Site Home Articles Web Forum File Archive Web Store Top Navigation
 
News
Site News
Tech News
Open News
Debate & Rants
Submit News

Archive
Archive
Articles
Games
Reading
Reviews
Videos
Old KBase
Old Archive

Interaction
IRC Chat
Web Forum

Resources
Anonymity
Dist. Computing
DNS Tools
File Sharing
Gatherings
Terminology
Virus Advisory
Zine Listing

Other
Encrypt
Store
Photo Album

Links
Outward Links
Request Swap
Link to Us

Add Content
Submit Article
Submit Book
Submit FAQ
Submit Game
Submit Files
Submit Review
Submit Terminology
Submit Video

Connect
About
Advertising
Contact
Donate
Jobs

View us Online
Twitter
Facebook

Assistance
Official FAQ
Official Rules
 
Quick Links
Get Firefox!
GoNix.org
DollarDNS
 

VAX VMS Authorize Utility

Posted: October 6th, 2009 Author: Line Shadow

Using the VAX/VMS Authorize Utility
Written by Line Shadow on 09/10/88

A Telecom Computer Security Bulletin File Volume One, Number 1, File 9 of 12

--------------------------------------------------------------------------------
Time to play God with your favorite

___ ___ ___ ___ ___ ___ ___
| | | | | | | |
| d | i | g | i | t | a | l |
|___|___|___|___|___|___|___|

VAX/VMS System
In order to put this article to good use, you will have to acquire a high priviledged VAX account. I'm leaving that up to you, as this article is intended for the more advanced VAX hacker. You can expect another article discussing the tricks of the trade as regards getting an account with priviledges of that sort in future articles. Until then, you're on your own.

This is a reference on how to use a powerful utility within VMS that will allow you to create accounts on a digital VAX system. This utility, called the Authorize Utility is located on every VAX system. It can be found in the
SYS$SYSTEM directory (which is a logical name for SYS$SYSROOT:[SYSEXE

  • ) under the filename AUTHORIZE.EXE. This is the actual program and you just RUN it.
    Along with tons of other files within SYS$SYSTEM, you will find two other files that are manipulated by the Authorize Utility.

    Quick definitions for the Command Syntax:
    ===============================================================================
    Qualifier - A qualifier is an optional extension of a main command
    (discussed below) whose format consists of:
    command/qualifier
    Use of brackets - Use of brackets ('[' and ']') placed around a logical-
    name indicates that the enclosed item is optional.
    Except in the case of specifying directories which
    has to have the brackets around the directory name.
    Also note that parenthesis arounf a logical name are
    required when noted as such.
    file-spec,... - Indicates that additional parameters, values, or
    information can be entered.

    Command Syntax: UAF> command [parameter]
    --------------------------------------------------------------------------------

    ADD

    /[NO]ACCESS[=(range[,...])]
    /ACCOUNT=account-name
    /[NO]ADD_IDENTIFIER
    /ATTRIBUTES=(keyword[,...])
    /[NO]BATCH[=(range[,...])]
    /BIOLM=value
    /BYTLM=value
    /CLI=cli-name
    /CLITABLES=clitable-name
    /CPUTIME=time
    /DEFPRIVILEGES=([NO]privname[,...])
    /DEVICE=name
    /[NO]DIALUP[=(range[,...])]
    /DIOLM=value
    /DIRECTORY=directory-name
    /ENQLM=value
    /EXPIRATION=time
    /FILLM=value
    /GENERATE_PASSWORD[=keyword]
    /FLAGS=([NO]option[,...])
    /[NO]INTERACTIVE[=(range[,...])]
    /JTQUOTA=value
    /LGICMD=file-spec
    /[NO]LOCAL[=(range[,...])]
    /MAXACCTJOBS=value
    /MAXDETACH=value
    /MAXJOBS=value
    /[NO]NETWORK[=(range[,...])]
    /OWNER=owner-name
    /[NO]PASSWORD=(password[,password2])
    /PFLAGS=([NO]option[,...])
    /PGFLQUOTA=value
    /PRCLM=value
    /P_RESTRICT=(range[,...])
    /PRIMEDAYS=([NO]day[,...])
    /PRIORITY=value
    /PRIVILEGES=([NO]privname[,...])
    /[NO]PWDEXPIRED
    /[NO]PWDLIFETIME=time
    /PWDMINIMUM=value
    /QUEPRIORITY=value
    /[NO]REMOTE[=(range[,...])]
    /SFLAGS=([NO]option[,...])
    /SHRFILLM=value
    /S_RESTRICT=(range[,...])
    /TQELM=value
    /UIC=uic
    /WSDEFAULT=value
    /WSEXTENT=value
    /WSQUOTA=value


    ADD/IDENTIFIER


    /ATTRIBUTES=(keyword[,...])
    /USER=user-spec
    /VALUE=value-specifier


    ADD/PROXY
    COPY

    (Same qualifiers as ADD)

    CREATE/PROXY
    CREATE/RIGHTS
    DEFAULT

    (Same qualifiers as ADD)

    EXIT
    GRANT/IDENTIFIER

    /ATTRIBUTES=(keyword[,...])

    HELP

    (All commands and qualifiers)

    LIST

    /BRIEF
    /FULL

    LIST/IDENTIFIER

    /BRIEF
    /FULL
    /USER=user-spec
    /VALUE=value-specifier

    LIST/PROXY
    LIST/RIGHTS

    /USER=user-spec

    MODIFY

    /[NO]ACCESS[=(range[,...])]
    /ACCOUNT=account-name
    /ASTLM=value
    /[NO]BATCH[=(range[,...])]
    /BIOLM=value
    /BYTLM=value
    /CLI=cli-name
    /CLITABLES=clitable-name
    /CPUTIME=time
    /DEFPRIVILEGES=([NO]privname[,...])
    /DEVICE=name
    /[NO]DIALUP[=(range[,...])]
    /DIOLM=value
    /DIRECTORY=directory-name
    /ENQLM=value
    /EXPIRATION=time
    /FILLM=value
    /FLAGS=([NO]option[,...])
    /[NO]INTERACTIVE[=(range[,...])]
    /JTQUOTA=value
    /LGICMD=file-spec
    /[NO]LOCAL[=(range[,...])]
    /MAXACCTJOBS=value
    /MAXDETACH=value
    /MAXJOBS=value
    /[NO]MODIFY_IDENTIFIER
    /[NO]NETWORK[=(range[,...])]
    /OWNER=owner-name
    /PASSWORD=(password[,password2])
    /PFLAGS=([NO]option[,...])
    /PGFLQUOTA=value
    /PRCLM=value
    /P_RESTRICT=(range[,...])
    /PRIMEDAYS=([NO]day[,...])
    /PRIORITY=value
    /PRIVILEGES=([NO]privname[,...]!
    /[NO]PWDEXPIRED
    /[NO]PWDLIFETIME=time
    /PWDMINIMUM=value
    /QUEPRIORITY=value
    /[NO]REMOTE[=(range[,...])]
    /SFLAGS=([NO]option[,...])
    /SHRFILLM=value
    /S_RESTRICT=(range[,...])
    /TQELM=value
    /UIC=uic
    /WSDEFAULT=value
    /WSEXTENT=value
    /WSQUOTA=value

    MODIFY/IDENTIFIER

    /ATTRIBUTES=(keyword[,...])
    /HOLDER=holder-name
    /NAME=id-name
    /VALUE=value-specifier

    MODIFY/SYSTEM_PASSWORD=system-password
    REMOVE

    /[NO]REMOVE_IDENTIFIER

    REMOVE/PROXY
    RENAME

    /PASSWORD[=(password[,password2])]
    /[NO]MODIFY_IDENTIFIER

    RENAME/IDENTIFIER
    REVOKE/IDENTIFIER
    SHOW

    /BRIEF

    SHOW/IDENTIFIER

    /BRIEF
    /FULL
    /USER=user-spec
    /VALUE=value-specifier

    SHOW/PROXY
    SHOW/RIGHTS

    /USER=user-spec

    Description:
    --------------------------------------------------------------------------------
    Using Authorize, you control access to the system and its resources by
    o Creating new records and modifying existing records in the system user authorization file (SYS$SYSTEM:SYSUAF.DAT) and the network user authorization
    file (SYS$SYSTEM:NETUAF.DAT)
    o Creating new records and modifying existing records in the rights database file (SYS$SYSTEM:RIGHTSLIST.DAT)


    Command Summary:
    --------------------------------------------------------------------------------

    ADD
    --------------------------------------------------------------------------------
    The ADD command will create a new entry in the user authorization file.

    Format for creating new entries in SYSUAF.DAT:
    ADD newusername [/qualifiers]

    Qualifiers:
    /ACCESS
    /[NO]ACCESS=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...]) /[NO]ACCESS="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

    Used to specify hours of access for all modes of logins. Specify hours as integers from 0 to 23, inclusive. Hours may be specified as single hours (n),
    or as ranges of hours (n-m). If the ending hour of a range is earlier than the starting hour, the range extends from the starting hour through midnight
    to the the ending hour. The first set of hours after the keyword PRIMARY specifies hours on primary days; the second set of hours after the keyword
    SECONDARY specifies hours on secondary days.

    All the list elements are optional. If no hours are specified for a day type, access is permitted the entire day. If only primary hours or only secondary
    hours are given, no access is permitted for secondary or primary days, respectively. If hours are given with no day type, they apply to both types of days.

    Negating the qualifier by specifying /NOACCESS=(...) completely inverts the sense of the access hours.

    Examples:
    /ACCESS allows unrestricted access
    /NOACCESS=SECONDARY allows access on primary days only
    /ACCESS=(9-17) allows access from 9am through 5 pm on all days
    /NOACCESS=(PRIMARY, 9-17, SECONDARY, 18-8) allows access from 9 through 5 on secondary days and all but 9 through 5 on primary days
    /ACCESS="Primary: 9-16; Secondary: 18-7, 8; Primary: 17"
    allows access from 9 through 5 on primary days and all but 9 through 5 on secondary days

    To specify access hours for specific types of logins, see the /BATCH, /NETWORK, /INTERACTIVE, /LOCAL, /DIALUP, and /REMOTE qualifiers.

    /ACCOUNT
    /ACCOUNT=account-name

    Specifies a default account name. This field is often used for billing purposes, and should consist of 1 through 8 characters.

    /ADD_IDENTIFIER
    /[NO]ADD_IDENTIFIER

    Controls whether an identifier corresponding to the specified username and UIC is added to the rights database. The default is /ADD_IDENTIFIER.

    /ASTLM
    /ASTLM=n

    Specifies the AST queue limit, which is the total number of asynchronous system trap operations and scheduled wakeup requests that can be outstanding
    at one time for the user.

    /BATCH
    /[NO]BATCH=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...]) /[NO]BATCH="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

    Specifies hours of access permitted for batch jobs. For a detailed description of the interpretation of the access specification, see the /ACCESS qualifier.

    /BIOLM
    /BIOLM=n

    Specifies the total buffered I/O operations that can be outstanding at one time.

    /BYTLM
    /BYTLM=n

    Total number of bytes that can be specified for transfer in outstanding buffered I/O operations.

    /CLI
    /CLI=cli-name

    Name of the default command interpreter.

    /CLITABLES
    /CLITABLES=table-name

    Name of the default command interpreter tables.

    /CPUTIME
    /CPUTIME=delta-time

    Maximum amount of CPU time a user process can take per session. The unit of time must be in delta format. 0 means infinite.

    /DEFPRIVILEGES
    /DEFPRIVILEGES=([NO]privname [,...])

    Specifies the default privileges for the user (i.e., those enabled at login time). A NO prefix removes this privilege from the user; specifying a
    privilege without the NO prefix allows the user that privilege.

    There are many privileges available with varying degrees of power and potential system impact. Please see the VAX/VMS System Manager's Reference Manual for a more detailed discussion of the available privileges.

    /DEVICE
    /DEVICE=device-name

    Name of default device (must be a direct access device) from one to fifteen characters. The colon is automatically added if omitted. A blank device
    is interpreted as SYS$SYSDISK.

    /DIALUP
    /[NO]DIALUP=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...]) /[NO]DIALUP="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

    Specifies hours of access permitted for interactive login via dialup terminals. For a detailed description of the interpretation of the access specification,
    see the /ACCESS qualifier.

    /DIOLM
    /DIOLM=n

    Total direct (usually disk) I/O operations that can be outstanding at one time.

    /DIRECTORY
    /DIRECTORY=directory-name

    Name of default login directory. Brackets (either

  • or <>) must be supplied.

    /ENQLM
    /ENQLM=n

    Total number of lock requests which may be outstanding at one time.

    /EXPIRATION
    /EXPIRATION=time

    Expiration date and time of the account. Specify as an absolute or combination time.

    /FILLM
    /FILLM=n

    Total number of files that can be open at one time, including active network logical links.

    /FLAGS
    /FLAGS=([NO]option[,...])

    Login flags for this user. Options which may be specified are:
    [NO]AUDIT - [do not] audit all security relevant actions
    [NO]AUTOLOGIN - [do not] restrict this account to autologins only
    [NO]CAPTIVE - [do not] prevent user
    [NO]DEFCLI - [do not] prevent user from changing default CLI or CLI tables
    [NO]DISCTLY - [do not] disable interrupts
    [NO]DISMAIL - [do not] prevent mail delivery to this user
    [NO]DISNEWMAIL - [do not] suppress "New Mail..." announcements [NO]DISRECONNECT-[do not] disable automated reconnections
    [NO]DISREPORT - [do not] disable time of last login and other security reports
    [NO]DISUSER - [do not] disable this account completely
    [NO]DISWELCOME - [do not] suppress "Welcome to..." login message [NO]GENPWD - [do not] require user to use generated passwords
    [NO]LOCKPWD - [do not] prevent user from changing password
    [NO]PWD_EXPIRED- [do not] mark password as expired
    [NO]PWD2_EXPIRED-[do not] mark second password as expired

    /GENERATE
    /GENERATE
    /GENERATE=CURRENT
    /GENERATE=PRIMARY
    /GENERATE=SECONDARY
    /GENERATE=BOTH
    /GENERATE=ALL

    Generate a random password. The formats of the passwords is the same as for the DCL SET PASSWORD /GENERATE command.

    /INTERACTIVE
    /[NO]INTERACTIVE=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...]) /[NO]INTERACTIVE="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:]
    [n][,...]"

    Specifies hours of access permitted for interactive login via any terminal. For a detailed description of the interpretation of the /ACCESS qualifier.

    /JTQUOTA
    /JTQUOTA=n

    Specifies the initial byte quota with which the job-wide logical name table is to be created with.

    /LGICMD
    /LGICMD=filespec

    Name of login command file. Default device and directory are used to locate the command file.

    /LOCAL
    /[NO]LOCAL=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...]) /[NO]LOCAL="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

    Specifies hours of access permitted for interactive login via local terminals. For a detailed description of the interpretation of the access specification, see the /ACCESS qualifier.

    /MAXACCTJOBS
    /MAXACCTJOBS=n

    Interactive and detached processes which may be active at one time for all users which are on the same account as the user for which the qualifier is present.

    /MAXDETACH
    /MAXDETACH=n

    Specifies the maximum number of detached processes with this username that may be active at one time. Processes which cause this count to be exceeded are
    terminated.

    /MAXJOBS
    /MAXJOBS=n

    Maximum number of interactive, batch, and detached processes with this username which can be active at one time. Processes which cause this count to
    be exceeded are terminated.

    /NETWORK
    /[NO]NETWORK=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...]) /[NO]NETWORK="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

    Specifies hours of access permitted for network jobs. For a detailed description of the interpretation of the access specification, see the /ACCESS
    qualifier.

    /OWNER
    /OWNER=owner-name

    Name of owner for billing purposes, etc. May be from one to 31 characters.
    /PASSWORD
    /PASSWORD=(password [,password2])
    /NOPASSWORD

    Password(s) for login. Must be from 0 to 31 characters in length, and must be composed of alphanumeric characters, dollar signs, and underscores.

    To set the first password with no second password, specify
    /PASSWORD=password

    To set both passwords, specify
    /PASSWORD=(password, password2)

    To set only the first password leaving the second alone, specify
    /PASSWORD=(password, "")

    To set only the second password leaving the first alone, specify
    /PASSWORD=("", password2)

    To clear the second password leaving the first alone, specify
    /PASSWORD=""

    To clear both passwords, specify
    /NOPASSWORD
    /PBYTLM
    /PBYTLM=n

    Paged pool byte count limit.

    /PFLAGS
    /PFLAGS=([NO]option[,...])

    This qualifier is obsolete and is retained for compatibility purposes. For current usage, see the /ACCESS, etc., qualifiers.

    Login flags for primary days. Options are:
    [NO]DISDIALUP - [do not] prohibit user from dialing in [NO]DISNETWORK - [do not] prohibit user from logging in via a "SET HOST" command.

    /PGFLQUOTA
    /PGFLQUOTA=n

    Total pages that this process can use in the system paging file. Should be a minimum of 2048 for a typical interactive process.

    /P_RESTRICT
    /P_RESTRICT=(n-m[,...])
    or
    /P_RESTRICT=(n[,...])

    This qualifier is obsolete and is retained for compatibility purposes. For current usage, see the /ACCESS, etc., qualifiers.

    Used to specify hours or ranges of hours to restrict user from logging in on primary days.

    /P_RESTRICT=(...) is roughly equivale7t to /NOACCESS=(PRIMARY, ...)
    /PRCLM
    /PRCLM=n

    Total number of subprocesses that can exist at one time.

    /PRIMEDAYS
    /PRIMEDAYS=([NO]day[,...])

    Used to define primary and secondary days. A day prefixed with NO becomes a secondary day, and a day without the NO prefix is defined as a primary day.
    Primary and secondary day definitions are used in conjunction with the /ACCESS, etc., qualifiers.

    /PRIORITY
    /PRIORITY=n

    Default base priority for user. The priority should be in the range from 0 - 31, and 4 is the default for a timesharing user.

    /PRIVILEGES
    /PRIVILEGES=([NO]privname[,...])

    Specifies authorized privileges for this user. Privileges which are allowed or disallowed for this user. A NO prefix removes this privalege from the user;
    specifying a privilege without the NO prefix allows the user that privilege.

    There are many privileges available with varying degrees of power and potential system impact. I will make up a list of the priviledges in a future article, until then...set them to ALL! Heheh...

    /PWDEXPIRED
    /[NO]PWDEXPIRED

    Password is [not] pre-expired. When a password is pre-expired, the user is allowed to log in once, at which time he must change his password or be locked out of the system.

    /PWDLIFETIME
    /PWDLIFETIME=delta-time
    /PWDLIFETIME=NONE

    Password lifetime. If the date of last password change is older than the password lifetime, when the user logs in, he is issued a warning message and
    the password is marked as expired. If there is no password lifetime, the password never expires.

    Delta-time is in the form: [dddd-] [hh:mm:ss.cc]

    /PWDMINIMUM
    /PWDMINIMUM=n

    Minimum password length in characters. Note that this value is only enforced by the SET PASSWORD command; passwords in violation of this value may be
    specified to AUTHORIZE.

    /QUEPRIORITY
    /QUEPRIORITY=n

    Maximum priority for queuing batch and print jobs. The priority should be in the range from 0 - 31, and 4 is the default value for a timesharing user.

    /REMOTE
    /[NO]REMOTE=([PRIMARY], [n-m], [n] [,...] [SECONDARY], [n-m], [n] [,...]) /[NO]REMOTE="[PRIMARY][:] [n-m][,] [n][,...][;] [SECONDARY][:] [n-m][,...]"

    Specifies hours of access permitted for interactive login via network remote terminals (i.e., SET HOST). For a detailed description of the interpretation
    of the access specification, see the /ACCESS qualifier.

    /SFLAGS
    /SFLAGS=([NO]option[,...])

    This qualifier is obsolete and is retained for compatibility purposes. For current usage, see the /ACCESS, etc., qualifiers.
    Login flags for secondary days. Options are:
    [NO]DISDIALUP - [do not] prohibit user from dialing in [NO]DISNETWORK - [do not] prohibit user from logging in via a "SET HOST" command.

    /S_RESTRICT
    /S_RESTRICT=(n-m[,...])
    or
    /S_RESTRICT=(n[,...])

    This qualifier is obsolete and is retained for compatibility purposes. For current usage, see the /ACCESS, etc., qualifiers.

    Used to specify hours or ranges of hours to restrict user from logging in on secondary days.

    /S_RESTRICT=(...) is roughly equivalent to /NOACCESS=(SECONDARY, ...)
    /SHRFILLM
    /SHRFILLM=n

    Maximum number of shared files allowed to be open at one time.

    /TQELM
    /TQELM=n

    Total entries in the timer queue plus the number of temporary common event flag clusters that the user can have at one time.

    /UIC
    /UIC=uic

    User identification code as explained in the VAX/VMS System Manager's Reference Manual. The UIC should have an octal group number and user number, and be
    separated by a comma and enclosed in brackets.

    /WSDEFAULT
    /WSDEFAULT=n

    Initial limit of a working set for the user process.

    /WSEXTENT
    /WSEXTENT=n

    Maximum to which the user's process may raise its working set limit when there is free memory available.

    /WSQUOTA
    /WSQUOTA=n

    Maximum to which the user's process may raise the working set limit when system memory is in demand.

    ADD/IDENTIFIER
    --------------------------------------------------------------------------------
    The ADD/IDENTIFIER command is used to add an identifier to the rights database.

    Format:
    ADD/IDENTIFIER [id-name]

    Parameters:
    id-name
    specifies the name of the identifier to be added to the rights database. If you omit the name, you must specify the /USER qualifier. The id-name is a string of 1 through 32 alphanumeric characters that may contain underscores and dollar signs. The name must contain at least one non-numeric character.

    Qualifiers:
    /ATTRIBUTES
    /ATTRIBUTES=(keyword)

    Specifies attributes to be associated with the new identifier. Valid keywords are:
    [NO]DYNAMIC
    Indicates whether or not unprivileged holders of the identifier may add or remove the identifier from the process rights list. The default is NODYNAMIC.
    [NO]RESOURCE

    Indicates whether or not holders of the identifier may charge resources to it. The default is NORESOURCE.

    /USER
    /USER=user-spec

    Scans the UAF record(s) of the specified user(s) and creates the appropriate identifiers(s). Specify user-spec by username or UIC. You can user the asterisk
    wildcard to specify multiple usernames or UICs: full user of the asterisk and percent wildcards is permitted for user names.

    UICs must be in the form [,], [n,], [,n], or [n,n]. A wildcard username specification (i.e., *) creates identifiers alphabetically by username; a wildcard UIC specification (i.e., [,]) creates them in numerical order by UIC.

    /VALUE
    /VALUE=value-specifier

    Specifies the value to be attached to the identifier. Valid formats for the value-specifier are:

    IDENTIFIER:integer
    An integer value in the range of 32768 to 268435455, or a hexadecimal number in the range %X00008000 to 0FFFFFF UIC:uic
    A uic value in the standard UIC format

    Examples:
    The following examples illustrate the use of the ADD/IDENTIFIER command.

    1.
    UAF> ADD/IDENTIFIER/VALUE=UIC:[300,011] INVENTORY
    identifier INVENTORY value: [000300,000011] added to RIGHTSLIST.DAT
    This command adds to the rights database an identifier named INVENTORY. By default, the identifier is not marked as a resource.

    2.
    UAF> ADD/IDENTIFIER/ATTRIBUTES=(RESOURCE) -
    /VALUE=IDENTIFIER:%X80011 PAYROLL identifier PAYROLL value: %X80080011 added to RIGHTSLIST.DAT
    This command adds the identifier PAYROLL and marks it as a resource.

    ADD/PROXY
    Adds a user record to the network UAF.

    Format
    ADD/PROXY node::remote-user local-user

    Parameters:
    node
    specifies a node name (1 through 6 alphanumberic characters).

    remote-user
    specifies the username of a user at a remote node. If you specify an asterisk, all users at the specified node can access files of a user specified on the
    local node.

    local-user
    specifies the username of a user on a local node.

    Examples:
    1.
    UAF> ADD/PROXY MISHA::MARCO *
    record successfully added NETUAF.DAT
    The command in this example specifies that the user MARCO on the remote node MISHA can only access the files of MARCO on the local node.

    2.
    UAF> ADD/PROXY MISHA::* MARCO
    record successfully added to NETUAF.DAT
    The command in this example specifies that any user on the remote node MISHA can access the files of MARCO on the local node.

    Parameters:
    newusername

    "newusername" specifies the name of the user to be added to the user authorization file.

    COPY
    --------------------------------------------------------------------------------
    The COPY command is used to make a copy of a record in SYSUAF.DAT. The full range of qualifiers is available for the command in order to change certain
    fields in the process of the copy operation.

    Format:
    COPY existing-username new-username [/qualifiers]

    Parameters:
    existing-username new-username

    existing-username is the source authorization record; new-username is the destination authorization record.

    Qualifiers:
    (Same qualifiers as ADD)

    CREATE
    --------------------------------------------------------------------------------
    This command will create a Proxy Login File (NETUAF.DAT) if one does not already exist or the rights database (RIGHTSLIST.DAT).

    Qualifiers: /PROXY
    Creates and initializes a network UAF, NETUAF.DAT. The /PROXY qualifier is required. The file is created with no records and is assigned the following
    protection:
    (S:RWED,O:RWED,G:RWE,W)

    /RIGHTS
    Creates and initializes the rights database, RIGHTSLIST.DAT, If it does not already exist. The file is created with no records and is assigned the following
    protection:
    (S:RWED,0:RWED,G:RWE,W)

    Format
    CREATE/RIGHTS

    Qualifiers: Format CREAT/(PROXY or RIGHTS)/qualifier

    /SYSTEM_ID=(integer list)
    Specifies the system ID quadword. Only the first two integers are used. The first integer becomes the first longword of the system ID, and the second
    integer the second longword. If only one integer is specified, the second longword is set to 0.

    DEFAULT
    --------------------------------------------------------------------------------
    This command enables the user to change any field(s) in the DEFAULT record in SYSUAF.DAT.

    Format:
    DEFAULT /qualifier [/qualifiers]

    Qualifiers:
    (Same qualifiers as ADD)

    EXIT
    --------------------------------------------------------------------------------
    The EXIT command terminates AUTHORIZE and returns the user to command language level.

    Format:
    EXIT

    GRANT
    --------------------------------------------------------------------------------
    The GRANT command grants an identifier name to a user UIC. The /IDENTIFIER is required.

    Format
    GRANT/IDENTIFIER id-name user-spec

    Parameters:
    id-name

    Specifies the identifier name (see the ADD/IDENTIFIER command).

    user-spec
    Is an identifier (UIC or non UIC format) that specifies the user (see the ADD/IDENTIFIER command).

    Qualifier:
    /ATTRIBUTES
    /ATTRIBUTES=(keyword)

    See the ADD/IDENTIFIER command.

    Example:
    UAF> GRANT/IDENTIFIER INVENTORY [300,015]
    identifier INVENTORY granted to CRAMER

    The command in this example grants the identifier INVENTORY to a user with the UIC [300,015]. The user becomes the holder of the identifier and any resources
    associated with it.

    HELP
    --------------------------------------------------------------------------------
    Lists and explains the AUTHORIZE commands and qualifiers.

    Format

    HELP [commmand-name]

    Parameter:
    command-name

    Name of an AUTHORIZE command.

    Qualifier:
    qualifier-name

    Name of an AUTHORIZE qualifier

    LIST
    --------------------------------------------------------------------------------
    The LIST command outputs a listing file which gives information on the records specified. Unless otherwise specified by qualifiers, UAF records are listed.

    Qualifiers:
    /BRIEF
    This qualifier will give an abbreviated listing of the desired record(s). /BRIEF is equivalent to /NOFULL.

    /FULL
    This qualifier gives complete information on the desired record(s). /FULL is equivalent to /NOBRIEF. /FULL is the default.

    LIST/IDENTIFIER
    --------------------------------------------------------------------------------
    Creates a listing file (RIGHTLIST.LIS) to which identifier information is written.

    Format
    LIST/IDENTIFIER [id-name]

    Parameter:
    id-name

    Specifies an identifier name. If you omit the identifier name, you must specify /USER or /VALUE.

    Qualifiers:
    /USER
    /USER=user-spec

    Specifies one or more users whose identifiers are to be listed. User-spec may be a username or UIC. You can user the asterisk wildcard to specify multip
    le usernames or UICs: full use of the asterisk and percent wildcards is permitted for usernames.

    UICs must be in the form [,], [,n], or [n,]. A wildcard username specification (i.e., *) lists identifiers alphabetically by username; a wildcard UIC specification (i.e., [,]) lists them numerically by UIC.

    /VALUE
    /VALUE=value-specifier

    Specifies the value of the identifier to be listed. Valid formats for the value-specifier are:

    IDENTIFIER:integer
    An integer value in the range of 32768 to 268435455, or a hexadecimal number in the range %X00008000 to 0FFFFFFF UIC:uic

    A uic value in the standard UIC format

    Examples:
    UAF> LIST/IDENTIFIER INVENTORY
    writing listing file
    listing file RIGHTSLIST.LIS complete

    The command in this example generates a full listing for the identifier INVENTORY, including its value (in hexadecimal), holders, and attributes.

    UAF> LIST/IDENTIFIER/USER=ANDERSON
    writing listing file
    listing file SYSUAF.LIS complete

    This command lists an identifier associated with the user ANDERSON, along with its value and attributes. Note, however, that this is the same result you
    would produce had you specified ANDERSON's UIC with the following forms of the command:

    UAF> LIST/IDENTIFIER/USER=[300,015]
    or
    UAF> LIST/IDENTIFIER/VALUE=UIC:[300,015]

    LIST/PROXY
    --------------------------------------------------------------------------------
    Creates a listing file of all the network UAF records. The /PROXY qualifier is required.

    Format

    LIST/PROXY
    Example:
    UAF> LIST/PROXY

    writing listing file
    listing file NETUAF.LIS complete

    The command in this example creates a listing file of all the network UAF records.

    LIST/RIGHTS
    --------------------------------------------------------------------------------
    Lists the holders of the specified identifier, or, if /USER is specified, all identifiers held by the specified user(s).

    Format
    LIST/RIGHTS [id-name]

    Parameter:
    id-name

    This is the name of the identifier (usually the username) associated with the user. If id-name is omitted, you must specify the /USER qualifier.

    Qualifier:
    /USER
    /USER=user-spec

    Specifies a user whose identifiers are to be listed. User-spec may be a username or UIC. You can use the asterisk wildcard to specify multiple usernames
    or UICs: full user of the asterisk and percent wildcards is permitted for usernames.

    UICs must be in the form [,], [n,], [n,n] or [,n]. A wildcard username specification (i.e., *) or wildcard UIC specification (i.e., [,]) lists all identifiers held by users. The wildcard username specification lists holders' usernames alphabetically; the wildcard UIC specification lists them in the numerical order of their UICs.

    Example:
    UAF> LIST/RIGHTS PAYROLL writing listing file listing file RIGHTSLIST.LIS is complete

    The command is this example creates a listing file of all holders of the identifier PAYROLL.

    MODIFY
    --------------------------------------------------------------------------------
    This command allows the user to change any field(s) in any user authorization record(s). Wildcarding of usernames or UICs is allowed.

    Format:
    MODIFY user-spec /qualifier [/qualifiers]

    Qualifier's:
    The MODIFY qualifiers are very similar to the ADD qualifiers with the following exceptions:
    /[NO]MODIFY_IDENTIFIER rather than /[NO]ADD_IDENTIFIER with the same

    parameters
    /ASTLM
    /ASTLM=value

    Specifies the AST queue limit, which is the total number of asynchronous system trap operations and scheduled wakeup requests that can be outstanding at
    one time for the user.

    MODIFY/IDENTIFIER
    Modifies an identifier in the rights database.

    Format
    MODIFY/IDENTIFIER id-name
    Parameter:
    id-name

    Specifies the name of an identifier to be modified

    Qualifiers: /ATTRIBUTES
    /ATTRIBUTES=(keyword)

    Specifies attributes to be associated with the modified identifier. Valid keywords are:

    [NO]DYNAMIC
    Indicates whether or not unprivileged holders of the identifier may add or remove the identifier from the process rights list. The default is NODYNAMIC.
    [NO]RESOURCE Indicates whether or not holders of the identifier may charge resources to it. The default is NORESOURCE.

    If you specify RESOURCE, a holder named with the /HOLDER qualifier gains the right to charge resources to the identifier. If you specify /NORESOURCE, the holder loses the right to charge resources. If you specify NORESOURCE and do not name any holder (if /HOLDER is not specified), all holders lose the right to charge resources.

    /HOLDER
    /HOLDER=username

    Specifies the holder of an identifier whose attributes are to modified. /HOLDER is used only in conjunction with /ATTRIBUTES qualifier. If you specify /HOLDER, the /NAME and /VALUE qualifiers are ignored.

    /NAME
    /NAME=id-name

    Specifies a new id-name to be associated with the identifier.
    /VALUE
    /VALUE=value-specifier

    Specifies a new identifier value. Note, however, that an identifier value cannot be modified from a UIC to a non UIC format or vice versa. Valid formats for the value-specifier are:

    IDENTIFIER:integer
    An integer value in the range of 32768 to 268435455, or a hexadecimal number in the range %X00008000 to 0FFFFFFF UIC:uic

    A uic value in the standard UIC format
    Examples:
    UAF> MODIFY/IDENTIFIER/VALUE=UIC:[300,21] ACCOUNTING
    identifier ACCOUNTING modified

    The command in this example changes the old UIC value of the identifier ACCOUNTING to a new value.

    UAF> MODIFY/IDENTIFIER/ATTRIBUTES=NORESOURCE/HOLDER=ALLISON ACCOUNTING

    identifier ACCOUNTING modified

    The command in this example associates the attribute NORESOURCE with the identifier ACCOUNTING in ALLISON's holder record.

    MODIFY/SYSTEM_PASSWORD
    Sets the system password.

    Format
    MODIFY/SYSTEM_PASSWORD=system-password

    Parameters:
    user-spec

    The record(s) to be modified may be specified in a variety of ways:
    1) wildcarded username (standard DCL wildcarding)
    2) wildcarded UIC, as
    a) [,]
    b) [*,n]
    c) [n,*]
    3) specific username
    4) specific UIC

    REMOVE
    --------------------------------------------------------------------------------
    This command will remove a user authorization record from SYSUAF.DAT.

    Format for removing a record from SYSUAF.DAT:
    REMOVE username

    Parameters:
    username
    username is the name of the authorization record to be removed from SYSUAF.DAT.

    Qualifiers:
    /REMOVE_IDENTIFIER
    /[NO]REMOVE_IDENTIFIER

    Controls whether the identifier corresponding to the specified username in the rights database is removed. The default is /REMOVE_IDENTIFIER.

    REMOVE/IDENTIFIER
    Removes an identifier from the rights database.

    Format
    REMOVE/IDENTIFIER id-name

    Parameter:
    id-name

    Specifies the name of an identifier in the rights database.

    Example:
    UAF> REMOVE/IDENTIFIER Q1SALES
    record removed from RIGHTSLIST.DAT

    The command in this example deletes the identifier Q1SALES from the rights database.

    REMOVE/PROXY
    --------------------------------------------------------------------------------
    This qualifier changes the context of REMOVE command. Its presence indicates that the intention is to remove a record from the Proxy Login File, NETUAF.DAT.
    The format for removing a record from NETUAF.DAT is
    REMOVE/PROXY node::remoteusername

    Where "node::remoteusername" is an entry in NETUAF.DAT for the local node.

    RENAME
    This command will change the username for a record in the user authorization file, SYSUAF.DAT. The only parameter qualifier allowed for the RENAME command
    is the /PASSWORD qualifier.

    Format:
    RENAME old-username new-username [/PASSWORD=password]

    Qualifiers: /GENERATE
    /GENERATE
    /GENERATE=CURRENT
    /GENERATE=PRIMARY
    /GENERATE=SECONDARY
    /GENERATE=BOTH
    /GENERATE=ALL

    Generate a random password. The formats of the passwords is the same as for the DCL SET PASSWORD /GENERATE command.

    /MODIFY_IDENTIFIER
    /[NO]MODIFY_IDENTIFIER

    Controls whether the identifier corresponding to the specified username in the rights database is modified. The default is /MODIFY_IDENTIFIER.

    /PASSWORD
    /PASSWORD=(password [,password2])
    /NOPASSWORD

    Password(s) for login. Must be from 0 to 31 characters in length, and must be composed of alphanumeric characters, dollar signs, and underscores.

    To set the first password with no second password, specify
    /PASSWORD=password

    To set both passwords, specify
    /PASSWORD=(password, password2)

    To set only the first password leaving the second alone, specify
    /PASSWORD=(password, "")

    To set only the second password leaving the first alone, specify
    /PASSWORD=("", password2)

    To clear the second password leaving the first alone, specify
    /PASSWORD=""

    To clear both passwords, specify
    /NOPASSWORD

    It is important to specify new passwords for a renamed record. Since the user name is taken as part of the input for password verification, the old password
    with the new user name will not yield the same result as the original password and user name, and the verification will fail.


    RENAME/IDENTIFIER
    Renames an identifier in the rights database.

    Format
    RENAME/IDENTIFIER old-id-name new-id-name

    Parameters:
    old-id-name
    Specifies the name of an identifier to be renamed.


    new-id-name
    Specifies the new identifier name.


    Example:
    UAF> RENAME/IDENTIFIER Q1SALES Q2SALES

    identifier Q1SALES renamed

    The command in this example renames the identifier Q1SALES to Q2SALES.

    Parameters
    old-username new-username
    "old-username" is the username for the authorization record which is to be renamed. "new-username" is the new username for the record.

    REVOKE
    --------------------------------------------------------------------------------
    Revokes an identifier name from a username or UIC identifier. The /IDENTIFIER qualifier is required.

    Format
    REVOKE/IDENTIFIER id-name user-spec

    Parameters:
    id-name
    Specifies the identifier name (see the ADD/IDENTIFIER command).

    user-spec
    Is an identifier (UIC or non UIC format) that specifies the user (see the ADD/IDENTIFIER command).

    SHOW
    --------------------------------------------------------------------------------
    The SHOW command outputs a listing of the specified authorization record(s) to the user's terminal. Unless otherwise specified by qualifiers, UAF records are listed.

    Format for the authorization file:
    SHOW [/qualifiers] user-spec

    Qualifiers: /BRIEF
    This qualifier will give an abbreviated listing of the desired record(s). /BRIEF is equivalent to /NOFULL. /BRIEF is the default.

    /FULL
    This qualifier gives complete information on the desired record(s). /FULL is equivalent to /NOBRIEF.


    SHOW/IDENTIFIER
    --------------------------------------------------------------------------------
    Displays information about the identifier on the current
    SYS$OUTPUT device.

    Format
    SHOW/IDENTIFIER [id-name]

    Parameter:
    id-name

    Specifies an identifier name. If you omit the identifier name, you must specify /USER or /VALUE.


    Qualifiers: /BRIEF
    This qualifier will give an abbreviated listing of the desired record(s). /BRIEF is equivalent to /NOFULL. /BRIEF is the default.


    /FULL
    This qualifier gives complete information on the desired record(s). /FULL is equivalent to /NOBRIEF.

    /USER
    /USER=user-spec

    Specifies one or more users whose identifiers are to be displayed. User-spec may be XH].+++lKU%9@You can use the asterisk wildcard to specify multiple usernames or UICs: full use of the asterisk and percent wildcards is permitted for usernames.

    UICs must be in the form [,], [,n], [n,], or [n,n]. A wildcard username specification (i.e., *) displays identifiers alphabetically by username; a wildcard UIC specification (i.e., [,]) displays them numerically by UIC.


    /VALUE

    /VALUE=value-specifier

    Specifies the value of the identifier to be listed. Valid formats for the value-specifier are:

    IDENTIFIER:integer
    An integer value in the range of
    32768 to 268435455, or a hexadecimal number in the range %X00008000 to 0FFFFFFF
    UIC:uic
    A uic value in the standard UIC
    format
    SHOW/PROXY
    Displays one or all records in the network UAF. The /PROXY qualifier is required.


    Format

    SHOW/PROXY node::remote-user

    Parameters:
    node

    Specifies the name of a network node in the network UAF. The asterisk wildcard is permitted in the node specification.

    remote-user
    Specifies the name of a user on a remote node. The asterisk wildcard is permitted in the remote-user specification.

    SHOW/RIGHTS
    Displays the names, values, and attributes of all identifiers held by the specified user(s).

    Format
    SHOW/RIGHTS [user-spec]

    Parameter:
    user-spec

    Is the name of the identifier (usually the username) associated with the user in SYSUAF.DAT. If user-spec is omitted, you must specify the /USER qualifier.

    Qualifier: /USER
    /USER=user-spec

    Specifies one or more users whose identifiers are to be displayed. User-spec may be a username or UIC. You can use the asterisk wildcard to specify multiple usernames or UICs:
    full use of the asterisk and percent wildcards is permitted for usernames; UICs must be in the form [,], [,n], [n,], or [n,n].

    A wildcard username specification (i.e., *) displays identifiers alphabetically by username; a wildcard UIC specification (i.e., [,]) displays them numerically by UIC.

    Parameters:
    If a listing is generated from SYSUAF.DAT, then the user may specify "user-spec" in a variety of ways:
    1) wildcarded username (standard DCL wildcarding)
    2) wildcarded UIC, as
    a) [,]
    b) [*,n]
    c) [n,*]
    3) specific username
    4) specific UIC.

    Phew! After all that, you should be doing just fine using the Authorize

    Utility. You can expect summaries of VMS commands, DCL, and other VAX infor- mation in future articles. Now, happy hacking and go play God for a while!

    [File Report]
    [Edit]
    - v5.0