OpenVMS System Management Utilities Reference Manual

Document revision date: 19 July 1999

OpenVMS System Management Utilities Reference Manual

Contents

Index

EXIT

Enables you to exit from AUTHORIZE and return to DCL command level. You can also return to command level by pressing Ctrl/Z.

Format

EXIT

Parameters

None.

Qualifiers

None.

GRANT/IDENTIFIER

Assigns the specified identifier to the user and documents the user as a holder of the identifier in the rights database.

Format

GRANT/IDENTIFIER id-name user-spec

Parameters

id-name
Specifies the identifier name. The identifier name is a string of 1 to 31 alphanumeric characters that can contain underscores and dollar signs. The name must contain at least one nonnumeric character.
user-spec
Specifies the UIC identifier that uniquely identifies the user on the system. This type of identifier appears in alphanumeric format. For example: [GROUP1,JONES].

Qualifier

/ATTRIBUTES=(keyword[,...])
Specifies attributes to be associated with the identifier. The following are valid keywords:

DYNAMIC Allows unprivileged holders of the identifier to remove and to restore the identifier from the process rights list by using the DCL command SET RIGHTS_LIST.

HOLDER_HIDDEN Prevents people from getting a list of users who hold an identifier, unless they own the identifier themselves.

NAME_HIDDEN Allows holders of an identifier to have it translated, either from binary to ASCII or from ASCII to binary, but prevents unauthorized users from translating the identifier.

NOACCESS Makes any access rights of the identifier null and void. If a user is granted an identifier with the No Access attribute, that identifier has no effect on the user's access rights to objects. This attribute is a modifier for an identifier with the Resource or Subsystem attribute.

RESOURCE Allows holders of an identifier to charge disk space to the identifier. Used only for file objects.

SUBSYSTEM Allows holders of the identifier to create and maintain protected subsystems by assigning the Subsystem ACE to the application images in the subsystem. Used only for file objects.

To remove an attribute from the identifier, add a NO prefix to the attribute keyword. For example, to remove the Resource attribute, specify /ATTRIBUTES=NORESOURCE.

Example


UAF> GRANT/IDENTIFIER INVENTORY [300,015] %UAF-I-GRANTMSG, identifier INVENTORY granted to CRAMER

The command in this example grants the identifier INVENTORY to the user named Cramer who has UIC [300,015]. Cramer becomes the holder of the identifier and any resources associated with it. The following command produces the same result:
UAF> GRANT/IDENTIFIER INVENTORY CRAMER

HELP

Displays information concerning the use of AUTHORIZE, including formats and explanations of commands, parameters, and qualifiers.

Format

HELP [keyword[,...]]

Parameter

keyword[,...]
Specifies one or more keywords that refer to the topic, command, qualifier, or parameter on which you want information from the AUTHORIZE HELP command.

Qualifiers

None.

Description

If you do not specify a keyword, HELP displays information about the topics and commands for which help is available. It then prompts you with "Topic?". You can supply a topic or a command name, or press Return. When you specify a command name and qualifiers, you get detailed information about that command. If you respond by pressing Return, you exit from help. You can also exit from help by pressing Ctrl/Z.
If the command you request accepts qualifiers, the display of the help information about the command is followed by the prompt "Subtopic?". Respond to this prompt with a qualifier name, or press Return. If you respond by pressing Return, HELP prompts with "Topic?". If you want to exit from help directly from this level, press Ctrl/Z.

Examples

#1
UAF> HELP ADD

The HELP command in this example displays information about the ADD command:

ADD Adds a user record to the SYSUAF and corresponding identifiers to the rights database. Format ADD newusername Additional information available: Parameter Qualifiers /ACCESS /ACCOUNT /ADD_IDENTIFIER /ALGORITHM /ASTLM /BATCH /BIOLM /BYTLM /CLI /CLITABLES /CPUTIME /DEFPRIVILEGES /DEVICE /DIALUP /DIOLM /DIRECTORY /ENQLM /EXPIRATION /FILLM /FLAGS /GENERATE_PASSWORD /INTERACTIVE /JTQUOTA /LGICMD /LOCAL /MAXACCTJOBS /MAXDETACH /MAXJOBS /NETWORK /OWNER /PASSWORD /PBYTLM /PGFLQUOTA /PRCLM /PRIMEDAYS /PRIORITY /PRIVILEGES /PWDEXPIRED /PWDLIFETIME /PWDMINIMUM /REMOTE /SHRFILLM /TQELM /UIC /WSDEFAULT /WSEXTENT /WSQUOTA Examples /IDENTIFIER /PROXY ADD Subtopic?

#2
UAF> HELP MODIFY/WSDEFAULT

The command in this example displays information about the /WSDEFAULT qualifier:

MODIFY /WSDEFAULT=value Specifies the default working set size. This represents the initial limit to the number of physical pages the process can use. (The user can alter the default quantity up to WSQUOTA with the DCL command SET WORKING_SET.) The minimum value is 50 pages (on VAX systems) and 150 pagelets (on Alpha systems). By default, a user has 150 pages (on VAX systems) and 150 pagelets (on Alpha systems).

LIST

Writes reports for selected UAF records to a listing file, SYSUAF.LIS, which is placed in the current default directory.

Format

LIST [user-spec]

Parameter

user-spec
Specifies the user name or UIC of the requested UAF record. Without the user-spec parameter, AUTHORIZE lists the user records of all users. The asterisk (*) and percent sign (%) wildcards are permitted in the user name.

Qualifiers

/BRIEF
Specifies that a brief report be written to SYSUAF.LIS. The /BRIEF qualifier is the default qualifier. SYSUAF.LIS is placed in the SYS$SYSTEM directory.
/FULL
Specifies that a full report be written to SYSUAF.LIS, including identifiers held by the user. SYSUAF.LIS is placed in the SYS$SYSTEM directory.

Description

The LIST command creates a listing file of reports for selected UAF records. Print the listing file, SYSUAF.LIS, with the DCL command PRINT.
Specification of a user name results in a single-user report. Specification of the asterisk wildcard character following the LIST command results in reports for all users in ascending sequence by user name. Specification of a UIC results in reports for all users with that UIC. (Compaq recommends that you assign each user a unique UIC, but if users share a UIC, the report will show all users with that UIC.) You can use the asterisk wildcard character to specify the UIC.
The following table shows how to specify a UIC with the LIST command and use the asterisk wildcard character with the UIC specification to produce various types of reports.

Command Description

LIST [14,6] Lists a full report for the user (or users) with member number 6 in group 14.

LIST [14,*] /BRIEF Lists a brief report for all users in group 14, in ascending sequence by member number.

LIST [*,6] /BRIEF Lists a brief report for all users with a member number of 6.

LIST [*,*] /BRIEF Lists a brief report for all users, in ascending sequence by UIC.

Although you must provide separate UICs for each user, the LIST command reports users with the same UIC in the order in which they were added to the SYSUAF. Full reports list the details of the limits, privileges, login flags, and command interpreter. Brief reports do not include the limits, login flags, or command interpreter, nor do they summarize the privileges. AUTHORIZE never displays the password for an account.
See the SHOW command for examples of brief and full reports.

Command	Description
LIST [14,6]	Lists a full report for the user (or users) with member number 6 in group 14.
LIST [14,*] /BRIEF	Lists a brief report for all users in group 14, in ascending sequence by member number.
LIST [*,6] /BRIEF	Lists a brief report for all users with a member number of 6.
LIST [,] /BRIEF	Lists a brief report for all users, in ascending sequence by UIC.

Examples

#1
UAF> LIST ROBIN/FULL %UAF-I-LSTMSG1, writing listing file %UAF-I-LSTMSG2, listing file SYSUAF.LIS complete

This command lists a full report for the user record ROBIN.

#2
UAF> LIST * %UAF-I-LSTMSG1, writing listing file %UAF-I-LSTMSG2, listing file SYSUAF.LIS complete

This command results in brief reports for all users in ascending sequence by user name. Note, however, that this is the same result you would produce had you omitted the asterisk wildcard.

#3
UAF> LIST [300.*] %UAF-I-LSTMSG1, writing listing file %UAF-I-LSTMSG2, listing file SYSUAF.LIS complete

This command lists a brief report for all user records with a group UIC of 300.

LIST/IDENTIFIER

Creates a listing file (RIGHTSLIST.LIS) in which identifier names, attributes, values, and holders are written.

Format

LIST/IDENTIFIER [id-name]

Parameter

id-name
Specifies an identifier name. You can specify the asterisk wildcard character (*) to list all identifiers. If you omit the identifier name, you must specify /USER or /VALUE.

Qualifiers

/BRIEF
Specifies a brief listing in which only the identifier name, value, and attributes appear.
/FULL
Specifies a full listing, in which the names of the identifier's holders are displayed along with the identifier's name, value, and attributes. The /FULL qualifier specifies the default listing format.
/USER=user-spec
Specifies one or more users whose identifiers are to be listed. The user-spec can be a user name or UIC. You can use the asterisk wildcard character (*) to specify multiple user names or UICs. UICs must be in the form [*,*], [n,*], [*,n], or [n,n]. A wildcard user name specification (*) lists identifiers alphabetically by user name; a wildcard UIC specification ([*,*]) lists them numerically by UIC.
/VALUE=value-specifier
Specifies the value of the identifier to be listed. The following formats are valid for the value-specifier:

IDENTIFIER:n An integer value in the range 65,536 to 268,435,455. You can also specify the value in hexadecimal (precede the value with %X) or octal (precede the value with %O).
To differentiate general identifiers from UIC identifiers, %X80000000 is added to the value you specify.

UIC:uic A UIC value in the standard UIC format.

Description

The LIST/IDENTIFIER command creates a listing file in which identifier names, attributes, values, and holders are displayed in various formats depending on the qualifiers specified. Two of these formats are illustrated in the description of the SHOW/IDENTIFIER command.
Print the listing file named RIGHTSLIST.LIS with the DCL command PRINT.

Examples

#1
UAF> LIST/IDENTIFIER INVENTORY %UAF-I-LSTMSG1, writing listing file %UAF-I-RLSTMSG, listing file RIGHTSLIST.LIS complete

The command in this example generates a full listing for the identifier INVENTORY, including its value (in hexadecimal), holders, and attributes.

#2
UAF> LIST/IDENTIFIER/USER=ANDERSON %UAF-I-LSTMSG1, writing listing file %UAF-I-RLSTMSG, listing file RIGHTSLIST.LIS complete

This command lists an identifier associated with the user ANDERSON, along with its value and attributes. Note, however, that this is the same result you would produce had you specified ANDERSON's UIC with the following forms of the command:
UAF> LIST/IDENTIFIER/USER=[300,015]
UAF> LIST/IDENTIFIER/VALUE=UIC:[300,015]

LIST/PROXY

Creates a listing file of the network proxy database entries from the network database file NET$PROXY.DAT.

Format

LIST/PROXY

Parameters

None.

Qualifiers

/OLD
Directs AUTHORIZE to display information from the NETPROXY.DAT file rather than from the default file NET$PROXY.DAT.
If someone modifies the proxy database on a cluster node that is not running the current OpenVMS VAX system, then you can use the /OLD qualifier to list the contents of the old database: NETPROXY.DAT.

Description

Use the DCL command PRINT to print the listing file, NETPROXY.LIS. The output assumes the same format as that of the SHOW/PROXY command. For an example of the output format, see the description of the SHOW/PROXY command.

Example


UAF> LIST/PROXY/OLD %UAF-I-LSTMSG1, writing listing file %UAF-I-NETLSTMSG, listing file NETPROXY.LIS complete

The command in this example creates a listing file of all the entries in the network proxy database NETPROXY.DAT.

LIST/RIGHTS

Lists identifiers held by the specified identifier or, if /USER is specified, all identifiers held by the specified users.

Format

LIST/RIGHTS [id-name]

Parameter

id-name
Specifies the name of the identifier associated with the user. If you omit the identifier name, you must specify the /USER qualifier.

Qualifier

/USER=user-spec
Specifies a user whose identifiers are to be listed. The user-spec can be a user name or UIC. You can use the asterisk wildcard character (*) to specify multiple UICs or all user names. UICs must be in the form [*,*], [n,*], [*,n], or [n,n]. A wildcard user name specification (*) or wildcard UIC specification ([*,*]) lists all identifiers held by users. The wildcard user name specification lists holders' user names alphabetically; the wildcard UIC specification lists them in the numerical order of their UICs.

Description

Use the DCL command PRINT to print the listing file (RIGHTSLIST.LIS) produced by the LIST/RIGHTS command. For an example of the output format, see the description of the SHOW/RIGHTS command.

Example


UAF> LIST/RIGHTS PAYROLL %UAF-I-LSTMSG1, writing listing file %UAF-I-RLSTMSG, listing file RIGHTSLIST.LIS complete

The command in this example lists identifiers held by PAYROLL, providing PAYROLL is the name of a UIC format identifier.

MODIFY

Changes values in a SYSUAF user record. Qualifiers not specified in the command remain unchanged.

Format

MODIFY username /qualifier[,...]

Parameter

username
Specifies the name of a user in the SYSUAF. The asterisk (*) and percent sign (%) wildcard characters are permitted in the user name. When you specify a single asterisk for the user name, you modify the records of all users.

Qualifiers

/MODIFY_IDENTIFIER (default)

/NOMODIFY_IDENTIFIER
Specifies whether the identifier associated with the user is to be modified in the rights database. This qualifier applies only when you modify the UIC or user name in the UAF record. By default, the associated identifiers are modified.
See also the qualifiers listed under the ADD command.

Description

The MODIFY command changes values in a SYSUAF user record. Most values not in the command remain unchanged. If the UIC is changed, the value of the corresponding identifier is also changed.
Modifications to the user record are not retroactive; thus, any changes to quota values apply to the next process that is created but not to the current one.

Examples

#1
UAF> MODIFY ROBIN /PASSWORD=SP0172 %UAF-I-MDFYMSG, user record(s) updated

The command in this example changes the password for user ROBIN without altering any other values in the record.

#2
UAF> MODIFY ROBIN/FLAGS=RESTRICTED %UAF-I-MDFYMSG, user record(s) updated

The command in this example modifies the UAF record for user ROBIN by adding the login flag RESTRICTED.

MODIFY/IDENTIFIER

Modifies an identifier name, its associated value, or its attributes in the rights database.

Format

MODIFY/IDENTIFIER id-name

Parameter

id-name
Specifies the name of an identifier to be modified.

Qualifiers

/ATTRIBUTES=(keyword[,...])
Specifies attributes to be associated with the modified identifier. The following keywords are valid:

DYNAMIC Allows unprivileged holders of the identifier to remove and to restore the identifier from the process rights list by using the DCL command SET RIGHTS_LIST.

HOLDER_HIDDEN Prevents people from getting a list of users who hold an identifier, unless they own the identifier themselves.

NAME_HIDDEN Allows holders of an identifier to have it translated, either from binary to ASCII or from ASCII to binary, but prevents unauthorized users from translating the identifier.

NOACCESS Makes any access rights of the identifier null and void. If a user is granted an identifier with the No Access attribute, that identifier has no effect on the user's access rights to objects. This attribute is a modifier for an identifier with the Resource or Subsystem attribute.

RESOURCE Allows holders of an identifier to charge disk space to the identifier. Used only for file objects.

SUBSYSTEM Allows holders of the identifier to create and maintain protected subsystems by assigning the Subsystem ACE to the application images in the subsystem. Used only for file objects.

To remove an attribute from the identifier, add a NO prefix to the attribute keyword. For example, to remove the Resource attribute, specify /ATTRIBUTES=NORESOURCE.

Note
If you specify the NORESOURCE keyword without naming any holder with the /HOLDER qualifier, all holders lose the right to charge resources.

/HOLDER=username
Specifies the holder of an identifier whose attributes are to be modified. The /HOLDER qualifier is used only in conjunction with the /ATTRIBUTES qualifier.
If you specify /HOLDER, the /NAME and /VALUE qualifiers are ignored.
/NAME=new-id-name
Specifies a new identifier name to be associated with the identifier.
/VALUE=value-specifier
Specifies a new identifier value. Note that an identifier value cannot be modified from a UIC to a non-UIC format or vice versa. The following formats are valid for the value-specifier:

IDENTIFIER:n An integer value in the range of 65,536 to 268,435,455. You can also specify the value in hexadecimal (precede the value with %X) or octal (precede the value with %O).
To differentiate general identifiers from UIC identifiers, %X80000000 is added to the value you specify.

UIC:uic A UIC value in the standard UIC format.

Description

The MODIFY/IDENTIFIER command changes identifier names, associated values, and attributes in the rights database. Values not specified in the command remain unchanged.

Examples

#1
UAF> MODIFY/IDENTIFIER OLD_ID /NAME=NEW_ID %UAF-I-RDBMDFYMSG, identifier OLD_ID modified

The command in this example changes the name of the OLD_ID identifier to NEW_ID.

#2
UAF> MODIFY/IDENTIFIER/VALUE=UIC:[300,21] ACCOUNTING %UAF-I-RDBMDFYMSG, identifier ACCOUNTING modified

The command in this example changes the old UIC value of the identifier ACCOUNTING to a new value.

#3
UAF> MODIFY/IDENTIFIER/ATTRIBUTES=NORESOURCE- _UAF> /HOLDER=CRAMER ACCOUNTING %UAF-I-RDBMDFYMSG, identifier ACCOUNTING modified

The command in this example associates the attribute NORESOURCE with the identifier ACCOUNTING in CRAMER's holder record. The identifier ACCOUNTING is not changed.

Contents

Index

privacy and legal statement

6048PRO_011.HTML

DYNAMIC	Allows unprivileged holders of the identifier to remove and to restore the identifier from the process rights list by using the DCL command SET RIGHTS_LIST.
HOLDER_HIDDEN	Prevents people from getting a list of users who hold an identifier, unless they own the identifier themselves.
NAME_HIDDEN	Allows holders of an identifier to have it translated, either from binary to ASCII or from ASCII to binary, but prevents unauthorized users from translating the identifier.
NOACCESS	Makes any access rights of the identifier null and void. If a user is granted an identifier with the No Access attribute, that identifier has no effect on the user's access rights to objects. This attribute is a modifier for an identifier with the Resource or Subsystem attribute.
RESOURCE	Allows holders of an identifier to charge disk space to the identifier. Used only for file objects.
SUBSYSTEM	Allows holders of the identifier to create and maintain protected subsystems by assigning the Subsystem ACE to the application images in the subsystem. Used only for file objects.

IDENTIFIER:n	An integer value in the range 65,536 to 268,435,455. You can also specify the value in hexadecimal (precede the value with %X) or octal (precede the value with %O). To differentiate general identifiers from UIC identifiers, %X80000000 is added to the value you specify.
UIC:uic	A UIC value in the standard UIC format.

IDENTIFIER:n	An integer value in the range of 65,536 to 268,435,455. You can also specify the value in hexadecimal (precede the value with %X) or octal (precede the value with %O). To differentiate general identifiers from UIC identifiers, %X80000000 is added to the value you specify.
UIC:uic	A UIC value in the standard UIC format.