14

In 1986-1987 I was an admin for a VMS 4.2 (or 4.1 or 4.3) system in college. I recall that at some point, there was a problem that caused the DECwriter console to spew messages to the effect of "INTRUSION COUNTERMEASURES ACTIVATED". I think the problem was actually a bad serial line or terminal; i.e., not an actual intruder trying to brute-force entry. We only had a handful of serial terminals on this Vax 11/750, all in the same room. My question is: what are these "countermeasures" the console message spoke of? (I would guess some sort of account lockout)

Edit: Looking at the documentation linked in the comment, my memory says that maybe the terminology in the console messages may have been "intrusion evasion activated".

Improve this question
5
  • 3
    See section 7.5.7 in VMS System Security.
    – another-dave
    Jul 17 at 15:46
  • 2
    @another-dave Ah, that's what I was looking for, thanks! Want to make that an answer? Although I don't remember anything about an intrusion database. That is probably a feature that was added in a later VMS version.
    – LAK
    Jul 17 at 15:59
  • 3
    Sure, I'll write it up soon ('at work' right now).
    – another-dave
    Jul 17 at 16:34
  • @another-dave Waiting for it :))
    – Raffzahn
    Jul 17 at 16:55
  • 2
    Off the top of my head, and as an old VMS user, I''d bet it's something about detecting multiple failed login attempts. Similar to fail2ban on Linux.
    – RonJohn
    Jul 17 at 21:45

1 Answer 1

Reset to default
14

The relevant manual is the Guide to VMS System Security. I was unable to locate the manual for V4.2; the link is to a V5.2 manual.

The intrusion countermeasures are described in 5.2.7.7, as 'breakin detection and evasion'. Failed password attempts (per account) are tracked, and if some configured limit is exceeded with some configured time interval, further logins are prevented, and optionally the account can be locked pending sysmgr unlocking.

Bottom of page 5-25 mentions a 'breakin database'.

The relevant DCL commands use the keyword INTRUSION. I didn't actually see mention of the phrase 'INTRUSTION COUNTERMEASURES ACTIVATED' or similar.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .