility named "ser2net".
The address format is:
MOIRA::uucp%"host!host!etc!username"
Most hosts are connected to b4gate, so a bangpath starting with b4gate will probably get your message delivered.
I've tested this with originating a message from RSTS/E (9.7) and CHIMPY. Replies in all directions work.
The UUHECnet relay will work properly for all once Johnny updates 9.1 to MOIRA, nukes the current MOIRA, and everyone pulls the current database.
Replies from UUHECNET also work.
Sampsa
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
Thanks to Cory's efforts and the advice of the community, we finally rigged up a VMS box to talk to UUHECNET directly.
The address format is:
MOIRA::uucp%"host!host!etc!username"
Most hosts are connected to b4gate, so a bangpath starting with b4gate will probably get your message delivered.
Replies from UUHECNET also work.
Sampsa
On Tue, 8 Oct 2013, Daniel Soderstrom wrote:
Oh.. I thought that somehow LAT was routable over DECnet. I thought I remember in the old days some remote sites just had a terminal server and a couple of terminals. Many beers ago.
So, I could go from the DECserver to my local vax, and then bounce out?
That's what I do. (Well, DECserver to a FreeBSD box, and then to the world if I want to send email...like this particular one was sent from a VT320 on a DECserver 200/MC)
Daniel.
On 08/10/2013, at 10:27 AM, Tim Sneddon <tim at sneddon.id.au> wrote:
On Tue, Oct 8, 2013 at 10:23 AM, Sampsa Laine <sampsa at mac.com> wrote:
On 8 Oct 2013, at 04:19, Cory Smelosky <b4 at gewt.net> wrote:
On Tue, 8 Oct 2013, Daniel Soderstrom wrote:
SET HOST EISNER straight from a DECServer will be nice.
A DECserver speaking DECnet? That'd be awesome to have. Mine (albeit awesome, and one of my favourite things) only speaks LAT. ;)
My DS300 does inbound Telnet as well as inbound/outbound LAT and serial :)
No DECNET as far as I know.
I don't recall a DECserver that talks DECnet. It is the wrong protocol for that type of communication. DECservers originally only spoke LAT, which was developed specifically for local area communications (which it does very well).
Regards, Tim.
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
That sounds pretty, well, yuck.
I prefer the "outside the box" approach to solving problems. ;) Weird > elegant in my book usually.
Not that I have given it much thought you would likely be able to achieve
this sort of environment using ACLs. I recommend checking out the VMS
security manual.
Do ACLs like that carry over DECnet? I seem to recall Brian S. saying they don't.
Guys, I decided to go with a more or less free-for-all environment, I'll make batch job that will set the FILE/PROT to W:RE every couple of hours but right now, CHIMPY::[.DROPBOX] is open to everyone.
BTW, the SAMPSA*.* images are me, I think this "Faces of HECnet" project would be cool.
sampsa
On Tue, 8 Oct 2013, Tim Sneddon wrote:
On Tue, Oct 8, 2013 at 10:22 AM, Cory Smelosky <b4 at gewt.net> wrote:
On Tue, 8 Oct 2013, Sampsa Laine wrote:
On 8 Oct 2013, at 01:52, Sampsa Laine <sampsa at mac.com> wrote:
Do we have an intranet site only accessible via DECnet? I dont put any
(much) personal information on the net.
Daniel.
That's what I'm trying to do with the "Dropbox" on CHIMPY:: - anyone can
add or view files, but not delete or edit them. Just not sure what the
correct security setting for the directory should be...
Is this type of security option on a dir possible? I can't figure out how
to set it up, but somebody amongst you gurus must know :)
You can set RWE for world set on the directory by default, but have a
script periodically set all files to w:RE only. There's probably a better
way to do it, though.
That sounds pretty, well, yuck.
I prefer the "outside the box" approach to solving problems. ;) Weird > elegant in my book usually.
Not that I have given it much thought you would likely be able to achieve
this sort of environment using ACLs. I recommend checking out the VMS
security manual.
Do ACLs like that carry over DECnet? I seem to recall Brian S. saying they don't.
Regards, Tim.
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
On Tue, 8 Oct 2013, Tim Sneddon wrote:
On Tue, Oct 8, 2013 at 10:23 AM, Sampsa Laine <sampsa at mac.com> wrote:
On 8 Oct 2013, at 04:19, Cory Smelosky <b4 at gewt.net> wrote:
On Tue, 8 Oct 2013, Daniel Soderstrom wrote:
SET HOST EISNER straight from a DECServer will be nice.
A DECserver speaking DECnet? That'd be awesome to have. Mine (albeit
awesome, and one of my favourite things) only speaks LAT. ;)
My DS300 does inbound Telnet as well as inbound/outbound LAT and serial :)
No DECNET as far as I know.
I don't recall a DECserver that talks DECnet. It is the wrong protocol for
that type of communication. DECservers originally only spoke LAT, which
was developed specifically for local area communications (which it does
very well).
That it does indeed do very well. ;)
Regards, Tim.
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
>Sampsa Laine wrote:
What would be the correct security settings for a directory that:
- Allows anyone to add a file
- Anyone can read any file
- Nobody can delete, edit or replace existing files.
Thinking of setting this up on CHIMPY for people to store nifty stuff they find.
Just a suggestion. Why not have TWO directories?
(a) WRITE ONLY - anyone can send files to it - normally named: INCOMING
(b) READ ONLY - anyone can read any file
Just in case, you can (probably should) monitor
what is added to (a), then copy it over to (b)
ONLY after it is checked. Having (a) which
only you can look at (you might allow the contents
to be displayed, but I would not recommend it)
provides much better security. I also suggest that
for any file larger that 10 MB, an MD5 checksum
also be sent so you can verify the large file was
sent correctly.
Jerome Fine
I've uploaded a picture of me (doing something stupid, obviously) to CHIMPY::[.DROPBOX]SAMPSA1.SIXEL
There is also a SAMPSA2.SIXEL, I can't recall what the difference between the files is...
sampsa <sampsa at mac.com>
mobile +358 40 7208932
