Adds a user record to the SYSUAF and corresponding identifiers to
the rights database.
In the list of "Additional information available" in online help,
the first group of qualifiers is used to add user information to
the authorization (UAF) file.
Following this list, after "Examples," are two more qualifiers:
o /IDENTIFIER-used to add identifiers to the rights database
(but does not affect the authorization file)
o /PROXY-used to add proxies to the proxy database (but does not
affect the authorization file)
These qualifiers use different parameters than other ADD
commands.
Format
ADD newusername
1 – Parameter
newusername
Specifies the name of the user record to be included in the
SYSUAF. The newusername parameter is a string of 1 to 12
alphanumeric characters and can contain underscores. Although
dollar signs are permitted, they are usually reserved for system
names.
Avoid using fully numeric user names (for example, 89560312). A
fully numeric user name cannot receive a corresponding identifier
because fully numeric identifiers are not permitted.
2 – Qualifiers
2.1 /ACCESS
/ACCESS[=(range[,...])]
/NOACCESS[=(range[,...])]
Specifies hours of access for all modes of access. The syntax for
specifying the range is:
UAF> /[NO]ACCESS=([PRIMARY],[n-m],[n],[,...],[SECONDARY],[n-m],[n],[,...])
Specify hours as integers from 0 to 23, inclusive. You can
specify single hours (n) or ranges of hours (n-m). If the ending
hour of a range is earlier than the starting hour, the range
extends from the starting hour through midnight to the ending
hour. The first set of hours after the keyword PRIMARY specifies
hours on primary days; the second set of hours after the keyword
SECONDARY specifies hours on secondary days. Note that hours
are inclusive; that is, if you grant access during a given hour,
access extends to the end of that hour.
By default, a user has full access every day. See the DCL command
SET DAY in the HP OpenVMS DCL Dictionary for information about
overriding the defaults for primary and secondary day types.
All the list elements are optional. Unless you specify hours for
a day type, access is permitted for the entire day. By specifying
an access time, you prevent access at all other times. Adding
NO to the qualifier denies the user access to the system for the
specified period of time. See the following examples.
/ACCESS Allows unrestricted access
/NOACCESS=SECONDARY Allows access on primary days only
/ACCESS=(9-17) Allows access from 9 A.M. to 5:59 P.M. on
all days
/NOACCESS=(PRIMARY, Disallows access between 9 A.M. to 5:59
9-17, SECONDARY, P.M. on primary days but allows access
18-8) during these hours on secondary days
To specify access hours for specific types of access, see the
/BATCH, /DIALUP, /INTERACTIVE, /LOCAL, /NETWORK, and /REMOTE
qualifiers.
For information about the effects of login class restrictions,
see the HP OpenVMS Guide to System Security.
2.2 /ACCOUNT
/ACCOUNT=account-name
Specifies the default name for the account (for example, a
billing name or number). The name can be a string of 1 to 8
alphanumeric characters. By default, AUTHORIZE does not assign
an account name.
2.3 /ADD_IDENTIFIER
/ADD_IDENTIFIER (default)
/NOADD_IDENTIFIER
Adds an identifier to the rights database file, RIGHTSLIST.DAT,
and also adds a user to the user authorization file, SYSUAF. The
/NOADD_IDENTIFIER qualifier does not add an identifier to the
RIGHTSLIST.DAT file but does, however, add a user to the SYSUAF
user record file. Note that the AUTHORIZE command ADD/IDENTIFIER
is quite different: it only adds an entry to the rights database
file, RIGHTSLIST.DAT.
2.4 /ALGORITHM
/ALGORITHM=keyword=type [=value]
Sets the password encryption algorithm for a user. The keyword
VMS refers to the algorithm used in the operating system version
that is running on your system, whereas a customer algorithm is
one that is added through the $HASH_PASSWORD system service by
a customer site, by a layered product, or by a third party. The
customer algorithm is identified in $HASH_PASSWORD by an integer
in the range of 128 to 255. It must correspond with the number
used in the AUTHORIZE command MODIFY/ALGORITHM. By default,
passwords are encrypted with the VMS algorithm for the current
version of the operating system.
Keyword Function
BOTH Set the algorithm for primary and secondary
passwords.
CURRENT Set the algorithm for the primary, secondary, both,
or no passwords, depending on account status. CURRENT
is the default value.
PRIMARY Set the algorithm for the primary password only.
SECONDARY Set the algorithm for the secondary password only.
The following table lists password encryption algorithms:
Type Definition
VMS The algorithm used in the version of the operating
system that is running on your system.
CUSTOMER A numeric value in the range of 128 to 255 that
identifies a customer algorithm.
The following example selects the VMS algorithm for Sontag's
primary password:
UAF> MODIFY SONTAG/ALGORITHM=PRIMARY=VMS
If you select a site-specific algorithm, you must give a value to
identify the algorithm, as follows:
UAF> MODIFY SONTAG/ALGORITHM=CURRENT=CUSTOMER=128
2.5 /ASTLM
/ASTLM=value
Specifies the AST queue limit, which is the total number of
asynchronous system trap (AST) operations and scheduled wake-up
requests that the user can have queued at one time. The default
is 300 on Alpha and Integrity server systems.
2.6 /BATCH
/BATCH[=(range[,...])]
Specifies the hours of access permitted for batch jobs. For
a description of the range specification, see the /ACCESS
qualifier. By default, a user can submit batch jobs any time.
2.7 /BIOLM
/BIOLM=value
Specifies a buffered I/O count limit for the BIOLM field of
the UAF record. The buffered I/O count limit is the maximum
number of buffered I/O operations, such as terminal I/O, that
can be outstanding at one time. The default is 150 on Alpha and
Integrity server systems.
2.8 /BYTLM
/BYTLM=value
Specifies the buffered I/O byte limit for the BYTLM field of the
UAF record. The buffered I/O byte limit is the maximum number
of bytes of nonpaged system dynamic memory that a user's job
can consume at one time. Nonpaged dynamic memory is used for
operations such as I/O buffering, mailboxes, and file-access
windows. The default is 128,000 on Alpha and Integrity server
systems.
2.9 /CLI
/CLI=cli-name
Specifies the name of the default command language interpreter
(CLI) for the CLI field of the UAF record. The cli-name is a
string of 1 to 31 alphanumeric characters and should be DCL,
which is the default. This setting is ignored for network jobs.
2.10 /CLITABLES
/CLITABLES=filespec
Specifies user-defined CLI tables for the account. The
filespec can contain 1 to 31 characters. The default is
SYS$LIBRARY:DCLTABLES. Note that this setting is ignored for
network jobs to guarantee that the system-supplied command
procedures used to implement network objects function properly.
2.11 /CPUTIME
/CPUTIME=time
Specifies the maximum process CPU time for the CPU field of the
UAF record. The maximum process CPU time is the maximum amount of
CPU time a user's process can take per session. You must specify
a delta time value. For a discussion of delta time values, see
the OpenVMS User's Manual. The default is 0, which means an
infinite amount of time.
2.12 /DEFPRIVILEGES
/DEFPRIVILEGES=([NO]privname[,...])
Specifies default privileges for the user; that is, those enabled
at login time. A NO prefix removes a privilege from the user. By
specifying the keyword [NO]ALL with the /DEFPRIVILEGES qualifier,
you can disable or enable all user privileges. The default
privileges are TMPMBX and NETMBX. Privname is the name of the
privilege.
2.13 /DEVICE
/DEVICE=device-name
Specifies the name of the user's default device at login. The
device-name is a string of 1 to 31 alphanumeric characters. If
you omit the colon from the device-name value, AUTHORIZE appends
a colon. The default device is SYS$SYSDISK.
If you specify a logical name as the device-name (for example,
DISK1: for DUA1:), you must make an entry for the logical name in
the LNM$SYSTEM_TABLE in executive mode by using the DCL command
DEFINE/SYSTEM/EXEC.
2.14 /DIALUP
/DIALUP[=(range[,...])]
Specifies hours of access permitted for dialup logins. For
a description of the range specification, see the /ACCESS
qualifier. The default is full access.
2.15 /DIOLM
/DIOLM=value
Specifies the direct I/O count limit for the DIOLM field of the
UAF record. The direct I/O count limit is the maximum number
of direct I/O operations (usually disk) that can be outstanding
at one time. The default is 150 on Alpha and Integrity server
systems.
2.16 /DIRECTORY
/DIRECTORY=directory-name
Specifies the default directory name for the DIRECTORY field of
the UAF record. The directory-name can be 1 to 39 alphanumeric
characters. If you do not enclose the directory name in brackets,
AUTHORIZE adds the brackets for you. The default directory name
is [USER].
2.17 /ENQLM
/ENQLM=value
Specifies the lock queue limit for the ENQLM field of the UAF
record. The lock queue limit is the maximum number of locks that
can be queued by the user at one time. The default is 4000 on
Alpha and Integrity server systems.
2.18 /EXPIRATION
/EXPIRATION=time (default)
/NOEXPIRATION
Specifies the expiration date and time of the account. The
/NOEXPIRATION qualifier removes the expiration date on the
account. If you do not specify an expiration time when you add
a new account, AUTHORIZE copies the expiration time from the
DEFAULT account. (The expiration time on the DEFAULT account is
"none" by default.)
2.19 /FILLM
/FILLM=value
Specifies the open file limit for the FILLM field of the UAF
record. The open file limit is the maximum number of files that
can be open at one time, including active network logical links.
The default is 128 on Alpha and Integrity server systems.
2.20 /FLAGS
/FLAGS=([NO]option[,...])
Specifies login flags for the user. The prefix NO clears the
flag. The options are as follows:
AUDIT Enables or disables mandatory security auditing for
a specific user. By default, the system does not
audit the activities of specific users (NOAUDIT).
AUTOLOGIN Restricts the user to the automatic login mechanism
when logging in to an account. When set, the flag
disables login by any terminal that requires entry
of a user name and password. The default is to
require a user name and password (NOAUTOLOGIN).
CAPTIVE Prevents the user from changing any defaults at
login, for example, /CLI or /LGICMD. It prevents
the user from escaping the captive login command
procedure specified by the /LGICMD qualifier
and gaining access to the DCL command level. See
"Guidelines for Captive Command Procedures" in the
HP OpenVMS Guide to System Security.
The CAPTIVE flag also establishes an environment
where Ctrl/Y interrupts are initially turned off;
however, command procedures can still turn on Ctrl/Y
interrupts with the DCL command SET CONTROL=Y. By
default, an account is not captive (NOCAPTIVE).
DEFCLI Restricts the user to the default command
interpreter by prohibiting the use of the /CLI
qualifier at login. By default, a user can choose
a CLI (NODEFCLI).
DISCTLY Establishes an environment where Ctrl/Y interrupts
are initially turned off and are invalid until a
SET CONTROL=Y is encountered. This could happen in
SYLOGIN.COM or in a procedure called by SYLOGIN.COM.
Once a SET CONTROL=Y is executed (which requires
no privilege), a user can enter a Ctrl/Y and reach
the DCL prompt ($). If the intent of DISCTLY is
to force execution of the login command files,
then SYLOGIN.COM should issue the DCL command
SET CONTROL=Y to turn on Ctrl/Y interrupts before
exiting. By default, Ctrl/Y is enabled (NODISCTLY).
DISFORCE_ Removes the requirement that a user must change an
PWD_CHANGE expired password at login. By default, a person can
use an expired password only once (NODISFORCE_PWD_
CHANGE) and then is forced to change the password
after logging in. If the user does not select a new
password, the user is locked out of the system.
To use this feature, set a password expiration date
with the /PWDLIFETIME qualifier.
DISIMAGE Prevents the user from executing RUN and foreign
commands. By default, a user can execute RUN and
foreign commands (NODISIMAGE).
DISMAIL Disables mail delivery to the user. By default, mail
delivery is enabled (NODISMAIL).
DISNEWMAIL Suppresses announcements of new mail at login.
By default, the system announces new mail
(NODISNEWMAIL).
DISPWDDIC Disables automatic screening of new passwords
against a system dictionary. By default, passwords
are automatically screened (NODISPWDDIC).
DISPWDHIS Disables automatic checking of new passwords against
a list of the user's old passwords. By default, the
system screens new passwords (NODISPWDHIS).
DISPWDSYNCH Suppresses synchronization of the external password
for this account. See bit 9 in the SECURITY_
POLICY system parameter for systemwide password
synchronization control.
DISRECONNECT Disables automatic reconnection to an existing
process when a terminal connection has been
interrupted. By default, automatic reconnection
is enabled (NODISRECONNECT).
DISREPORT Suppresses reports of the last login time, login
failures, and other security reports. By default,
login information is displayed (NODISREPORT).
DISUSER Disables the account so the user cannot log in.
For example, the DEFAULT account is disabled. By
default, an account is enabled (NODISUSER).
DISWELCOME Suppresses the welcome message (an informational
message displayed during a local login). This
message usually indicates the version number of
the operating system that is running and the name of
the node on which the user is logged in. By default,
a system login message appears (NODISWELCOME).
EXTAUTH Considers user to be authenticated by an external
user name and password, not by the SYSUAF user name
and password. (The system still uses the SYSUAF
record to check a user's login restrictions and
quotas and to create the user's process profile.)
GENPWD Restricts the user to generated passwords.
By default, users choose their own passwords
(NOGENPWD).
LOCKPWD Prevents the user from changing the password for
the account. By default, users can change their
passwords (NOLOCKPWD).
PWD_EXPIRED Marks a password as expired. The user cannot log in
if this flag is set. The LOGINOUT.EXE image sets the
flag when both of the following conditions exist: a
user logs in with the DISFORCE_PWD_CHANGE flag set,
and the user's password expires. A system manager
can clear this flag. By default, passwords are not
expired after login (NOPWD_EXPIRED).
PWD2_ Marks a secondary password as expired. Users cannot
EXPIRED log in if this flag is set. The LOGINOUT.EXE image
sets the flag when both of the following conditions
exist: a user logs in with the DISFORCE_PWD_CHANGE
flag set, and the user's password expires. A system
manager can clear this flag. By default, passwords
are not set to expire after login (NOPWD2_EXPIRED).
PWDMIX Enables case-sensitive and extended-character
passwords.
After PWDMIX is specified, you can then use mixed-
case and extended characters in passwords. Be aware
that before the PWDMIX flag is enabled, the system
stores passwords in all upper-case. Therefore, until
you change passwords, you must enter your pre-PWDMIX
passwords in upper-case.
To change the password after PWDMIX is enabled:
o You (the user) can use the DCL command SET
PASSWORD, specifying the new mixed-case password
(omitting quotation marks).
o You (the system manager) can use the AUTHORIZE
command MODIFY/PASSWORD, and enclose the user's
new mixed-case password in quotation marks " ".
RESTRICTED Prevents the user from changing any defaults at
login (for example, by specifying /LGICMD) and
prohibits user specification of a CLI with the
/CLI qualifier. The RESTRICTED flag establishes
an environment where Ctrl/Y interrupts are initially
turned off; however, command procedures can still
turn on Ctrl/Y interrupts with the DCL command SET
CONTROL=Y. Typically, this flag is used to prevent
an applications user from having unrestricted access
to the CLI. By default, a user can change defaults
(NORESTRICTED).
VMSAUTH Allows account to use standard (SYSUAF)
authentication when the EXTAUTH flag would otherwise
require external authentication. This depends on the
application. An application specifies the VMS domain
of interpretation when calling SYS$ACM to request
standard VMS authentication for a user account that
normally uses external authentication.
2.21 /GENERATE_PASSWORD
/GENERATE_PASSWORD[=keyword]
/NOGENERATE_PASSWORD (default)
Invokes the password generator to create user passwords.
Generated passwords can consist of 1 to 10 characters. Specify
one of the following keywords:
BOTH Generate primary and secondary passwords.
CURRENT Do whatever the DEFAULT account does (for example,
generate primary, secondary, both, or no passwords).
This is the default keyword.
PRIMARY Generate primary password only.
SECONDARY Generate secondary password only.
When you modify a password, the new password expires
automatically; it is valid only once (unless you specify
/NOPWDEXPIRED). On login, users are forced to change their
passwords (unless you specify /FLAGS=DISFORCE_PWD_CHANGE).
Note that the /GENERATE_PASSWORD and /PASSWORD qualifiers are
mutually exclusive.
2.22 /IDENTIFIER
Adds an identifier to the rights database, RIGHTSLIST.DAT.
The ADD/IDENTIFIER command does not add a user account to the
authorization file, SYSUAF.
The ADD/ADD_IDENTIFIER command, however, adds a user account to
the authorization file, SYSUAF, and also adds an identifier to
the rights database, RIGHTSLIST.DAT.
2.23 /INTERACTIVE
/INTERACTIVE[ =(range[,...])]
/NOINTERACTIVE
Specifies the hours of access for interactive logins. For
a description of the range specification, see the /ACCESS
qualifier. By default, there are no access restrictions on
interactive logins.
2.24 /JTQUOTA
/JTQUOTA=value
Specifies the initial byte quota with which the jobwide logical
name table is to be created. By default, the value is 4096 on
Alpha and Integrity server systems.
2.25 /LGICMD
/LGICMD=filespec
Specifies the name of the default login command file. The file
name defaults to the device specified for /DEVICE, the directory
specified for /DIRECTORY, a file name of LOGIN, and a file type
of .COM. If you select the defaults for all these values, the
file name is SYS$SYSTEM:[USER]LOGIN.COM.
2.26 /LOCAL
/LOCAL[=(range[,...])]
Specifies hours of access for interactive logins from local
terminals. For a description of the range specification, see the
/ACCESS qualifier. By default, there are no access restrictions
on local logins.
2.27 /MAXACCTJOBS
/MAXACCTJOBS=value
Specifies the maximum number of batch, interactive, and detached
processes that can be active at one time for all users of the
same account. By default, a user has a maximum of 0, which
represents an unlimited number.
2.28 /MAXDETACH
/MAXDETACH=value
Specifies the maximum number of detached processes with the cited
user name that can be active at one time. To prevent the user
from creating detached processes, specify the keyword NONE. By
default, a user has a value of 0, which represents an unlimited
number.
2.29 /MAXJOBS
/MAXJOBS=value
Specifies the maximum number of processes (interactive, batch,
detached, and network) with the cited user name that can be
active simultaneously. The first four network jobs are not
counted. By default, a user has a maximum value of 0, which
represents an unlimited number.
2.30 /NETWORK
/NETWORK[=(range[,...])]
Specifies hours of access for network batch jobs. For a
description of how to specify the range, see the /ACCESS
qualifier. By default, network logins have no access
restrictions.
2.31 /OWNER
/OWNER=owner-name
Specifies the name of the owner of the account. You can use this
name for billing purposes or similar applications. The owner name
is 1 to 31 characters. No default owner name exists.
2.32 /PASSWORD
/PASSWORD=(password1[,password2])
/NOPASSWORD
Specifies up to two passwords for login. Passwords can be from 0
to 32 alphanumeric characters in length. The dollar sign ($) and
underscore (_) are also permitted.
Uppercase and lowercase characters are equivalent. All lowercase
characters are converted to uppercase before the password is
encrypted. Avoid using the word password as the actual password.
Use the /PASSWORD qualifier as follows:
o To set only the first password and clear the second, specify
/PASSWORD=password.
o To set both the first and second password, specify
/PASSWORD=(password1, password2).
o To change the first password without affecting the second,
specify /PASSWORD=(password, "").
o To change the second password without affecting the first,
specify /PASSWORD=("", password).
o To set both passwords to null, specify /NOPASSWORD.
When you modify a password, the new password expires
automatically; it is valid only once (unless you specify
/NOPWDEXPIRED). On login, the user is forced to change the
password (unless you specify /FLAGS=DISFORCE_PWD_CHANGE).
Note that the /GENERATE_PASSWORD and /PASSWORD qualifiers are
mutually exclusive.
By default, the ADD command assigns the password USER. When you
create a new UAF record with the COPY or RENAME command, you must
specify a password. Avoid using the word password as the actual
password.
2.33 /PBYTLM
This flag is reserved for HP.
2.34 /PGFLQUOTA
/PGFLQUOTA=value
Specifies the paging file limit. This is the maximum number of
pages that the person's process can use in the system paging
file. By default, the value is 256,000 pagelets on Alpha and
Integrity server systems.
If decompressing libraries, make sure to set PGFLQUOTA to twice
the size of the library.
2.35 /PRCLM
/PRCLM=value
Specifies the subprocess creation limit. This is the maximum
number of subprocesses that can exist at one time for the
specified user's process. By default, the value is 8 on Alpha
and Integrity server systems.
2.36 /PRIMEDAYS
/PRIMEDAYS=([NO]day[,...])
Defines the primary and secondary days of the week for logging
in. Specify the days as a list separated by commas, and enclose
the list in parentheses. To specify a secondary day, prefix the
day with NO (for example, NOFRIDAY). To specify a primary day,
omit the NO prefix.
By default, primary days are Monday through Friday and secondary
days are Saturday and Sunday. If you omit a day from the list,
AUTHORIZE uses the default value. (For example, if you omit
Monday from the list, AUTHORIZE defines Monday as a primary day.)
Use the primary and secondary day definitions in conjunction with
such qualifiers as /ACCESS, /INTERACTIVE, and /BATCH.
2.37 /PRIORITY
/PRIORITY=value
Specifies the default base priority. The value is an integer in
the range of 0 to 63 on Alpha and Integrity server systems. By
default, the value is set to 4 for timesharing users.
2.38 /PRIVILEGES
/PRIVILEGES=([NO]privname[,...])
Specifies which privileges the user is authorized to hold,
although these privileges are not necessarily enabled at login.
(The /DEFPRIVILEGES qualifier determines which ones are enabled.)
A NO prefix removes the privilege from the user. The keyword
NOALL disables all user privileges. Many privileges have varying
degrees of power and potential system impact (see the HP OpenVMS
Guide to System Security for a detailed discussion). By default,
a user holds TMPMBX and NETMBX privileges. Privname is the name
of the privilege.
2.39 /PWDEXPIRED
/PWDEXPIRED (default)
/NOPWDEXPIRED
Specifies the password is valid for only one login. A user must
change a password immediately after login or be locked out of the
system. The system warns users of password expiration. A user can
either specify a new password, with the DCL command SET PASSWORD,
or wait until expiration and be forced to change. By default, a
user must change a password when first logging in to an account.
The default is applied to the account only when the password is
being modified.
2.40 /PWDLIFETIME
/PWDLIFETIME=time (default)
/NOPWDLIFETIME
Specifies the length of time a password is valid. Specify a
delta time value in the form [dddd-] [hh:mm:ss.cc]. For example,
for a lifetime of 120 days, 0 hours, and 0 seconds, specify
/PWDLIFETIME="120-". For a lifetime of 120 days 12 hours, 30
minutes and 30 seconds, specify /PWDLIFETIME="120-12:30:30". If
a period longer than the specified time elapses before the user
logs in, the system displays a warning message. The password is
marked as expired.
To prevent a password from expiring, specify the time as NONE. By
default, a password expires in 90 days.
2.41 /PWDMINIMUM
/PWDMINIMUM=value
Specifies the minimum password length in characters. Note that
this value is enforced only by the DCL command SET PASSWORD. It
does not prevent you from entering a password shorter than the
minimum length when you use AUTHORIZE to create or modify an
account. By default, a password must have at least 6 characters.
The value specified by the /PWDMINIMUM qualifier conflicts with
the value used by the /GENERATE_PASSWORD qualifier or the DCL
command SET PASSWORD/GENERATE, the operating system chooses the
lesser value. The maximum value for generated passwords is 10.
2.42 /QUEPRIO
/QUEPRIO=value
Reserved for future use.
2.43 /REMOTE
/REMOTE[=(range[,...])]
Specifies hours during which access is permitted for interactive
logins from network remote terminals (with the DCL command SET
HOST). For a description of the range specification, see the
/ACCESS qualifier. By default, remote logins have no access
restrictions.
2.44 /SHRFILLM
/SHRFILLM=value
Specifies the maximum number of shared files that the user can
have open at one time. By default, the system assigns a value of
0, which represents an infinite number.
2.45 /TQELM
Specifies the total number of entries in the timer queue plus the
number of temporary common event flag clusters that the user can
have at one time. By default, a user can have 100.
2.46 /UIC
/UIC=value
Specifies the user identification code (UIC). The UIC value is
a group number in the range from 1 to 37776 (octal) and a member
number in the range from 0 to 177776 (octal), which are separated
by a comma and enclosed in brackets. HP reserves group 1 and
groups 300-377 for its own use.
Each user must have a unique UIC. By default, the UIC value is
[200,200].
2.47 /WSDEFAULT
/WSDEFAULT=value
Specifies the default working set limit. This represents the
initial limit to the number of physical pages the process can
use. (The user can alter the default quantity up to WSQUOTA with
the DCL command SET WORKING_SET.) By default, a user has 4096
pagelets on Alpha and Integrity server systems.
The value cannot be greater than WSMAX. This quota value replaces
smaller values of PQL_MWSDEFAULT.
2.48 /WSEXTENT
/WSEXTENT=value
Specifies the working set maximum. This represents the maximum
amount of physical memory allowed to the process. The system
provides memory to a process beyond its working set quota only
when it has excess free pages. The additional memory is recalled
by the system if needed.
The value is an integer equal to or greater than WSQUOTA. By
default, the value is 16384 pagelets on Alpha and Integrity
server systems. The value cannot be greater than WSMAX. This
quota value replaces smaller values of
PQL_MWSEXTENT.
2.49 /WSQUOTA
/WSQUOTA=value
Specifies the working set quota. This is the maximum amount of
physical memory a user process can lock into its working set. It
also represents the maximum amount of swap space that the system
reserves for this process and the maximum amount of physical
memory that the system allows the process to consume if the
systemwide memory demand is significant.
The value cannot be greater than the value of WSMAX and cannot
exceed 8,192 pagelets on Alpha and Integrity server systems. This
quota value replaces smaller values of PQL_MWSQUOTA.
3 – Examples
1.UAF> ADD ROBIN /PASSWORD=SP0152/UIC=[014,006] -
_/DEVICE=SYS$USER/DIRECTORY=[ROBIN]/OWNER="JOSEPH ROBIN" /ACCOUNT=INV
%UAF-I-ADDMSG, user record successfully added
%UAF-I-RDBADDMSGU, identifier ROBIN value: [000014,000006] added to
RIGHTSLIST.DAT
%UAF-I-RDBADDMSGU, identifier INV value: [000014,177777] added to
RIGHTSLIST.DAT
This example illustrates the typical ADD command and
qualifiers. The resulting record from this command appears
in the description of the SHOW command.
2.UAF> ADD WELCH /PASSWORD=SP0158/UIC=[014,051] -
_/DEVICE=SYS$USER/DIRECTORY=[WELCH]/OWNER="ROB WELCH"/FLAGS=DISUSER -
_/ACCOUNT=INV/LGICMD=SECUREIN
%UAF-I-ADDMSG, user record successfully added
%UAF-I-RDBADDMSGU, identifier WELCH value: [000014,000051] added to
RIGHTSLIST.DAT
UAF> MODIFY WELCH/FLAGS=(RESTRICTED,DISNEWMAIL,DISWELCOME, -
_NODISUSER,EXTAUTH)/NODIALUP=SECONDARY/NONETWORK=PRIMARY -
/CLITABLES=DCLTABLES/NOACCESS=(PRIMARY, 9-16, SECONDARY, 18-8)
%UAF-I-MDFYMSG, user records updated
The commands in this example add a record for a restricted
account. Because of the number of qualifiers required, a MODIFY
command is used in conjunction with the ADD command. This helps
to minimize the possibility of typing errors.
In the ADD command line, setting the DISUSER flag prevents the
user from logging in until all the account parameters are set
up. In the MODIFY command line, the DISUSER flag is disabled
(by specifying NODISUSER) to allow access to the account.
The EXTAUTH flag causes the system to consider the user as
authenticated by an external user name and password, not by the
SYSUAF user name and password.
The record that results from these commands and an explanation
of the restrictions the record imposes appear in the
description of the SHOW command.
4 /IDENTIFIER
Adds only an identifier to the rights database. It does not add a
user account.
Format
ADD/IDENTIFIER [id-name]
4.1 – Parameter
id-name
Specifies the name of the identifier to be added to the
rights database. If you omit the name, you must specify the
/USER qualifier. The identifier name is a string of 1 to 32
alphanumeric characters. The name can contain underscores and
dollar signs. It must contain at least one nonnumeric character.
4.2 – Qualifiers
4.2.1 /ATTRIBUTES
/ATTRIBUTES=(keyword[,...])
Specifies attributes to be associated with the new identifier.
The following keywords are valid:
DYNAMIC Allows unprivileged holders of the identifier to
remove and to restore the identifier from the
process rights list by using the DCL command SET
RIGHTS_LIST.
HOLDER_ Prevents people from getting a list of users who
HIDDEN hold an identifier, unless they own the identifier
themselves.
NAME_HIDDEN Allows holders of an identifier to have it
translated, either from binary to ASCII or from
ASCII to binary, but prevents unauthorized users
from translating the identifier.
NOACCESS Makes any access rights of the identifier null
and void. If a user is granted an identifier with
the No Access attribute, that identifier has no
effect on the user's access rights to objects. This
attribute is a modifier for an identifier with the
Resource or Subsystem attribute.
RESOURCE Allows holders of an identifier to charge disk
space to the identifier. Used only for file
objects.
SUBSYSTEM Allows holders of the identifier to create and
maintain protected subsystems by assigning the
Subsystem ACE to the application images in the
subsystem. Used only for file objects.
By default, none of these attributes is associated with the new
identifier.
4.2.2 /USER
/USER=user-spec
Scans the UAF record for the specified user and creates the
corresponding identifier. Specify user-spec by user name or
UIC. You can use the asterisk wildcard to specify multiple user
names or UICs. Full use of the asterisk and percent wildcards
is permitted for user names; UICs must be in the form [*,*],
[n,*], [*,n], or [n,n]. A wildcard user name specification (*)
creates identifiers alphabetically by user name; a wildcard UIC
specification ([*,*]) creates them in numerical order by UIC.
4.2.3 /VALUE
/VALUE=value-specifier
Specifies the value to be attached to the identifier. The
following formats are valid for the value-specifier:
IDENTIFIER:n An integer value in the range of 65,536 to
268,435,455. You can also specify the value in
hexadecimal (precede the value with %X) or octal
(precede the value with %O).
The system displays this type of identifier in
hexadecimal. To differentiate general identifiers
from UIC identifiers, the system adds %X80000000 to
the value you specify.
GID:n GID is the POSIX group identifier. It is an integer
value in the range 0 to 16,777,215 (%XFFFFFF).
The system will add %XA400.0000 to the value you
specify and then enter this new value into the
system RIGHTSLIST as an identifier.
UIC:uic A UIC value in standard UIC format consists of a
member name and, optionally, a group name enclosed
in brackets. For example, [360,031].
In numeric UICs, the group number is an octal
number in the range of 1 to 37776; the member
number is an octal number in the range of 0 to
177776. You can omit leading zeros when you are
specifying group and member numbers.
Regardless of the UIC format you use, the system
translates a UIC to a 32-bit numeric value.
Alphanumeric UICs are not allowed.
Typically, system managers add identifiers as UIC values to
represent system users; the system applies identifiers in integer
format to system resources.
4.3 – Examples
1.UAF> ADD/IDENTIFIER/VALUE=UIC:[300,011] INVENTORY
%UAF-I-RDBADDMSGU, identifier INVENTORY value: [000300,000011]
added to RIGHTSLIST.DAT
The command in this example adds an identifier named INVENTORY
to the rights database. By default, the identifier is not
marked as a resource.
2.UAF> ADD/IDENTIFIER/ATTRIBUTES=(RESOURCE) -
_/VALUE=IDENTIFIER:%X80011 PAYROLL
%UAF-I-RDBADDMSGU, identifier PAYROLL value: %X80080011 added to
RIGHTSLIST.DAT
This command adds the identifier PAYROLL and marks it as a
resource. To differentiate identifiers with integer values
from identifiers with UIC values, %X80000000 is added to the
specified code.
5 /PROXY
Adds an entry to the network proxy authorization files,
NETPROXY.DAT and NET$PROXY.DAT, and signals DECnet to update
its volatile database. Proxy additions take effect immediately on
all nodes in a cluster that share the proxy database.
Format
ADD/PROXY node::remote-user local-user[,...]
5.1 – Parameters
node
Specifies a DECnet node name. If you provide a wildcard character
(*), the specified remote user on all nodes is served by the
account defined as local-user.
remote-user
Specifies the user name of a user at a remote node. If you
specify an asterisk, all users at the specified node are served
by the local user.
For systems that are not OpenVMS and that implement DECnet,
specifies the UIC of a user at a remote node. You can specify
a wildcard character (*) in the group and member fields of the
UIC.
local-user
Specifies the user names of 1 to 16 users on the local node. If
you specify an asterisk, a local-user name equal to remote-user
name will be used.
5.2 – Positional Quals.
5.2.1 /DEFAULT
Establishes the specified user name as the default proxy account.
The remote user can request proxy access to an authorized account
other than the default proxy account by specifying the name of
the proxy account in the access control string of the network
operation.
5.3 – Examples
1.UAF> ADD/PROXY SAMPLE::WALTER ROBIN/DEFAULT
%UAF-I-NAFADDMSG, record successfully added to NETPROXY.DAT
Specifies that user WALTER on remote node SAMPLE has proxy
access to user ROBIN's account on local node AXEL. Through
proxy login, WALTER receives the default privileges of user
ROBIN when he accesses node AXEL remotely.
2.UAF> ADD/PROXY MISHA::* MARCO/DEFAULT, OSCAR
%UAF-I-NAFADDMSG, record successfully added to NETPROXY.DAT
Specifies that any user on the remote node MISHA can, by
default, use the MARCO account on the local node for DECnet
tasks such as remote file access. Remote users can also access
the OSCAR proxy account by specifying the user name OSCAR in
the access control string.
3.UAF> ADD/PROXY MISHA::MARCO */DEFAULT
%UAF-I-NAFADDMSG, record successfully added to NETPROXY.DAT
Specifies that user MARCO on the remote node MISHA can use only
the MARCO account on the local node for remote file access.
4.UAF> ADD/PROXY TAO::MARTIN MARTIN/D,SALES_READER
%UAF-I-NAFADDMSG, proxy from TAO:.TWA.RAN::MARTIN to MARTIN added
%UAF-I-NAFADDMSG, proxy from TAO:.TWA.RAN::MARTIN to SALES_READER
added
Adds a proxy from TAO::MARTIN to the local accounts MARTIN (the
default) and SALES_READER on a system running DECnet-Plus.