Re: Viewing SSH users on VMS

On 31/07/2024 15:02, David Jones wrote:

On 7/27/2024 1:34 PM, Chris Townley wrote:

On AXP ssh uses show as FT terminals, and the source can be seen, and accessed using the DVI code TT_ACCPORNAM. for example on AXP I see:
>
$ sh u /f/i
       OpenVMS User Processes at 27-JUL-2024 18:24:48.74
     Total number of users = 2,  number of processes = 2
>
Username  Process Name       PID     Terminal
SYSTEM    SYS_SYSTEM_01    0000012B  OPA0:
TOWNLEYC  CCT_TOWNLEYC_01  0000012A  FTA1:(ssh/merlin.fritz.box:50407)
>
However on X86 TT_ACPORNAM is blank, and I can find no method of seeing where they come from. OK it is probably me as it is always local, so it is perhaps not that important. But I do like a challenge!
>
Currently I just see:
>
1 $ sh u /f/i
       OpenVMS User Processes at 27-JUL-2024 18:29:41.86
     Total number of users = 2,  number of processes = 5
>
  Username  Process Name      PID     Terminal
  SYSTEM    SYSTEM          00000431  OPA0:
  TOWNLEYC  FTA12_TOWNLEYC  0000044C  FTA12:
  TOWNLEYC  FTA13_TOWNLEYC  0000044E  FTA13:
  TOWNLEYC  FTA14_TOWNLEYC  00000450  FTA14:
  TOWNLEYC  TOWNLEYC        00000448  FTA11:
>
Any ideas how I could get this information?
>

 The best I could do was make my personal finger program do this for
SSH connections (terminal FTA1):
                            FINGER Version 4.9
Wed  31-JUL-2024 09:18         HOBBY::          Up Since Fri  26-JUL-2024 00:36
Job counts: Interactive = 5, Network = 4, Detached = 3
 Username     Name                 Image        Line    Location
----------   -------------------- ------------ ------- -------------------------
JONESD       David Jones          < DCL >      FTA1:   PTY (SSHD22_BG7584)
                ""                 TCPIP$UCP    VTA1:   Host: 192.168.1.55 Port:
                ""                 < DCL >      VTA2:   Host: 192.168.1.55 Port:
                ""                 < DCL >      OPA0:   Unknown for OPA0:
                ""                 finger_x86   VTA3:   Host: 192.168.1.179 Port:
--------------------------------------------------------------------------------
 It uses $GETDVI to get the LOCKID value for the terminal, which the PTY driver
re-purposes to hold the ipid of that pseudoterminal's control process. It then
calls EXE$IPID_TO_EPID from exec mode to get an epid we can use with $GETJPI to
fetch its process name (SSHD22_BG7584). I never found a way to get the remote
connect information from the name of the TCPIP device (assuming the process name
reliably reflected it).

Thanks, that is interesting. Of course in the past the source node, and user was put into the terminals TT_ACCPORNAM, so easy to get.
What I have discovered, which could make getting the parent PID unnecessary, is that a log file is created in SSH$ROOT:[VAR] named either
<this_hostname>_<remote host or IP address>_<process_PID>.log
or
<remote host or IP address>_<process_PID>.log
but unless the login fails, nothing is written.
No idea why or when which form is used.
Can I presume that a PID will be unique until a system reboot? If so I could delete/rename these logs at system startup, then look for the file, at least to get the remote node, and add to the process name.
Otherwise maybe I cold hack the client startup to create a readable file with remote node and user?
--
Chris