<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Tops-20 is vastly different from Unix (and I believe also VMS) as
to how it manages user ids and accounts. Parts of the
authentication paradigm are very tightly woven into the the file
system. Briefly, <br>
</p>
<ul>
<li>A user id is a login-able directory (I.E., one that doesn't
have a password and is not set <tt>FILES-ONLY</tt>). In
addition to basic OS restrictions which prevent you from viewing
file system meta-data unless you have appropriate authorization,
an access control job (<tt>ACJ</tt>) is layered on top of this
which can even restrict privileged users.</li>
<li>Accounts are either validated out of a binary accounting file
in monitor space (which is compiled from <tt>ASCII</tt> source)
or via the <tt>ACJ</tt>. Accounts can have multiple users or
systems processes (such as spoolers) creating billing records.
Users can switch between accounts on a per-job, per-fork and
intra-program basis (a program can decide to bill certain
portions of its activity to different accounts).</li>
<li>The obvious benefit is that there is no password file to
attack or steal and you can't even tell that there is an
accounting file; probing passwords is monitored and a certain
amount of intervention is done. It is <i>extremely</i> fast.
No <tt>/etc/passwd</tt> to grovel.<br>
</li>
</ul>
<div class="moz-cite-prefix">However, a deleterious side-effect is
that once an id is created, it can be used for <u>anything</u>,
including online interactive login.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On a <tt>PANDA</tt> monitor, is
possible to specify a user id as <tt>FTP-ONLY</tt>, but neither
the supplied 5 series <tt>ACJ</tt> nor the <tt>EXEC</tt> do
anything with it. Historically, the Tops-20 <tt>FTP</tt> server
implemented <tt>ANONYMOUS</tt> usage by parsing for the login
user atom <tt>ANONYMOUS</tt> and then swallowing anything for the
password (what was typically supplied was an email addresses).
This was then hardwired into a local id.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Artifacts of this still exist in
certain browers. Guess who supplies <tt>IEUSER@</tt> as the
email address password for <tt>ANONYOUS</tt> usage?</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I recall that this is the approach that
we had to use with Tops-20 <tt>FAL</tt>. The Extended Mode <tt>FTP</tt>
server that I wrote is configurable via a file to specify the
underlying id and password. More productization would probably
including having the <tt>ACJ</tt> enforce <tt>FTP-ONLY</tt> on <tt>LOGIN%</tt>
or <tt>CRJOB%</tt> and having the <tt>EXEC</tt> parse for and
display <tt>FTP-ONLY</tt>. Probably about two weeks' part time
work as I recall. Might have to consider Batch policy.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">One approach here could be to lift the
<tt>ANONYMOUS</tt> code out of <tt>EFTPSR</tt> and drop it into <tt>FAL</tt>
and then do the changes to the <tt>ACJ</tt> and <tt>EXEC</tt>.
I'm just surprised none of the HECnet Tops-10 or Tops-20 nerds
have done it (there is some commonality in some of the sources).<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Since Tops-20 has a <tt>BLISS</tt>
compiler which implements <tt>BLISS</tt> <tt>COMMON</tt> (my
first training at DEC as an employee was to write code that would
cross compile under VMS, RSX, Tops-10 and Tops-20). I think it
might be useful to review some of the VMS DECnet source, if any of
that is available. It might be possible to lift some
functionality, which could be fun.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Does the VMS hobbiest license get you
source code?<br>
</div>
<blockquote type="cite"
cite="mid:270574c8-ed8c-cf6e-ef51-49d728375d3b@softjar.se">
<hr width="100%" size="2">On 7/3/2019 7:21 PM, Johnny Billquist
wrote:<br>
<br>
VMS, as someone else mentioned, have a default account for FAL.
<br>
<br>
RSX does not have that. However, you can use proxy access in RSX
to achieve something similar. Enable incoming and outgoing proxy,
and define a default account that incoming requests should be
using that way.
<br>
<br>
If TOPS-20 can do this I don't know. But it's a suggestion for
something else/more to check.
<br>
<br>
Johnny
<br>
<blockquote type="cite">
<hr width="100%" size="2">On 2019-07-03 14:15, Thomas DeBellis
wrote:
<br>
<br>
I have some software that I'd like to post, but don't recall how
to configure FAL to allow for an anonymous connection; to
download from a restricted directory.
<br>
<br>
I know how to do it for the FTP server (seeing as I wrote it),
but ... different code base.
<br>
<br>
I can only vaguely remember what we did for CCnet at Columbia
University in the 1980's, but I think it was kind of a hack.<br>
</blockquote>
</blockquote>
</body>
</html>