Restricting outbound TCP/IP access by account?

[Alan Winston - SSRL Central Computing]

Multinetters:

$multinet show /version
Process Software MultiNet V5.1 Rev A-X, COMPAQ AlphaServer DS20E 666 MHz,
OpenVMS AXP V8.3

I have an account that should be allowed inbound/outbound DECnet access, but
should only be allowed inbound TCP/IP access. (That is, you should be able
to SSH into it, but not, say, launch Xwindows keystroke sniffers from it.)

Does Multinet or VMS provide some way to do this? (Removing NETMBX privilege
whacks DECnet as well as IP - too big a hammer for my uses.)

Thanks,

-- Alan

[Jeremy Begg]

Hi Alan,

Post by Alan Winston - SSRL Central Computing
$multinet show /version
Process Software MultiNet V5.1 Rev A-X, COMPAQ AlphaServer DS20E 666 MHz,
OpenVMS AXP V8.3
I have an account that should be allowed inbound/outbound DECnet access, but
should only be allowed inbound TCP/IP access. (That is, you should be able
to SSH into it, but not, say, launch Xwindows keystroke sniffers from it.)
Does Multinet or VMS provide some way to do this? (Removing NETMBX privilege
whacks DECnet as well as IP - too big a hammer for my uses.)

The only thing which springs to mind would be an ACL on
MULTINET:MULTINET_SOCKET_LIBRARY.EXE but this probably won't to much for
programs which make their own $QIO calls. It would probably defeat most
ported Unix utilities, though.

Regards,

Jeremy Begg

+---------------------------------------------------------+
| VSM Software Services Pty. Ltd. |
| http://www.vsm.com.au/ |
| "OpenVMS Systems Management & Programming" |
|---------------------------------------------------------|
| P.O.Box 402, Walkerville, | E-Mail: ***@vsm.com.au |
| South Australia 5081 | Phone: [phone] |
|---------------------------| Mobile: [phone] |
| A.C.N. 068 409 156 | FAX: [phone] |
+---------------------------------------------------------+