HP OpenVMS Systems Documentation

Logins can fail for any number of reasons. One of your passwords might have changed or your account might have expired. You might be attempting to log in over the network or from a modem but be unauthorized to do so. The following table summarizes common reasons for login failure:

The following sections describe the reasons for login failure in more detail.

2.5.1 Terminals That Require System Passwords

You cannot log in if the terminal you attempt to use requires a system password and you are unaware of the requirement. All attempts at logging in fail until you enter the system password.

If you know the system password, perform the steps described in Section 2.2.5. If your attempts fail, it is possible that the system password has been changed. If you do not know the system password and you suspect that this is the problem, try to log in at another terminal or request the new system password.

2.5.2 Login Class Restrictions

If you attempt a class of login that is prohibited in your UAF record, your login will fail. For example, your security administrator can restrict you from logging in over the network. If you attempt a network login, you receive a message telling you that you are not authorized to log in from this source.

Your security administrator can restrict your logins to include or exclude any of the following classes: local, remote, dialup, batch, or network.

2.5.3 Shift Restrictions

Another cause of login difficulty is failure to observe your shift restrictions. A system manager or security administrator can control access to the system based on the time of day or the day of the week. These restrictions are imposed on classes of logins. The security administrator can apply the same work-time restrictions to all classes of logins or choose to place different restrictions on different login classes.

If you attempt a login during a time prohibited for that login class, your login fails. The system notifies you that you are not authorized to log in at this time.

2.5.4 Batch Jobs During Shift Restrictions

When shift restrictions apply to batch jobs, jobs you submit that are scheduled to run outside your permitted work times are not run. The system does not automatically resubmit such jobs during your next available permitted work time. Similarly, if you have initiated any kind of job and attempt to run it beyond your permitted time periods, the job controller aborts the uncompleted job when the end of your allocated work shift is reached. This job termination behavior applies to all jobs.

2.5.5 Failures During Dialup Logins

Your security administrator can control the number of opportunities you are given to enter a correct password during a dialup login before the connection is automatically broken.

If your login fails and you have attempts remaining, press the Return key and try again. You can do this until you succeed or reach the limit. If the connection is lost, you can redial the access line and start again.

The typical reason for limiting the number of dialup login failures is to discourage unauthorized users attempting to learn passwords by trial and error. They already have the advantage of anonymity because of the dialup line. Of course, limiting the number of tries for each dialup does not necessarily stop this kind of break-in attempt. It only requires the perpetrator to redial and start another login.

2.5.6 Break-In Evasion Procedures

If anyone has made a number of failed attempts to log in at the same terminal with your user name, the system can respond as though a break-in attempt is in progress. That is, the system concludes that someone is attempting to gain illegal access to the system by using your user name.

At the discretion of your security administrator, break-in evasion measures can be in effect for all users of the system. The security administrator controls how many password attempts are allowed over what period of time. Once break-in evasion tactics are triggered, you cannot log in to the terminal---even with your correct password---during a defined interval. Your security administrator can tell you how long you must wait before reattempting the login, or you can move to another terminal to attempt a login.

If you suspect that break-in evasion is preventing your login and you have not personally experienced any login failures, contact your security administrator immediately. Together, you should attempt another login and check the message that reveals the number of login failures since the last login to confirm or deny your suspicion of break-in attempts. (If your system does not normally display the login message, your security administrator can use the Authorize utility (AUTHORIZE) to examine the data in your UAF record.) With prompt action, your security administrator can locate someone attempting logins at another terminal.

2.6 Changing Passwords

Changing passwords on a regular basis promotes system security. To change your password, enter the DCL command SET PASSWORD.

The system manager can allow you to select a password on your own or can require that you use the automatic password generator when you change your password. If you select your own password, note that the password must follow system restrictions on length and acceptability (see Section 2.2.3).

There is no restriction on how many times you can change your password in a given period of time.

The following example shows a password choice that is too short:

$ SET PASSWORD
Old password:
New password:
%SET-F-INVPWDLEN, password length must be between 12 and 32
characters; password not changed

If your system manager does not require use of the automatic password generator, the SET PASSWORD command prompts you to enter the new password. It then prompts you to reenter the new password for verification, as follows:

$ SET PASSWORD [Return]
New password:       [Return]
Verification:       [Return]

If you fail to enter the same new password twice, the password is not changed. If you succeed in these two steps, there is no notification. The command changes your password and returns you to the DCL prompt.

Even though your security administrator might not require the password generator, you are strongly encouraged to use it to promote the security of your system.

2.6.2 Using Generated Passwords

If your system security administrator decides that you must let the system generate the password for you automatically, the system provides you with a list of password choices when you enter the DCL command SET PASSWORD. (If your system is not set up to use automatically generated passwords, you can use them by specifying the SET PASSWORD command with the /GENERATE qualifier.) The character sequence resembles native language words to make it easy to remember, but it is unusual enough to be difficult for outsiders to guess.
Because system-generated passwords vary in length, they become even more difficult to guess.

In the following example, the system automatically generates a list of passwords made up of random sequences of characters. The minimum password length for the user in the following example has been set to 8 characters in their UAF record.

$ SET PASSWORD
Old password:          [Return] (1)

reankuna      rean-ku-na    (2)
cigtawdpau    cig-tawd-pau
adehecun      a-de-he-cun
ceebatorai    cee-ba-to-rai
arhoajabad    ar-hoa-ja-bad

Choose a password from this list, or press Return to get a new list (3)
New password:          [Return] (4)
Verification:          [Return] (5)
$ (6)

Note the following about the example:

1. The user correctly specifies the old password and presses the Return key.
2. The system responds with a list of five password choices ranging in length from 8 to 10 characters. Usually, the password that is easiest to pronounce is easiest to remember; therefore, it is the best choice.
   On OpenVMS VAX systems, representations of the same word divided into syllables are displayed to the right of each password choice (as shown here).
3. The system informs the user that it is possible to request a new list by pressing the Return key in response to the prompt for a new password.
4. The user enters one of the first five possible passwords and presses the Return key.
5. The system recognizes that this password is one provided by the automatic password generator and responds with the verification prompt. The user enters the new password again and presses Return.
6. The system changes the password and responds with the DCL prompt.

There are two disadvantages to using generated passwords:

• There is a possibility that you might not remember your password choice. However, if you dislike all the password choices in your list or think none are easy to remember, you can always request another list.
• There is a potential for disclosure of password choices from the display that the command produces. To protect your account, change your password in private. If you perform the change on a video terminal, clear the display of password choices from the screen after the command finishes. If you use a printing terminal, properly dispose of all hardcopy output.
  If you later realize that you failed to protect your password in these ways, change your password immediately. Depending on site policy or your own judgment concerning the length of time your account was exposed, you should notify your security administrator that a security breach could have occurred through your account.

To change a secondary password, use the DCL command SET PASSWORD/SECONDARY. You are prompted to specify the old secondary password and the new secondary password, just as in the procedure for changing the primary password. To remove a secondary password, press the Return key when you are prompted for a new password and verification.

You can change primary and secondary passwords independently, but both are subject to the same change frequency because they share the same password lifetime.

2.6.5 Changing Passwords at Login

Even if your current password has not yet expired, you can change your password when you log in to the system by including the /NEW_PASSWORD qualifier with your user name. When you enter the /NEW_PASSWORD qualifier after your user name, the system prompts you to set a new password immediately after login.

The following example shows how to change your password when you log in:

  WILLOW - A member of the Forest Cluster

Username: RWOODS/NEW_PASSWORD
Password:
         Welcome to OpenVMS on node WILLOW
            Last interactive login on Tuesday, 7-NOV-1999 10:20
            Last non-interactive login on Monday, 6-NOV-1999 14:20

Your password has expired; you must set a new password to log in
New password:
Verification:

Your system manager can set up your account so that your password, or the account itself, expires automatically on a particular date and time. Password expiration times promote system security by forcing you to change your password on a regular basis. Account expiration times help to ensure that accounts are available only for as long as they are needed.

2.7.1 Expired Passwords

As you approach the expiration time of your password, you receive an advance warning message. The message first appears 5 days before the expiration date and at each subsequent login. The message appears immediately below the new mail message and sounds the bell character on your terminal to attract your attention. The message indicates that your password is expiring, as follows:

WARNING -- Your password expires on Thursday 11-DEC-1999 15:00

If you fail to change your password before it expires, you receive the following message when you log in:

Your password has expired; you must set a new password to log in
New password:

The system prompts you for a new password or, if automatic password generation is enabled, asks you to select a new password from those listed. You can abort the login by pressing Ctrl/Y. At your next login attempt, the system again prompts you to change your password.

2.7.2 Using Secondary Passwords

If secondary passwords are in effect for your account (see Section 2.2.4), the secondary password expires at the same time as the primary one. You are prompted to change both passwords. If you change the primary password and press Ctrl/Y before changing the secondary password, the login fails. The system does not record a password change.

2.7.3 Failure to Change Passwords

If the system manager decides not to force you to change your expired password upon logging in, you receive one final warning when you log in after your password expires, as follows:

WARNING -- Your password has expired; update immediately with
SET PASSWORD!

At this point, if you do not change the password or if the system fails before you have the opportunity to do so, you will be unable to log in again. To regain access, see your system manager.

2.7.4 Expired Accounts

If you need your account for a specific purpose for a limited time only, the person who creates your account may specify a period of time after which the account lapses. For example, student accounts at universities are typically authorized for a single semester at a time.

Expired accounts deny logins automatically. You receive no advance warning message before the account expiration date, so it is important to know in advance your account duration. The account expiration resides in the UAF record, which can be accessed and displayed only through the use of the OpenVMS Authorize utility (AUTHORIZE) by users with the SYSPRV privilege or equivalent---normally, your system manager or security administrator.

When your account expires, you receive an authorization failure message at your next attempted login. If you need an extension, follow the procedures defined at your site.

2.8 Guidelines for Protecting Your Password

Illegal system accesses involving the use of a correct password are more often traced to disclosure of the password by its owner than to surreptitious discovery. It is vital that you do not reveal your password to anyone.

You can best protect your password by observing the following rules:

• Select reasonably long passwords that cannot be guessed easily. Avoid using words in your native language that appear in a dictionary. Consider including numbers in your password. Alternatively, let the system generate passwords for you automatically.
• Never write down your password.
• Never give your password to another user. If another user obtains your password, change it immediately.
• Do not include your password in any file, including the body of an electronic mail message. (If anyone else reveals a password to you, delete the information promptly.)
  The character strings that appear in conjunction with your actual password can make it easy for someone to find your password in a file. For example, a quotation mark followed by two colons ("::) always comes after a user name and password in an access control string. Someone attempting to break into the system could obtain your password by searching inadequately protected files for this string. Another way in which you might reveal your password is by using the word "password" in a text file, for example:

  My password is GOBBLEDYGOOK.

• If you submit a batch job on cards, do not leave your password card where others may be able to obtain your password from it.
• Do not use the same password for accounts on different systems.
  An unauthorized user can try one password on every system where you have an account. The account that first reveals the password might hold little information of interest, but another account might yield more information or more privileges, ultimately leading to a far greater security breach.
• Before you log in to a terminal that is already on, invoke the secure terminal server feature (if enabled) by pressing the Break key. This is particularly relevant when you are working in a public terminal room.
  A password grabber program is a special program that displays an empty video screen, a screen that appears to show the system has just been initialized after a crash, or a screen that shows a nonexistent logout. When you attempt to log in, the program runs through the normal login sequence so you think you are entering your user name and password in a normal manner. However, once the program receives this key information and passes it on to the perpetrator, it displays a login failure. You might think you mistyped your password and be unaware that you have just revealed it to someone else.
  To eliminate this possibility, your security administrator might advise you to press the Break key before logging in. Pressing the Break key invokes the secure terminal server feature for the terminal, if it has been enabled by the security administrator. The secure server ensures that the OpenVMS login program is the only program able to receive your login.
• Change your password every 3 to 6 months. Compaq warns against sharing passwords. If you do share your password, change it every month.
• Change your password immediately if you have any reason to suspect it might have been discovered. Report such incidents to your security administrator.
• Do not leave your terminal unattended after you log in.
  You might think the system failed and came back up again, when actually someone has loaded a password-stealing program. Even a terminal that displays an apparently valid logout message might not reflect a normally logged out process.
• Check your last login messages routinely. The password-stealing program cannot actually increase the login failure count, although it looks like a login failure to you. Be alert for login failure counts that do not appear following your failure or that are one less than the number you experienced. If you observe this or any other unusual failure during a login, change your password immediately and notify your security administrator.

The system responds to the commands you enter in one or more of the following ways:

• By executing the command. Generally, you know your command has executed successfully when the system prompt returns (by default, the dollar sign).
• By executing the command and informing you in a message what it has done.
• By informing you of errors, if execution of a command is unsuccessful.
• By supplying values (defaults) you have not supplied.