Location-based Security

When a user makes a connection, his or her location is identified by a Physical Location Identifier (PLId) which is a function of the method of connection used and the location of the user. The user can read, but not set, the PLId.

Note that when you use DDA for connection to another host, the current PLId is passed to the called host. If you use a character circuit, however, a new PLId is assigned.

PLid Format

A PLId can have any of the following formats:

CHAR-Address-Port

This form is used for character circuit connections. On OSI circuits, Address is the calling NSAP and Port is the calling TSAP. On TCP/IP circuits, Address is the calling IP address and Port is the calling port identifier.

Example: CHAR-49000100112233445501-0203

CHAR2-Address-Port

This form is used for character mode connections to a type 2 listening entry - that is, one that uses the called TSAP instead of the calling TSAP. Type 2 listening entries are used for connection via non-NEC terminal servers that do not associate a TSAP with each physical port.

On OSI circuits, Address is the calling NSAP and Port is the called TSAP. On TCP/IP circuits, Address is the calling IP address and Port is the called port identifier specified in the ROUTE-FILE listening entry.

Example: CHAR2-152.114.132.39-1100

INET-DecimalAddress-Port

This form is used for telnet connections that use location-based security. DecimalAddress is the IP address (in decimal) and Port is the port or session number.

Example: INET-152.114.132.39-1100

INET-HexAddress-Session

This form is used for DDA connections from PCs via TCP. HexAddress is the caller?s IP address (in hexadecimal) and Session is the PC session number.

Example: INET-98.72.0C.0C-2

A similar form is used for connections via the telnet LBS daemon.

MPS-Address-Port

This form is used for connections initiated from a Multi-protocol Server (MPS). Address is the Ethernet address of the server and Port is the port number on that server.

Example: MPS-001122334455-0005

NETX-Address

This form is used for connections through a NetworkX node configured to convert OSI transport class 3 to transport class 4, and to include the X.25 calling address in the call user data of the connect request. Address is the X.25 calling address in SPAG Y/13 format.

Example: NETX-1442987654

NT-SerialNo-Session

This form is used for telnet sessions to a Windows system. SerialNo is the called system’s serial number and Session is the session number.

Note that the session number is allocated dynamically at logon and may therefore be different each time a user logs on.

Example: NT-123456-6

PLAN-SerialNo-Port

This form is used for Series 18/19 PLAN connected terminals. SerialNo is the serial number of the Series 18/19 system and Port is the PLAN port number.

Example: PLAN-004000-0012

SLAN-Address-Port

This form is used for:

• Connections via an S-LAN network. In this case, Port is the port number on the Series 19 system.

  Example: SLAN-56A9D3EE6B27-0426

• OSI connections from PCs. In this case, Port is the PC session number.

  Example: SLAN-0020AF49EA43-0001

In both cases, Address is the Ethernet address of the caller.

TNET-Location

This form is used for connections via the telnet LBS daemon.

TSRV-Address-Port

This form is used for connections initiated from a Multi-protocol Terminal Server (MPTS). Address is the Ethernet address of the server and Port is the port number on that server.

Example: TSRV-008023050587-0008

TYM-Node-Host-Port

This form is used for an incoming call from a TYMNET network. Node is the Tymnet node identifier, Host is the host number and Port is the port number.

Example: TYM-309951-0033-0078

UNET-SerialNo-Name

This form is used for Reality-initiated processes connected to a network terminal (that is, using START-NET-PRT [RealityX 3.1 only] or NET-LOGON). SerialNo is the calling system’s UNIX serial number and Name is the name of the ROUTE-FILE entry on that system.

Example: UNET-200433-support.port11

UNIX-SerialNo

This form is used for daemon processes which do not already have a PLId, if the environment variable UC_PROCPLID is not set or has the value 0. SerialNo is the calling system’s UNIX serial number.

If a unique PLId is required, the environment variable UC_PROCPLID can be set to 1; a PLId with the form UPROC-SerialNo-Process will then be generated.

Example: UNIX-123456

UNIX-SerialNo-Port

This form is used for directly connected terminals and telnet sessions connected via the standard telnet daemon. SerialNo is the called system’s UNIX serial number and Port is the tty port number.

Note that for telnet connections the tty port number is allocated dynamically at logon and may therefore be different each time a user logs on.

Example: UNIX-123456-tty06

UNIX-SerialNo-rtSsPp

This form is used for terminals connected via an annex terminal server using the proprietary call protocol. SerialNo is the calling system’s UNIX serial number, Ss denotes the terminal server number and Pp the port on the terminal server.

Example: UNIX-123456-rt0102

UPROC-SerialNo-Process

If the environment variable UC_PROCPLID has the value 1, daemon processes that do not already have a PLId (no REALPLID environment variable) will have PLIds in this format. SerialNo is the calling system’s UNIX serial number, and Process is the UNIX process id.

Example: UPROC-123456-3751

X25-Address

This form is used for X.25 PAD connections. Address is the X.121 address of the calling PAD.

Example: X25-03323674900234

User-defined PLId Format

This optional feature (enabled by software key) is intended for use when logging on to Reality via a port specified in the devices file using the OPEN keyword. The format is defined in the host environment variable REALPLIDFORMAT — this can contain literal text and the place-holder %d which, when used, is replaced by the port number. For example, if REALPLIDFORMAT is set to PORT-%d  and a user logs onto port 35 (by using the reality command with the -t option), the PLId assigned will be PORT-35.

Telnet Security

The telnet location based security (LBS) daemon provides location-based security for telnet-connected users.

The telnet LBS daemon has six modes of operation:

Any of the above modes can be modified by adding 4 to the mode number - this has the effect of disabling the normal 60-second login timeout.

Configuring Telnet LBS

The telnet LBS daemon must be assigned at least one port in the services file (/etc/services). The following is a typical entry:

telnet_lbs0     1400/tcp            # telnet location based security

Each new service added to the services file should have a corresponding entry in the inet daemon configuration file (/etc/inetd.conf). These additional entries should follow the format of the telnet service entry except for the fields listed in the following table:

Field	Description	Value
1	Service name	telnet_lbs0 *
6	Executable path	/usr/RCS/bin/telnetd_lbs
7	Server-arguments	telnetd_lbs
8		-m1 *
9		-k

* Example values.

For example:

telnet_lbs0 stream tcp nowait root /usr/RCS/bin/telnetd_lbs telnetd_lbs -m11

• Field 8 specifies the required mode, in the form:

  -mMode

• Field 9 is an optional parameter that disables TCP keep-alive. You should specify this option if the connection is likely to be via an ISDN network — a ‘quiet’ telnet circuit can increase the network charges significantly, because the keep-alive packets constantly force the ISDN circuit to be reconnected.

Whenever you change either the /etc/services or /etc/inetd.conf files, the inet daemon must be re-initialised before the changes will take effect. To do this, ascertain the process id (pid) of the inet daemon by entering the following command:

ps -e | grep inetd | grep -v grep

The first field of the result contains the required process id. You can then re-initialise the daemon with the following command:

kill -1 pid