Great Circle Associates Firewalls
(March 1994)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: RE: Telnet application gateway and VMS loginout.exe
From: Thomas Hutton <hutton @ SDSC . EDU>
Date: Thu, 17 Mar 94 01:07:23 PST
To: firewalls @ GreatCircle . COM

----- Begin Included Message -----

>From gkn @
 TGV .
 COM Wed Mar 16 22:51:32 1994
Date:    Wed, 16 Mar 94 22:47:23 PST
From: gkn @
 TGV .
 COM (Gerard K. Newman)
Subject: RE: Telnet application gateway and VMS loginout.exe
To: hutton @
 Sdsc .
 Edu, tri @
 psulias .
 psu .
 edu
Organization: TGV, Inc.
X-St-Vmsmail-To: ST%"hutton @
 SDSC .
 EDU"
Content-Length: 1791


> Do any of you VMS wizards out there know of a way to grab an incoming Telnet
> connection request, and based on the source IP address, allow the telnet connection to
> a specific username.  I'm aware of the VMS ALF utility and how you can match
> specific ip addresses to specific usernames.  I would like to be able to  
> force logins to specific usernames if the ip address is NOT in the ALF table,
> or forces users from specific networks or subnets to a specific captive login
> account.   Ever hear of anything like this?

If you're running MultiNet, you've got two ways to do this;  if not, perhaps only
one.  I'll start with the common one.

You can replace the DEC-supplied LOGINOUT image with one of your own, which makes
whatever checks you'd like and then $CREPRC's a newly-logged in process with the
right username with it's SYS${INPUT,OUTPUT,ERROR} pointed at the terminal device,
otherwise transferring control to the real DEC loginout.  The only real trick
here is that when you make this image you have to set it's base VA way up in
space to allow room for the real loginout to be mapped where it expects to be.
I can mail you example code that does this that I used in a past life to do
something oddball (don't ask) with incoming logins.

The other choice would be to write your own TELNET server, which, when confronted
with whatever criteria you like about the source address would $CREPRC a logged-in
process tied to the proper network terminal, else just doing what the standard
TELNET server does.  I can also send you a template TELNET server if you'd
prefer (and can use;  it's MultiNet-specific) this approach.

Cheers,

Gerard K. Newman | TGV, Inc.  101 Cooper St. | +1 408 457 5200 (voice)
gkn @
 tgv .
 com      | Santa Cruz, CA 95060-4526 | +1 408 457 5208 (fax)


----- End Included Message -----



Indexed By Date Previous: Firewalls loop fixed (I think)
From: Brent Chapman <brent @ mycroft . GreatCircle . COM>
Next: Interlock : Opinions & Experiences?
From: R . P . Handy @ ste0411 . wins . icl . co . uk
Indexed By Thread Previous: Telnet application gateway and VMS loginout.exe
From: Tom Irwin - 865-1818 <TRI @ psulias . psu . edu>
Next: Re: SOCKS rftp problem
From: pjh70 @ eng . amdahl . com (Patrick J Horgan)

Google
 
Search Internet Search www.greatcircle.com