HP OpenVMS Systems Documentation

The Kerberos TELNET server uses port 2323. Specify this port on the TELNET command line. For example:

$ TELNET/AUTHENTICATE terse.mbs.com /PORT=2323

%TELNET-I-TRYING, Trying ... 17.21.205.153
%TELNET-I-SESSION, Session 01, host terse.mbs.com, port 2323
-TELNET-I-ESCAPE, Escape character is ^]

 Welcome to OpenVMS (TM) Alpha Operating System, Version V7.3

Username:

Before you use the Kerberos TELNET client, make sure the local host name is fully qualified in the local hosts database. Kerberos realms form principal names using fully-qualified domain names. For example, terse.mbs.com is a fully qualified domain name; terse is a simple host name.

HP TCP/IP Services for OpenVMS is usually configured so that the host name is entered in the hosts database as a simple host name. That is, on host TERSE, the TCP/IP management command SHOW HOST TERSE returns terse , not terse.mbs.com .

To correct a mismatch between the Kerberos realm and the TCP/IP Services configurations, follow these steps from a privileged account at a time when system usage is low:

1. Find the host's numeric address. For example:

   $ TCPIP TCPIP> SHOW HOST terse LOCAL database Host address Host name 15.28.311.11 terse

2. Remove the simple host name. For example:

   TCPIP> SET NOHOST terse/CONFIRM

3. Use the SET HOST command to associate the fully qualified domain name with the IP address, as shown in the following example:

   TCPIP> SET host "terse.mbs.com"/ADDRESS=15.28.311.11 - _TCPIP> /ALIAS=("TERSE.MBS.COM", "terse", "TERSE")

   
   Specify the /ALIAS qualifier to ensure that applications can handle host names in uppercase and lowercase.
4. Confirm that the first name returned is fully qualified.

   TCPIP> SHOW HOST terse LOCAL database Host address Host name 15.28.311.11 terse.mbs.com, TERSE.MBS.COM, terse, TERSE

To improve TELNET performance, try modifying some of the internet parameters. These changes might also decrease the use of system resources.

15.2.1 TELNET Characteristics That Affect Performance

The settings for the TELNET systemwide characteristics might affect TCP/IP Services and TELNET performance. To display the TELNET systemwide characteristics, enter:

TCPIP> SHOW SERVICE TELNET /FULL

The command generates a display similar to the following:

Service: TELNET
  State:  Enabled
 Port: 23  Protocol:  TCP  Address:  0.0.0.0
 Inactivity:  1  User_name: Process:  not defined
 Limit:30  Active: 1  Peak:  4
 File: not defined
 Flags:  Listen Priv Rtty
 Socket Opts:  Keepalive
 Receive: 3000  Send:  3000

 Log Opts:  Actv Dactv Conn Error Logi Logo Mdfy Rjct Addr

 File:  not defined

 Security
 Reject msg:  not defined
 Accept host: 0.0.0.0
 Accept netw: 0.0.0.0

The TELNET server sends the following error message for a TELNET login request that cannot be satisfied:

SS$_EXQUOTA

This error is due to insufficient local resources, such as:

• Too many sessions
  To determine whether this is the cause of the problem, check to see whether the maximum number of concurrent sessions has been exceeded. Enter the following TCP/IP management command:

  TCPIP> SHOW SERVICE TELNET

  
  If the maximum number of concurrent sessions has been exceeded, the display shows:

  PEAK=limit

  
  To increase the number of allowed sessions, enter the following command:

  TCPIP> SET SERVICE TELNET /LIMIT=n

• Insufficient OpenVMS nonpaged pool
  To determine whether this is the cause of the problem, check to see whether the OpenVMS nonpaged pool is insufficient for servicing a new TELNET connection. If so, monitor the server.
  To improve any of the parameters, redefine the logical names.
• Excessive OpenVMS login sessions
  To determine whether this is the cause of the problem, check to see whether the limit for maximum OpenVMS sessions has been exceeded. If the current value is not appropriate, redefine it.

Verify that the CHANNELCNT parameter (in SYSGEN) is larger than the number of simultaneous TELNET and RLOGIN sessions that you plan to support.

The File Transfer Protocol (FTP) software transfers files between "nontrusted" hosts. Nontrusted hosts require user name and password information for remote logins.

The TCP/IP Services product includes an implementation of the FTP end-user applications.

This chapter describes:

• How to manage the FTP service ( Section 16.1)
• How to solve FTP problems ( Section 16.2)

For information on using FTP, see the HP TCP/IP Services for OpenVMS User's Guide.

16.1 Managing FTP

Managing FTP consists of the the following tasks:

• Enabling and disabling FTP
• Starting and Stopping FTP
• Configuring anonymous FTP
• Defining FTP logical names
• Monitoring FTP with FTP log files

After FTP is configured by TCPIP$CONFIG, the postinstallation configuration procedure, it is started automatically when TCP/IP Services is started.

To stop any new connections without losing existing connections, disable the FTP server interactively using the SET NOSERVICE command. This is useful before shutting down FTP, as described in Section 16.1.2.

To disable FTP when TCP/IP Services starts, use the SET CONFIGURATION NOSERVICE command.

See the HP TCP/IP Services for OpenVMS Management Command Reference for descriptions of the SET SERVICE and SET CONFIGURATION SERVICE commands.

16.1.2 FTP Startup and Shutdown

The FTP service can be shut down and started independently from TCP/IP Services. This is useful when you change parameters or logical names that require the service to be restarted.

The following command procedures are provided:

• SYS$STARTUP:TCPIP$FTP_STARTUP.COM allows you to start FTP independently.
• SYS$STARTUP:TCPIP$FTP_SHUTDOWN.COM allows you to shut down FTP independently.

To preserve site-specific parameter settings and commands, create the following files. These files are not overwritten when you reinstall TCP/IP Services:

• SYS$STARTUP:TCPIP$FTP_SYSTARTUP.COM can be used as a repository for site-specific definitions and parameters to be invoked when FTP is started.
• SYS$STARTUP:TCPIP$FTP_SYSHUTDOWN.COM can be used as a repository for site-specific definitions and parameters to be invoked when FTP is shut down.

Anonymous FTP is an FTP session in which a user logs in to the remote server using the user name ANONYMOUS and, by convention, the user's real user name as the password.

On the local FTP server, local users can access files without password authentication. Remote users do not require an account. File access is controlled by regular OpenVMS access restrictions.

When you use TCPIP$CONFIG to establish an ANONYMOUS account, a new account is created with the UIC [ANONY,ANONYMOUS] (by default, [3376,xx]), user name ANONYMOUS, account ANONY, default directory SYS$SYSDEVICE:[ANONYMOUS], and the following types of login access:

The usual OpenVMS file protection codes restrict file access for inbound anonymous FTP sessions to this directory, its subdirectories, and files with an owner attribute of [ANONY,ANONYMOUS].

When the ANONYMOUS account has been created, a remote FTP client can:

• Copy files to and from GUEST$PUBLIC.
• From the ANONYMOUS$USER directory:
  • Delete files
  • Create directories
  • Delete directories
  • Rename files
  • Rename directories

You can set up guest and public directories for bulletin board or group interest. Make sure the directory protections are set to read-only or read/write, as needed.

In the following example, UNIX user ubird connects to the ANONYMOUS account on OpenVMS host TRAGOPAN. TRAGOPAN asks for ubird 's password, which is not echoed. In response to this request, the user should supply the local system user name for identification purposes.

% ftp tragopan

Connected to tragopan.asian.pheasant.edu.
220 tragopan.asian.pheasant.edu FTP Server (Version 5.1) Ready.

Name (tragopan:wings): ANONYMOUS

331 Guest login ok, send ident as password.
Password: CARIBBEAN

230  Guest login ok, access restrictions apply.

        Welcome to HP TCP/IP Services for OpenVMS
        on internet host TRAGOPAN    Date 24-JUN-2000
FTP>

The FTP server processes each command individually as it receives the command and displays a reply based on the command parameters. A reply can include a file specification that displays part of the server file system.

16.1.3.2 Setting Up Anonymous FTP

Complete the following steps to set up anonymous FTP access on your system:

1. Use the TCPIP$CONFIG procedure to create an account named ANONYMOUS with the password GUEST.
   To create the ANONYMOUS user account, select Optional Components from the main menu, then select Setup Anonymous FTP Account and Directories.
2. Set user account access restrictions NOLOCAL, NOBATCH, NOREMOTE, and NODIALUP.
3. Optionally, create public directories and assign to them the devices names GUEST$PUBLIC and ANONYMOUS$USER. HP neither creates nor recommends the use of these directories. If you create these directories, be careful to set protections on them to allow read access only (for GUEST$PUBLIC) and use other security measures to protect the ANONYMOUS$USER directory.
4. Create a welcome banner.
   When an anonymous user logs in, FTP informs the user of the account's restrictions. You can use the TCPIP$FTP_ANONYMOUS_WELCOME logical name add more information to the welcome text for anonymous users.
   Define this logical using the following format:

   $ DEFINE/SYSTEM/EXEC TCPIP$FTP_ANONYMOUS_WELCOME "Anonymous User Account"

5. Specify the file name and location for the log files generated by FTP sessions.
   Use the TCPIP$FTP_ANONYMOUS_LOG logical name. If you do not define TCPIP$FTP_ANONYMOUS_LOG, FTP puts the files in SYS$SYSDEVICE:[TCPIP$FTP]TCPIP$FTP_ANONYMOUS.LOG.
   Set this logical when the FTP server is not running. For example, to shut down the FTP server, define the file name and location of the log file, and then restart the server, enter the following commands:

   $ @SYS$STARTUP:TCPIP$FTP_SHUTDOWN.COM $ DEFINE/SYSTEM TCPIP$FTP_ANONYMOUS_LOG dev:[directory]filename $ @SYS$STARTUP:TCPIP$FTP_STARTUP.COM

   
   Where dev:[directory]filename is a complete directory and file name specification.
6. Specify a user name for the anonymous FTP account. Define the logical name TCPIP$FTP_ANONYMOUS_ALIAS. See Table 16-1 for more information.

Table 16-1 lists the logical names that you can use to manage the FTP server. After you define a logical name, you must stop and start the FTP server for the new setting to take effect.

$ DEFINE/SYSTEM/EXEC TCPIP$FTP_ANONYMOUS_ALIAS -

_$ THOMAS,JONES,SMITH

TCPIP> DEFINE /SYSTEM/EXEC TCPIP$FTPD_KEEPALIVE 1

$ DEFINE/SYSTEM TCPIP$FTP_HELP
dev:[directory]filename.HLB

$ DEFINE /SYSTEM/EXEC TCPIP$FTP_KEEPALIVE 1

$ DEFINE /SYSTEM/EXEC TCPIP$FTP_NO_VERSION 1

$ DEFINE /SYSTEM TCPIP$FTP_SERVER
dev:[directory]filename.log

$ DEFINE/SYSTEM/EXEC TCPIP$FTP_SERVER_ANNOUNCE "FTP Ready"

NODE> FTP FTPSERVER/USER=auser/PASS=mypassword

220 ftpserver.node.com FTP Server (Version 5.4) Ready.

Connected to ftpserver.mysys.myco.com.

331 Username AUSER requires a Password

230 User logged in.

FTP>

$ FTP FTPSERVER/USER=auser/PASS=mypassword

220 FTP server ready

Connected to ftpserver.mysys.myco.com.

331 Username AUSER requires a Password

230 User logged in.

FTP>