22 Aug
2020
22 Aug
'20
1:35 a.m.
Paul,
I?m pretty sure this is you. It?s coming from 28nh (41.28). What is it expecting? I
seem to remember a discussion on this, but can?t find it in my archives.
Thanks,
Zane
22 Aug
22 Aug
3:04 a.m.
Yes, that's the mapper, you can see it here: http://akdesign.dyndns.org:8080/map
<http://akdesign.dyndns.org:8080/map>
It sends NICE requests -- network management queries equivalent to these NCP commands:
1. show executor characteristics
2. show known circuits status
3. show active nodes status
You will see this once a day, plus if there is a topology change reported to 28NH that
involves your node.
paul
On Aug 21, 2020, at 7:35 PM, Zane Healy <healyzh at
avanthar.com> wrote:
Paul,
I?m pretty sure this is you. It?s coming from 28nh (41.28). What is it expecting? I
seem to remember a discussion on this, but can?t find it in my archives.
Thanks,
Zane
5:20 a.m.
I figured that it was related, though I?m not sure you?re actually getting any info out of
my nodes.
%%%%%%%%%%% OPCOM 21-AUG-2020 21:47:09.28 %%%%%%%%%%% (from node LNGTOM at
21-AUG-2020 22:42:30.55)
Message from user AUDIT$SERVER on LNGTOM
Security alarm (SECURITY) and security audit (SECURITY) on LNGTOM, system id: 62101
Auditable event: Network login failure
Event time: 21-AUG-2020 22:42:30.55
PID: 2060021B
Process name: NML_8195
Username: NML$SERVER
Remote nodename: 28NH
Remote node id: 42012 (41.28)
Remote username: NETMAPPER
Status: %LOGIN-F-INVPWD, invalid password
On a mildly related note, I now have a plugin for Nagios that will let me monitor the
availability of systems that only run DECnet. I?ll probably try to put together one for
LAT in the near future. While I was working on it last night, it correctly alerted me to
HAM being down.
Zane
On Aug 21, 2020, at 6:04 PM, Paul Koning
<paulkoning at comcast.net> wrote:
Yes, that's the mapper, you can see it here: http://akdesign.dyndns.org:8080/map
<http://akdesign.dyndns.org:8080/map>
It sends NICE requests -- network management queries equivalent to these NCP commands:
1. show executor characteristics
2. show known circuits status
3. show active nodes status
You will see this once a day, plus if there is a topology change reported to 28NH that
involves your node.
paul
On Aug 21, 2020, at 7:35 PM, Zane Healy
<healyzh at avanthar.com <mailto:healyzh at avanthar.com>> wrote:
Paul,
I?m pretty sure this is you. It?s coming from 28nh (41.28). What is it expecting? I
seem to remember a discussion on this, but can?t find it in my archives.
Thanks,
Zane
1:05 p.m.
Ah. Ignore my previous mail. That's clearly a NICE request then.
I just tried to talk NICE with LNGTOM:: from MIM:: as well, and also got
denied.
Interesting that it gets logged as a login failure.
Johnny
On 2020-08-22 05:20, Zane Healy wrote:
I figured that it was related, though I?m not sure
you?re actually
getting any info out of my nodes.
%%%%%%%%%%% ?OPCOM ?21-AUG-2020 21:47:09.28 ?%%%%%%%%%%% ? ?(from node
LNGTOM at 21-AUG-2020 22:42:30.55)
Message from user AUDIT$SERVER on LNGTOM
Security alarm (SECURITY) and security audit (SECURITY) on LNGTOM,
system id: 62101
Auditable event: ? ? ? ? ?Network login failure
Event time: ? ? ? ? ? ? ? 21-AUG-2020 22:42:30.55
PID: ? ? ? ? ? ? ? ? ? ? ?2060021B
Process name: ? ? ? ? ? ? NML_8195
Username: ? ? ? ? ? ? ? ? NML$SERVER
Remote nodename: ? ? ? ? ?28NH
Remote node id: ? ? ? ? ? 42012 (41.28)
Remote username: ? ? ? ? ?NETMAPPER
Status: ? ? ? ? ? ? ? ? ? %LOGIN-F-INVPWD, invalid password
On a mildly related note, I now have a plugin for Nagios that will let
me monitor the availability of systems that only run DECnet. ?I?ll
probably try to put together one for LAT in the near future. ?While I
was working on it last night, it correctly alerted me to HAM being down.
Zane
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
On Aug 21, 2020, at 6:04 PM, Paul Koning
<paulkoning at comcast.net
<mailto:paulkoning at comcast.net>> wrote:
Yes, that's the mapper, you can see it here:
http://akdesign.dyndns.org:8080/map
It sends NICE requests -- network management queries equivalent to
these NCP commands:
1. show executor characteristics
2. show known circuits status
3. show active nodes status
You will see this once a day, plus if there is a topology change
reported to 28NH that involves your node.
paul
On Aug 21, 2020, at 7:35 PM, Zane Healy
<healyzh at avanthar.com
<mailto:healyzh at avanthar.com>> wrote:
Paul,
I?m pretty sure this is you. ?It?s coming from 28nh (41.28). ?What is
it expecting? ?I seem to remember a discussion on this, but can?t
find it in my archives.
Thanks,
Zane
5 p.m.
What happens with PDXVAX::?
LNGTOM, SAVAGE, MONK, RENNY, and HAM are all part of the same cluster running 3 different
versions of OpenVMS. PDXVAX is a standalone VAX/VMS 5.5-2 system.
Zane
On Aug 22, 2020, at 4:05 AM, Johnny Billquist <bqt
at softjar.se> wrote:
Ah. Ignore my previous mail. That's clearly a NICE request then.
I just tried to talk NICE with LNGTOM:: from MIM:: as well, and also got denied.
Interesting that it gets logged as a login failure.
Johnny
6:36 p.m.
PDXVAX works.
It would appear that PDXVAX has a default account for the NML object whereas your cluster
does not. Issue the NCP command ?show object nml char? on PDXVAX and any member of the
cluster to see the difference.
Mark Berryman
On Aug 22, 2020, at 9:00 AM, Zane Healy <healyzh at
avanthar.com> wrote:
What happens with PDXVAX::?
LNGTOM, SAVAGE, MONK, RENNY, and HAM are all part of the same cluster running 3 different
versions of OpenVMS. PDXVAX is a standalone VAX/VMS 5.5-2 system.
Zane
On Aug 22, 2020, at 4:05 AM, Johnny Billquist
<bqt at softjar.se <mailto:bqt at softjar.se>> wrote:
Ah. Ignore my previous mail. That's clearly a NICE request then.
I just tried to talk NICE with LNGTOM:: from MIM:: as well, and also got denied.
Interesting that it gets logged as a login failure.
Johnny
1:01 p.m.
Hmm. But Zane mentioned login attempts? What's exactly in the log? Is it
actually login attempts, or NICE requests?
Johnny
On 2020-08-22 03:04, Paul Koning wrote:
Yes, that's the mapper, you can see it here:
http://akdesign.dyndns.org:8080/map
It sends NICE requests -- network management queries equivalent to these
NCP commands:
1. show executor characteristics
2. show known circuits status
3. show active nodes status
You will see this once a day, plus if there is a topology change
reported to 28NH that involves your node.
paul
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
On Aug 21, 2020, at 7:35 PM, Zane Healy
<healyzh at avanthar.com
<mailto:healyzh at avanthar.com>> wrote:
Paul,
I?m pretty sure this is you. ?It?s coming from 28nh (41.28). ?What is
it expecting? ?I seem to remember a discussion on this, but can?t find
it in my archives.
Thanks,
Zane
7:09 p.m.
Apparently VMS treats DECnet object authentication failure as login failure, which is
faintly sensible since they use the same authentication scheme (username/password).
paul
On Aug 22, 2020, at 7:01 AM, Johnny Billquist <bqt
at softjar.se> wrote:
Hmm. But Zane mentioned login attempts? What's exactly in the log? Is it actually
login attempts, or NICE requests?
Johnny
On 2020-08-22 03:04, Paul Koning wrote:
Yes, that's the mapper, you can see it here:
http://akdesign.dyndns.org:8080/map
It sends NICE requests -- network management queries equivalent to these NCP commands:
1. show executor characteristics
2. show known circuits status
3. show active nodes status
You will see this once a day, plus if there is a topology change reported to 28NH that
involves your node.
paul
> On Aug 21, 2020, at 7:35 PM, Zane Healy <healyzh at avanthar.com
<mailto:healyzh at avanthar.com>> wrote:
>
> Paul,
> I?m pretty sure this is you. It?s coming from 28nh (41.28). What is it expecting?
I seem to remember a discussion on this, but can?t find it in my archives.
>
> Thanks,
> Zane
>
>
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
10:27 p.m.
On 2020-08-22 19:09, Paul Koning wrote:
Apparently VMS treats DECnet object authentication
failure as login failure, which is faintly sensible since they use the same authentication
scheme (username/password).
Sure. In some sense. But I do find it slightly misleading to see a login
failure, when in fact it was access to an object over DECnet that was
happening.
The mechanism as such is the same in RSX, and I would assume also RSTS/E.
You make use of the same user database, along with associated passwords.
Johnny
paul
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
On Aug 22, 2020, at 7:01 AM, Johnny Billquist
<bqt at softjar.se> wrote:
Hmm. But Zane mentioned login attempts? What's exactly in the log? Is it actually
login attempts, or NICE requests?
Johnny
On 2020-08-22 03:04, Paul Koning wrote:
Yes, that's the mapper, you can see it here:
http://akdesign.dyndns.org:8080/map
It sends NICE requests -- network management queries equivalent to these NCP commands:
1. show executor characteristics
2. show known circuits status
3. show active nodes status
You will see this once a day, plus if there is a topology change reported to 28NH that
involves your node.
paul
> On Aug 21, 2020, at 7:35 PM, Zane Healy <healyzh at avanthar.com
<mailto:healyzh at avanthar.com>> wrote:
>
> Paul,
> I?m pretty sure this is you. It?s coming from 28nh (41.28). What is it expecting?
I seem to remember a discussion on this, but can?t find it in my archives.
>
> Thanks,
> Zane
>
>
--
Johnny Billquist || "I'm on a bus
|| on a psychedelic trip
email: bqt at softjar.se || Reading murder books
pdp is alive! || tryin' to stay hip" - B. Idol
10:32 p.m.
On Aug 22, 2020, at 1:27 PM, Johnny Billquist <bqt at softjar.se> wrote:
On 2020-08-22 19:09, Paul Koning wrote:
Then I wonder if this is behavior that changed between VAX/VMS 5.5-2 and OpenVMS 7.3.
They?re all running DECnet Phase IV.
Zane
Apparently VMS treats DECnet object
authentication failure as login failure, which is faintly sensible since they use the same
authentication scheme (username/password).
Sure. In some sense. But I do find it slightly misleading to see a login failure, when in
fact it was access to an object over DECnet that was happening.
The mechanism as such is the same in RSX, and I would assume also RSTS/E.
You make use of the same user database, along with associated passwords.
Johnny
1583
days inactive
1584
days old
9 comments
4 participants
participants (4)
-
bqt＠softjar.se -
healyzh＠avanthar.com -
mark＠theberrymans.com -
paulkoning＠comcast.net