Account flags - Revision history

Jane.doe at 07:49, 13 December 2019

2019-12-13T07:49:20Z

← Older revision		Revision as of 07:49, 13 December 2019
Line 27:		Line 27:
	\| DISNEWMAIL \|\| Suppresses announcements of new mail at login. By default, the system announces new mail (NODISNEWMAIL).		\| DISNEWMAIL \|\| Suppresses announcements of new mail at login. By default, the system announces new mail (NODISNEWMAIL).
	\|-		\|-
	\| DISPWDDIC \|\| Disables automatic screening of new passwords against a [[~~System~~ Password Dictionary\|system dictionary]]. By default, passwords are automatically screened (NODISPWDDIC).		\| DISPWDDIC \|\| Disables automatic screening of new passwords against a [[Password Dictionary\|system dictionary]]. By default, passwords are automatically screened (NODISPWDDIC).
	\|-		\|-
	\| DISPWDHIS \|\| Disables automatic checking of new passwords against a [[Password History\|list of the user's old passwords]]. By default, the system screens new passwords (NODISPWDHIS).		\| DISPWDHIS \|\| Disables automatic checking of new passwords against a [[Password History\|list of the user's old passwords]]. By default, the system screens new passwords (NODISPWDHIS).

Jane.doe at 09:18, 12 December 2019

2019-12-12T09:18:23Z

Darya.zelenina: Created page with "'''Account flags''' are flags that can be set on a user record to control that process's security-related settings. They can be modified using the AUTHORIZE ut..."

2018-12-18T14:30:49Z

Created page with "'''Account flags''' are flags that can be set on a user record to control that process's security-related settings. They can be modified using the AUTHORIZE ut..."

New page

'''Account flags''' are flags that can be set on a [[User record|user record]] to control that process's security-related settings. They can be modified using the AUTHORIZE utility /FLAGS qualifier. The prefix NO clears the flag:
<nowiki>
MOD USER1 /FLAGS=(NODISUSER,CAPTIVE)
</nowiki>

{| class="wikitable"
|-
! Flag !! Description
|-
| AUDIT || Enables or disables mandatory security auditing for a specific user. By default, the system does not audit the activities of specific users (NOAUDIT).
|-
| AUTOLOGIN || Restricts the user to the automatic login mechanism when logging in to an account. When set, the flag disables login by any terminal that requires entry of a user name and password.
|-
| CAPTIVE || Prevents the user from changing any defaults at login, for example, /CLI or /LGICMD. It prevents the user from escaping the captive login command procedure specified by the /LGICMD qualifier and gaining access to the DCL command level. The CAPTIVE flag also establishes an environment where Ctrl/Y interrupts are initially turned off; however, command procedures can still turn on Ctrl/Y interrupts with the DCL command SET CONTROL=Y. By default, an account is not captive (NOCAPTIVE).
|-
| DEFCLI || Restricts the user to the default command interpreter by prohibiting the use of the /CLI qualifier at login. By default, a user can choose a CLI (NODEFCLI).

|-
| DISCTLY || Establishes an environment where Ctrl/Y interrupts are initially turned off and are invalid until a SET CONTROL=Y is encountered. This could happen in SYLOGIN.COM or in a procedure called by SYLOGIN.COM. Once a SET CONTROL=Y is executed (which requires no privilege), a user can enter a Ctrl/Y and reach the DCL prompt ($). If the intent of DISCTLY is to force execution of the login command files, then SYLOGIN.COM should issue the DCL command SET CONTROL=Y to turn on Ctrl/Y interrupts before exiting. By default, Ctrl/Y is enabled (NODISCTLY).
|-
| DISFORCE_PWD_CHANGE || Removes the requirement that a user must change an expired password at login. By default, a person can use an expired password only once (NODISFORCE_PWD_CHANGE) and then is forced to change the password after logging in. If the user does not select a new password, the user is locked out of the system. To use this feature, set a password expiration date with the /PWDLIFETIME qualifier.
|-
| DISIMAGE || Prevents the user from executing RUN and foreign commands. By default, a user can execute RUN and foreign commands (NODISIMAGE).
|-
| DISMAIL || Disables mail delivery to the user. By default, mail delivery is enabled (NODISMAIL).
|-
| DISNEWMAIL || Suppresses announcements of new mail at login. By default, the system announces new mail (NODISNEWMAIL).
|-
| DISPWDDIC || Disables automatic screening of new passwords against a system dictionary. By default, passwords are automatically screened (NODISPWDDIC).
|-
| DISPWDHIS || Disables automatic checking of new passwords against a list of the user's old passwords. By default, the system screens new passwords (NODISPWDHIS).
|-
| DISPWDSYNCH || Suppresses synchronization of the external password for this account. See bit 9 in the SECURITY_POLICY system parameter for systemwide password synchronization control.
|-
| DISRECONNECT || Disables automatic reconnection to an existing process when a terminal connection has been interrupted. By default, automatic reconnection is enabled (NODISRECONNECT).
|-
| DISREPORT || Suppresses reports of the last login time, login failures, and other security reports. By default, login information is displayed (NODISREPORT).
|-
| DISUSER || Disables the account so the user cannot log in. For example, the DEFAULT account is disabled.
|-
| DISWELCOME || Suppresses the welcome message (an informational message displayed during a local login). This message usually indicates the version number of the operating system that is running and the name of the node on which the user is logged in. By default, a system login message appears (NODISWELCOME).
|-
| EXTAUTH || Considers user to be authenticated by an external user name and password, not by the SYSUAF user name and password. (The system still uses the SYSUAF record to check a user's login restrictions and quotas and to create the user's process profile.)
|-
| GENPWD || Restricts the user to generated passwords. By default, users choose their own passwords (NOGENPWD).
|-
| LOCKPWD || Prevents the user from changing the password for the account. By default, users can change their passwords (NOLOCKPWD).
|-
| PWD_EXPIRED || Marks a password as expired. The user cannot log in if this flag is set. The LOGINOUT.EXE image sets the flag when both of the following conditions exist: a user logs in with the DISFORCE_PWD_CHANGE flag set, and the user's password expires. A system manager can clear this flag. By default, passwords are not expired after login (NOPWD_EXPIRED).
|-
| PWD2_EXPIRED || Marks a secondary password as expired. Users cannot log in if this flag is set. The LOGINOUT.EXE image sets the flag when both of the following conditions exist: a user logs in with the DISFORCE_PWD_CHANGE flag set, and the user's password expires. A system manager can clear this flag. By default, passwords are not set to expire after login (NOPWD2_EXPIRED).
|-
| PWDMIX || Enables case-sensitive and extended-character passwords. After PWDMIX is specified, you can then use mixed-case and extended characters in passwords. Be aware that before the PWDMIX flag is enabled, the system stores passwords in all upper-case. Therefore, until you change passwords, you must enter your pre-PWDMIX passwords in upper-case.
|-
| RESTRICTED || Prevents the user from changing any defaults at login (for example, by specifying /LGICMD) and prohibits user specification of a CLI with the /CLI qualifier. The RESTRICTED flag establishes an environment where Ctrl/Y interrupts are initially turned off; however, command procedures can still turn on Ctrl/Y interrupts with the DCL command SET CONTROL=Y. Typically, this flag is used to prevent an applications user from having unrestricted access to the CLI. By default, a user can change defaults (NORESTRICTED).
|-
| VMSAUTH || Allows account to use standard (SYSUAF) authentication when the EXTAUTH flag would otherwise require external authentication. This depends on the application. An application specifies the VMS domain of interpretation when calling SYS$ACM to request standard VMS authentication for a user account that normally uses external authentication.
|}

← Older revision		Revision as of 09:18, 12 December 2019
Line 8:		Line 8:
	! Flag !! Description		! Flag !! Description
	\|-		\|-
	\| AUDIT \|\| Enables or disables mandatory security auditing for a specific user. By default, the system does not audit the activities of specific users (NOAUDIT).		\| AUDIT \|\| Enables or disables mandatory [[Security Auditing\|security auditing]] for a specific user. By default, the system does not audit the activities of specific users (NOAUDIT).
	\|-		\|-
	\| AUTOLOGIN \|\| Restricts the user to the automatic login mechanism when logging in to an account. When set, the flag disables login by any terminal that requires entry of a user name and password.		\| AUTOLOGIN \|\| Restricts the user to the automatic login mechanism when logging in to an account. When set, the flag disables login by any terminal that requires entry of a user name and password.
	\|-		\|-
	\| CAPTIVE \|\| Prevents the user from changing any defaults at login, for example, /CLI or /LGICMD. It prevents the user from escaping the captive login command procedure specified by the /LGICMD qualifier and gaining access to the DCL command level. The CAPTIVE flag also establishes an environment where Ctrl/Y interrupts are initially turned off; however, command procedures can still turn on Ctrl/Y interrupts with the DCL command SET CONTROL=Y. By default, an account is not captive (NOCAPTIVE).		\| CAPTIVE \|\| Prevents the user from changing any defaults at login, for example, /CLI or /LGICMD. It prevents the user from escaping the captive [[LOGIN.COM\|login command procedure]] specified by the /LGICMD qualifier and gaining access to the DCL command level. The CAPTIVE flag also establishes an environment where Ctrl/Y interrupts are initially turned off; however, command procedures can still turn on Ctrl/Y interrupts with the DCL command [[SET CONTROL]]=Y. By default, an account is not captive (NOCAPTIVE).
	\|-		\|-
	\| DEFCLI \|\| Restricts the user to the default command interpreter by prohibiting the use of the /CLI qualifier at login. By default, a user can choose a CLI (NODEFCLI).		\| DEFCLI \|\| Restricts the user to the default [[CLI\|command interpreter]] by prohibiting the use of the /CLI qualifier at login. By default, a user can choose a [[CLI]] (NODEFCLI).

	\|-		\|-
Line 21:		Line 21:
	\| DISFORCE_PWD_CHANGE \|\| Removes the requirement that a user must change an expired password at login. By default, a person can use an expired password only once (NODISFORCE_PWD_CHANGE) and then is forced to change the password after logging in. If the user does not select a new password, the user is locked out of the system. To use this feature, set a password expiration date with the /PWDLIFETIME qualifier.		\| DISFORCE_PWD_CHANGE \|\| Removes the requirement that a user must change an expired password at login. By default, a person can use an expired password only once (NODISFORCE_PWD_CHANGE) and then is forced to change the password after logging in. If the user does not select a new password, the user is locked out of the system. To use this feature, set a password expiration date with the /PWDLIFETIME qualifier.
	\|-		\|-
	\| DISIMAGE \|\| Prevents the user from executing RUN and foreign commands. By default, a user can execute RUN and foreign commands (NODISIMAGE).		\| DISIMAGE \|\| Prevents the user from executing RUN and foreign commands. By default, a user can execute [[RUN]] and [[Foreign Command\|foreign commands]] (NODISIMAGE).
	\|-		\|-
	\| DISMAIL \|\| Disables mail delivery to the user. By default, mail delivery is enabled (NODISMAIL).		\| DISMAIL \|\| Disables [[MAIL\|mail]] delivery to the user. By default, mail delivery is enabled (NODISMAIL).
	\|-		\|-
	\| DISNEWMAIL \|\| Suppresses announcements of new mail at login. By default, the system announces new mail (NODISNEWMAIL).		\| DISNEWMAIL \|\| Suppresses announcements of new mail at login. By default, the system announces new mail (NODISNEWMAIL).
	\|-		\|-
	\| DISPWDDIC \|\| Disables automatic screening of new passwords against a system dictionary. By default, passwords are automatically screened (NODISPWDDIC).		\| DISPWDDIC \|\| Disables automatic screening of new passwords against a [[System Password Dictionary\|system dictionary]]. By default, passwords are automatically screened (NODISPWDDIC).
	\|-		\|-
	\| DISPWDHIS \|\| Disables automatic checking of new passwords against a list of the user's old passwords. By default, the system screens new passwords (NODISPWDHIS).		\| DISPWDHIS \|\| Disables automatic checking of new passwords against a [[Password History\|list of the user's old passwords]]. By default, the system screens new passwords (NODISPWDHIS).
	\|-		\|-
	\| DISPWDSYNCH \|\| Suppresses synchronization of the external password for this account. See bit 9 in the SECURITY_POLICY system parameter for systemwide password synchronization control.		\| DISPWDSYNCH \|\| Suppresses synchronization of the external password for this account. See bit 9 in the SECURITY_POLICY system parameter for systemwide password synchronization control.
Line 39:		Line 39:
	\| DISUSER \|\| Disables the account so the user cannot log in. For example, the DEFAULT account is disabled.		\| DISUSER \|\| Disables the account so the user cannot log in. For example, the DEFAULT account is disabled.
	\|-		\|-
	\| DISWELCOME \|\| Suppresses the welcome message (an informational message displayed during a local login). This message usually indicates the version number of the operating system that is running and the name of the node on which the user is logged in. By default, a system login message appears (NODISWELCOME).		\| DISWELCOME \|\| Suppresses the [[Welcome Message\|welcome message]] (an informational message displayed during a local login). This message usually indicates the version number of the operating system that is running and the name of the node on which the user is logged in. By default, a system login message appears (NODISWELCOME).
	\|-		\|-
	\| EXTAUTH \|\| Considers user to be authenticated by an external user name and password, not by the SYSUAF user name and password. (The system still uses the SYSUAF record to check a user's login restrictions and quotas and to create the user's process profile.)		\| EXTAUTH \|\| Considers user to be authenticated by an external user name and password, not by the SYSUAF user name and password. (The system still uses the SYSUAF record to check a user's login restrictions and quotas and to create the user's process profile.)
Line 53:		Line 53:
	\| PWDMIX \|\| Enables case-sensitive and extended-character passwords. After PWDMIX is specified, you can then use mixed-case and extended characters in passwords. Be aware that before the PWDMIX flag is enabled, the system stores passwords in all upper-case. Therefore, until you change passwords, you must enter your pre-PWDMIX passwords in upper-case.		\| PWDMIX \|\| Enables case-sensitive and extended-character passwords. After PWDMIX is specified, you can then use mixed-case and extended characters in passwords. Be aware that before the PWDMIX flag is enabled, the system stores passwords in all upper-case. Therefore, until you change passwords, you must enter your pre-PWDMIX passwords in upper-case.
	\|-		\|-
	\| RESTRICTED \|\| Prevents the user from changing any defaults at login (for example, by specifying /LGICMD) and prohibits user specification of a CLI with the /CLI qualifier. The RESTRICTED flag establishes an environment where Ctrl/Y interrupts are initially turned off; however, command procedures can still turn on Ctrl/Y interrupts with the DCL command SET CONTROL=Y. Typically, this flag is used to prevent an applications user from having unrestricted access to the CLI. By default, a user can change defaults (NORESTRICTED).		\| RESTRICTED \|\| Prevents the user from changing any defaults at login (for example, by specifying /LGICMD) and prohibits user specification of a [[CLI]] with the /CLI qualifier. The RESTRICTED flag establishes an environment where Ctrl/Y interrupts are initially turned off; however, command procedures can still turn on Ctrl/Y interrupts with the DCL command SET CONTROL=Y. Typically, this flag is used to prevent an applications user from having unrestricted access to the CLI. By default, a user can change defaults (NORESTRICTED).
	\|-		\|-
	\| VMSAUTH \|\| Allows account to use standard (SYSUAF) authentication when the EXTAUTH flag would otherwise require external authentication. This depends on the application. An application specifies the VMS domain of interpretation when calling SYS$ACM to request standard VMS authentication for a user account that normally uses external authentication.		\| VMSAUTH \|\| Allows account to use standard ([[SYSUAF]]) authentication when the EXTAUTH flag would otherwise require external authentication. This depends on the application. An application specifies the VMS domain of interpretation when calling SYS$ACM to request standard VMS authentication for a user account that normally uses external authentication.
	\|}		\|}