Conference iamok::inspect_srf

	RE:  .3  "Applying ACLs to OPERATOR.LOG & ACCOUNTNG.DAT"
	RE: .24  "UPDATE TO NOTE 99.3"

	I have attached the latest version of SET_OPER_AND_ACCT_ACL.COM
	which applies to PSCM V2.3+ and VMS 6.0+.


............................  CUT ALONG DOTTED LINE  ...........................
$ SET NOVERIFY
$ GOTO START
$!
$!  SET_OPER_AND_ACCT_ACL.COM
$!
$!  V1.1 (09-JUN-1994)
$!
$!  Paul D'Arcangelo 
$!
$!  REFERENCE: Corporate Security Standard 11.1, Section 4.5.3
$!
$!  I. PROLOGUE
$!
$!  In order to set the required ACLs on the operator log(s) and the
$!  accounting file(s), you need to perform a few necessary steps in
$!  order to skirt around the 'locked file' error, which occurs when
$!  you try to apply an ACL to an opened file. 
$!
$!  This command procedure will execute the necessary steps in order
$!  to apply the "required" ACLs to all versions of the operator log 
$!  file and also the accounting file.  
$!
$!  This command procedure will handle the enhanced required ACLs in
$!  PSCM V2.3 for VMS V6 systems, but is also downward compatible to
$!  VMS V5 systems.
$!
$!  II. IMPLEMENTATION IN A CLUSTER ENVIRONMENT
$!
$!  It is suggested that you execute this procedure in SYSMAN in or- 
$!  der to apply these ACLs in a cluster environment for ease of op-
$!  eration.  This command file should be located in the SYS$COMMON:
$!  [SYSMGR] directory in order for the commands below to work:
$!
$!    $MCR SYSMAN
$!    SYSMAN> SET ENVI/CLUSTER
$!    SYSMAN> SET TIME 00:01:00
$!    SYSMAN> SET PROFILE/DEFAULT=SYS$SYSROOT:[SYSMGR]
$!    SYSMAN> DO @SET_OPER_AND_ACCT_ACL.COM
$!    SYSMAN> EXIT
$!
$!  III. TECHNICAL INFORMATION
$!
$!  In order to apply an ACL to the accounting file and the operator
$!  log, a new version of each file is created using the CREATE com-
$!  mand and an ACL is applied to this unopened version.  Then, each
$!  of the opened files is closed and a new file is created with the 
$!  appropriate commands.  These new files will inherit the ACL from
$!  the CREATEd files.
$!
$!  This command procedure will search for the logicals: "ACCOUNTNG" 
$!  and "OPC$LOGFILE_NAME" for those configurations where the opera-
$!  or file(s) and accounting file(s) are intentionally located on a
$!  non-default device and/or directory.
$!
$!  Due to the restrictions of OPCOM communications, SYS$COMMAND is
$!  temporarily assigned to OPA0: within this procedure in order to 
$!  create a new operator log while using the SYSMAN utility.
$!
$!  IV. CONCLUSION
$!
$!  As a result of this command procedure, new operator log files &
$!  accounting files will be created with no purge being done on ei-
$!  ther of the files; all file versions will now meet the require-
$!  ments set out in the Corporate Security Standard 11.1 document, 
$!  section 4.5.3. "Auditing Important System Files".
$!                                                 
$!
$
$ START:
$  
$   SET NOON
$   WO := WRITE SYS$OUTPUT
$
$   vms_vers = F$GETSYI("VERSION")
$   vms_vers = F$EDIT(vms_vers,"COLLAPSE")
$
$   offset   = 0
$   offset   = F$LOCATE(".",vms_vers)
$   abbr_vms_vers = F$EXTRACT(0,offset,vms_vers)
$
$ OPERATOR_LOG_ACL:
$
$   IF F$TRNLNM("OPC$LOGFILE_NAME") .EQS. "" THEN -
    DEFINE/PROCESS OPC$LOGFILE_NAME SYS$MANAGER:OPERATOR.LOG
$
$   OPERATOR_LOG = F$TRNLMN("OPC$LOGFILE_NAME")
$
$   IF F$SEARCH("''OPERATOR_LOG'") .EQS. ""
$   THEN 
$     WO " "
$     WO "%FILE-NOT-FOUND; ''OPERATOR_LOG'" 
$     WO " "
$     GOTO ACCOUNTING_FILE_ACL
$   ELSE
$     CONTINUE
$   ENDIF
$
$   OPERATOR_LOG = OPERATOR_LOG + ";*"
$
$   CREATE OPC$LOGFILE_NAME
$
$   IF abbr_vms_vers .EQS. "V6" 
$   THEN
$     DEFINE/USER SYS$OUTPUT _NL:
$     DEFINE/USER SYS$ERROR  _NL:
$     SET ACL 'OPERATOR_LOG -
      /ACL=(ALARM=SECURITY,ACCESS=DELETE+CONTROL+SUCCESS)
$     DEFINE/USER SYS$OUTPUT _NL:
$     DEFINE/USER SYS$ERROR  _NL:
$     SET ACL 'OPERATOR_LOG -
      /ACL=(AUDIT=SECURITY,ACCESS=DELETE+CONTROL+SUCCESS)
$   ELSE
$     DEFINE/USER SYS$OUTPUT _NL:
$     DEFINE/USER SYS$ERROR  _NL:
$     SET ACL 'OPERATOR_LOG -
      /ACL=(ALARM=SECURITY,ACCESS=DELETE+CONTROL+SUCCESS)
$   ENDIF
$
$   ASSIGN OPA0: SYS$COMMAND
$   REPLY/ENABLE
$   REPLY/LOG
$   REPLY/DISABLE
$   DEASSIGN SYS$COMMAND
$
$   DIRECTORY/ACL 'OPERATOR_LOG
$
$ ACCOUNTING_FILE_ACL:
$
$   IF F$TRNLNM("ACCOUNTNG") .EQS. "" THEN -
    DEFINE/PROCESS ACCOUNTNG SYS$MANAGER:ACCOUNTNG.DAT
$
$   ACCOUNTNG_DAT = F$TRNLMN("ACCOUNTNG")
$
$   IF F$SEARCH("''ACCOUNTNG_DAT'") .EQS. ""
$   THEN
$     WO " "
$     WO "%FILE-NOT-FOUND; ''ACCOUNTNG_DAT'" 
$     WO " "
$     GOTO FINISH
$   ELSE
$     CONTINUE
$   ENDIF
$
$   ACCOUNTNG_DAT = ACCOUNTNG_DAT + ";*"
$
$   CREATE ACCOUNTNG
$
$   IF abbr_vms_vers .EQS. "V6" 
$   THEN
$     DEFINE/USER SYS$OUTPUT _NL:
$     DEFINE/USER SYS$ERROR  _NL:
$     SET ACL 'ACCOUNTNG_DAT -
      /ACL=(ALARM=SECURITY,ACCESS=DELETE+CONTROL+SUCCESS)
$     DEFINE/USER SYS$OUTPUT _NL:
$     DEFINE/USER SYS$ERROR  _NL:
$     SET ACL 'ACCOUNTNG_DAT -
      /ACL=(AUDIT=SECURITY,ACCESS=DELETE+CONTROL+SUCCESS)
$   ELSE
$     DEFINE/USER SYS$OUTPUT _NL:
$     DEFINE/USER SYS$ERROR  _NL:
$     SET ACL 'ACCOUNTNG_DAT -
      /ACL=(ALARM=SECURITY,ACCESS=DELETE+CONTROL+SUCCESS)
$   ENDIF
$
$   SET ACCOUNTING/ENABLE/DISABLE=IMAGE/NEW
$
$   DIRECTORY/ACL 'ACCOUNTNG_DAT
$
$ FINISH:
$
$   WO " "
$   WO "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
$   WO " "
$   EXIT