Security Considerations

In this section: Special Passwords FOCSUACC DATA

This section describes the implications of using special passwords, the ability to issue commands without a password, and the FOCSUACC DATA file.

Special Passwords

If the server is started with the password ACIGROUP, the ACIGROUP of the user and the ACIGROUP of the server must match before the user can issue a command. This allows all users of a specific AGIGROUP command authority for the server.

FOCSUACC DATA

Example: Sample FOCSUACC File

The FOCSUACC DATA file defines a list of users and/or groups of users who are authorized to access the server via the ACIGROUP directory option. If omitted, all users are authorized. User IDs are limited only by virtual storage. ACIGROUP entries are limited to 16.

Example: Sample FOCSUACC File

The following is a sample of the FOCSUACC file that is shipped with FOCUS:

*  
* This is a sample file. If FOCUSACC DATA is found on any accessed disk 
* by the FOCUS SU SERVER, then ACCESS using security rules, defined in 
* this file, will be used.
* This data file must be named FOCUSACC DATA, on any disk accessed by 
* the SERVER.
*
* File MUST be RECFM=F LRECL=80.      
*         
* Comments begin with a '*' in column 1. Comments may follow entries 
* so long as they begin after column 8. All userids, keywords, and groups 
* must be in uppercase.       
*         
* Only users which are defined in this file or users in specific  
* ACIGROUPs will be allowed access. Userids MUST begin in column 1. 
*         
* A special keyword "ACIGROUP" allows 'GROUPS' of users to be defined 
* rather than specific userids. Entries can be 'mixed'. If ACIGROUP is 
* defined, the group which accesses the server most should be defined 
* BEFORE other ACIGROUPS. The 'GROUP' must follow the keyword, ACIGROUP 
* and start in column 10. Entries are COLUMN sensitive.
*         
VMUSERID    John Doe, dept sales, authorized by jack smith 
VMUSERA     mary smith     
VMUSERB     temp id for sales    
VMUSERC        
*         
* allow all users with ACIGROUP of 'ACCT ' and 'MANAGE ' access 
* where most users who access the server are in the 'ACCT ' group
*         
ACIGROUP ACCT      * allow all accounting users to access  
ACIGROUP MANAGE    * allow managers access