1 JUMPHJUMP allows a user to login exactly  as another user without a password.HIt  also  allows a more restricted (non-exact) impersonation of  anotheruser.HUse of JUMP  is  restricted  to  specific  categories  of users: Systems=Programmers, Operators and any specifically authorised users.HJUMP provides fine-grained access  specifications  and secure logging ofHexact  jumps.   All users are validated against an Access List  file  toHdetermine any specific access to be granted or denied in addition to anyHdefault access (e.g.  for Operators).  The Access  List  file  also  mayGcontain options relating to security monitoring of exact JUMP sessions.-By default, all users can JUMP to themselves.)The general syntax of the JUMP command is   $ JUMP [username] [qualifiers]2 ParameterHJUMP takes a single optional parameter which is a username.  This is theHusername which will be  used  (after  validation)  as the target user towhich  to  change.HIf no username is specified,  the  username  is defaulted to the currentHusername  of  the  process.   If a non-exact jump  without  username  isHspecified, JUMP returns all values of items  to  those  of  the  current	username.HOnly Systems Programmers and users specifically authorised in the AccessHList file can jump in any manner to  a user with privileges in excess of3those defined by the logical name JUMP_MINOR_PRIVS.2 Qualifiers/ALL  /ALL  /NOALL	(Default)HUse of /ALL is restricted to Systems Programmers. It causes all "normal"Factions of a non-exact jump _and_ the action of the SETUSER qualifier./AUDIT  /AUDIT	(Default)
  /NOAUDITHBy default, use of JUMP is audited  to a site-specific audit trail file.HSystems Programmers  may use /NOAUDIT to prevent auditing of  successfuljumps./ESCAPE_CHARACTER.  /ESCAPE_CHARACTER[=<valid escape character>]%  /NOESCAPE_CHARACTER       (Default)HWhen jumping EXACT, an escape character can be defined, which will causeHimmediate termination of the  pseudo-terminal  process.  To generate theHescape character when logged in to the pseudo-terminal, simply hold downHthe control key (Ctrl) and press the defined letter, e.g., Ctrl-K if the+letter 'K' is the defined escape character.;The following letters are the only valid escape characters:  D,F,G,I,K,L,N,P,U,VHBy default, there is no escape character.  If the qualifier is specifiedHwithout providing a specific character,  the default escape character isthe letter 'D'.0Example:  $ JUMP FRED /EXACT /ESCAPE_CHARACTER=F/EXACT  /EXACT  /NOEXACT	(Default)HLogin exactly as the targeted user without  a password.  This is done byHcreating  a pseudo-terminal logged in as the target user.  The result is>identical to logging in as the user with the correct password.HThe RECORD, SECURE_MODE and NOTIFY  qualifiers  can also be specified toHgenerate,  save  and  distribute  a log of the session  running  on  thepseudo-terminal.7See also the help on the JUMP_SECURE_MODE logical name./LOG  /LOG	(Default)  /NOLOGHBy default, successful jumps are  logged  to  SYS$OUTPUT.  Use /NOLOG tochange "quietly"!/NOTIFY	  /NOTIFY  /NONOTIFY	(Default)?  /NOTIFY=([NO]BEFORE,[NO]AFTER,[NO]INCLUDE,[NO]MAIL,[NO]OPCOM)HThis qualifier is used  with  /EXACT  to  notify  specific users that anHexact jump is being performed.  Notification may be by OPCOM messages orHvia  mail  messages  sent  to the users specified by  the  logical  nameJUMP_NOTIFY_MAILLIST.E  /NOTIFY=BEFORE     Issue notification before the JUMP is initiated.E  /NOTIFY=AFTER      Issue notification after the JUMP has completed.D  /NOTIFY=INCLUDE    When used with the RECORD and AFTER qualifiers,A                       include a copy of the session log with the4                       completion mail notification.:  /NOTIFY=MAIL       Issue notification via mail messages.2  /NOTIFY=OPCOM      Issue notification via OPCOM.  /NOTIFY=EXIT_ON_MAIL_ERROR@                     Terminate JUMP when MAIL notification failsHIf the NOTIFY qualifier is  specified  without any keywords, the defaultHkeywords  are (BEFORE, AFTER, INCLUDE, MAIL, OPCOM, EXIT_ON_MAIL_ERROR).<Individual keywords may be specifically negated as required.HIf NOTIFY=EXIT_ON_MAIL_ERROR is set (explicitly, or implicitly by JUMP),HNOTIFY=BEFORE  will  also  be   set   mandatorily.   This  ensures  thatHidentifiable  problems  with  MAILing  are flagged *before*  a  JUMP  is
performed.7See also the help on the JUMP_SECURE_MODE logical name.
/OVERRIDE_UAF  /OVERRIDE_UAF  /NOOVERRIDE_UAF	(Default)HSystems Programmers may use this qualifier  to set their username to oneHwhich  is  not in the UAF when performing non-exact jumps, and  to  jump8EXACT to users who have the DISUSER flag set in the UAF.H*** WARNING!!!  Jumping /EXACT to  a  username with the DISUSER flag ***H*** set  causes the  pseudo-terminal  process  to be logged in  with ***H*** the username and UIC  of the target user,  but  ALL  other  user ***H*** profile information is that of the invoking user.  BEWARE!!!     ***H*** Avoid jumping to a DISUSERed account.  If you must do this,  use ***H*** a non-exact jump.                                                ***/RECORD	  /RECORD  /NORECORD	(Default)HThis qualifier can be  specified  with  /EXACT  to generate a transcriptH(session  log)  of the actions performed whilst JUMPed to the  specified5user.  The log file specification will be of the form&    JUMP_<user1>-<user2>.<date>_<time>?where <user1> is the username of the user executing JUMP/EXACT,.      <user2> is the username being JUMPed to,5      <date>  is the date when the jump is performed,5  and <time>  is the time when the jump is performed..For example,  JUMP_FRED-HARRY.20010529_093113.HWhen jumping  in  Secure  mode  (either  /SECURE_MODE  is specified, theHJUMP_SECURE_MODE logical name is defined as "TRUE", or the Secure optionHhas  been  specified  in  the Access List file), the log  file  will  beHcreated in the directory specified by the logical name  JUMP_SECURE_DIR.9The default value of this logical name is "SYS_MANAGER:".HWhen not jumping in Secure  mode,  the  log  file will be created in theHdirectory  specified  by  the logical name JUMP_USER_DIR.   The  defaultHvalue of this logical name is "SYS$LOGIN:" (the login directory  of  theHuser  executing  the  JUMP command).  A common alternative value for theHJUMP_USER_DIR  logical  name  is   "SYS$DISK:[]"  (the  current  default2directory of the user executing the JUMP command).7See also the help on the JUMP_SECURE_MODE logical name./SECURE_MODE  /SECURE_MODE  /NOSECURE_MODE	(Default)HThis qualifier can be  used  with  the  EXACT  qualifier.  It causes the9equivalent action to specifying the following qualifiers:  /SECURE_MODE /RECORD ->  /NOTIFY=(BEFORE,AFTER,INCLUDE,MAIL,OPCOM,EXIT_ON_MAIL_ERROR)HThe log file will be created in a 'secure' directory.  This directory is.specified by the logical name JUMP_SECURE_DIR.HSee also the help on  the  JUMP_SECURE_MODE  logical name and the RECORD
qualifier./SETUSER
  /SETUSER  /NOSETUSER	(Default)ISystems Programmers may use this qualifier to change ONLY their username./UPDATE_UAF
  /UPDATE_UAF  /NOUPDATE_UAF    (Default)HBy default, the  non-interactive login timestamp in  the UAF is  updatedHwhen an  EXACT JUMP is performed.   The UPDATE_UAF qualifier  will forceHthe interactive login timestamp also to be updated and the login failurecount to be reset to zero./VERSION
  /VERSION  /NOVERSION	(Default)HDisplay the current version  identification  of JUMP.  If this qualifierHis  specified, any other qualifiers and parameters are ignored, and JUMPEwill perform no action other than to display the version information.2 User_Categories)There are three categories of JUMP users:5 Systems Programmers:  Users with SETPRV privilege or7                       in an implicit system UIC group.?                       Systems Programmers can target any user.& Operators: Users with OPER privilege.F            Operators cannot target users who have more than a certainF            set of privileges unless specifically authorised to do so.? All users who are not either Systems Programmers or Operators.>     These users can only target users for whom they have been     specifically authorised.2 Non-exact_jumpsHNon-exact jumps simply change  characteristics  of  the current process.8Items which are changed to those of the target user are:2  UIC, Default Directory, Default Disk, LNM$GROUP.I  Username (Systems Programmers only, using the SETUSER or ALL qualifier).Privileges and process rights are NOT changed.HNon-exact jumps  are  useful  for  allowing  Operators,  for example, toFrestore user files from backup or archive tapes to the user's account.2 Logical_NamesHThere are many logical  names  which  the  System Manager may define forHJUMP.  All must be defined in the SYSTEM logical name table in EXECUTIVEmode.HNOTE: Some JUMP logical  names  define  file or directory specificationsHfor  JUMP files  that are secure files.  All logical names used as  partHof these specifications must also be defined in  EXECUTIVE  mode.   ThisHapplies   to  all  logical  name  translations  for  the  specification,Hincluding those found during  iterative  translation.   Access to secure'files will be denied if this is not so.HFor example, if JUMP_SECURE_DIR is defined as "SAFE_PLACE:", the logicalHname SAFE_PLACE (and  all  other  logical  names  found during iterative1translation) *must* be defined in EXECUTIVE mode.HEXCEPTION: There is one  (and  ONLY  one)  exception  to  this rule. TheH           JUMP_USER_DIR  logical  name  may  be   defined  in  user  orH           supervisor  mode  by  the user.   This  allows  user-specificH           specification of the location for recorded session log  filesH           for EXACT jumps when NOT in Secure mode.  NOTE, however, thatH           any  explicit  System  Manager definition of JUMP_USER_DIR inH           EXECUTIVE  mode,  or  specifying  Secure  mode  will *always*>           override any user definition in outer access modes.3 JUMP_ACCESS_LISTHThe logical name JUMP_ACCESS_LIST is  the  file  specification of a fileHcontaining  access lists to determine who is specifically authorised  toHJUMP, or prohibited from JUMPing, and to whom access is to be granted orHdenied.  The file may also contain options  for  any  particular  accessHlist.   See  the  example  Access List file for full details of the fileformat.HThe default value of JUMP_ACCESS_LIST  is "SYS_MANAGER:JUMP_ACCESS.DAT".HThe Access List file is OPTIONAL. JUMP does NOT support ODS-5 filenames.3 JUMP_AUDIT_TRAILHThe logical name JUMP_AUDIT_TRAIL is the file specification of the auditHtrail file for  JUMP.   This  file  contains  audit  records of all JUMPHrequests  (successful and unsuccessful) except those made with /NOAUDIT.FThe default value of JUMP_AUDIT_TRAIL is "SYS_MANAGER:JUMP_AUDIT.DAT".HThe audit trail file is REQUIRED and  must be created before JUMP can be,run.  JUMP does NOT support ODS-5 filenames.3 JUMP_CHAINHThe logical name JUMP_CHAIN is a string,  the only legal value for whichHis  "TRUE" - all other values are treated as not "TRUE".  If  JUMP_CHAINHis "TRUE", JUMP will allow a user to "chain" jump.  Normally, JUMP_CHAIN#would be used to prevent chaininig.HSee the help for "Chaining" and the example Access List file in the JUMPdistribution for full details.*The default value of JUMP_CHAIN is "TRUE".3 JUMP_DOUBLE_CHECKHThe logical name JUMP_DOUBLE_CHECK is a string, the only legal value forHwhich is "TRUE" -  all  other  values  are  treated  as  not "TRUE".  IfHJUMP_DOUBLE_CHECK  is  "TRUE", JUMP will ensure that when a user who  isHnot a Systems Programmer or Operator attempts to use JUMP, the user must/have the JUMP_ACCESS process Rights identifier.1The default value of JUMP_DOUBLE_CHECK is "TRUE".3 JUMP_MATCH_BOTH1This logical name is obsolete and no longer used.HJUMP requires that access list specifications for EXACT jumps explicitlyFinclude both the calling user and the target user (wildcards allowed).3 JUMP_MINOR_PRIVSHThe logical name JUMP_MINOR_PRIVS is a string which is a space-separatedHlist of privileges which is the  maximum  set of privileges which may beHheld by a username targeted by an Operator.  If any other privileges areHheld by the username, Operators cannot jump to the user without explicit2access being granted through the Access List file.9The default value of JUMP_MINOR_PRIVS is "NETMBX TMPMBX".3 JUMP_NOTIFY_MAILLISTHThe logical name JUMP_NOTIFY_MAILLIST  is  a  string  which  is a comma-Hseparated  list  of  usernames  to  which  notification  by  MAIL  of  aHJUMP /EXACT session is sent. The list may contain references to  mailingHlist  files  in the form @<filespec> where <filespec> is a valid OpenVMSHODS-2 file specification.  Here are some example values for this logicalname:  FRED  DELORES,FRED  @SECURE_DIR:TEAM_LEADERS.TXTH  DONNA,@MANAGEMENT_DIR:MANAGERS.LIST,ROBOCOP  ! Keep Donna in the loop.HMailing list files must consist of  one address per line.  Address linesHmust  not contain references to other mailing lists (i.e.  @<filespec>).HComments, both full line and trailing, may  be  included  in  the  file,(starting with an exclamation mark ("!").HNOTE: JUMP checks all mail  addresses  that  are logical names to ensureHthe logical names are defined securely (i.e.  /SYSTEM /EXECUTIVE).  JUMPHdoes  not attempt to pre-verify the validity of any mail address  beforeHsubmitting it to Callable Mail.  In Secure mode, an attempt to  mail  toHany  address  which  causes an error in Callable Mail will cause JUMP toexit immediately.&JUMP does NOT support ODS-5 filenames.6The default value of JUMP_NOTIFY_MAILLIST is "SYSTEM".3 JUMP_OPER_CLASSESIThe logical name JUMP_OPER_CLASSES is a string which is a space-separatedIlist of operator message  classes  to  which  OPCOM messages generated byIJUMP  will be sent.  The valid classes are identical to those for the DCLcommand REQUEST.HNOTE:  The  class  SECURITY  is   mandatory  and  is  always  implicitlyHspecified.  Any other classes specified will be in addition to SECURITY,Halthough  SECURITY  can  be  specified explicitly if  so  desired.   ForHexample, to direct OPCOM messages  to  operator  terminals  enabled  for5SECURITY, CENTRAL and OPER8, specify "CENTRAL OPER8".HThe default value of  JUMP_OPER_CLASSES  is  "CENTRAL".  (This will send(OPCOM messages to SECURITY and CENTRAL.)3 JUMP_SECURE_DIRHThe logical name JUMP_SECURE_DIR  is  the directory specification of theBdirectory where log files from secure EXACT jumps will be created.HThe default value of  JUMP_SECURE_DIR is "SYS_MANAGER:".  JUMP does  NOTsupport ODS-5 filenames.3 JUMP_SECURE_MODEHThe logical name JUMP_SECURE_MODE is a  string, the only legal value forHwhich  is  "TRUE"  -  all other values are treated as  not  "TRUE".   IfHJUMP_SECURE_MODE is "TRUE", the  following  qualifiers  are  mandatorily!added to the JUMP /EXACT command:  /SECURE_MODE /RECORD ->  /NOTIFY=(BEFORE,AFTER,INCLUDE,MAIL,OPCOM,EXIT_ON_MAIL_ERROR)HIt is intended for use  in  environments where exact jumps are recorded.HThe  'X'  option in the Access List file can be used to override  Securemode.1The default value of JUMP_SECURE_MODE is "FALSE".3 JUMP_SELFHThe logical name JUMP_SELF is a  string,  the only legal value for whichHis "TRUE" - all other values are treated as not "TRUE".  If JUMP_SELF isH"TRUE",  JUMP  will  allow a user to jump  to the  current  (i.e.  same)Husername unless the user is explicitly prevented  from  jumping  to  the)current username in the Access List file.HIf JUMP_SELF is not "TRUE",  users  cannot jump to the current username,6even if given explicit access in the Access List file.)The default value of JUMP_SELF is "TRUE".3 JUMP_USER_DIRHThe logical name  JUMP_USER_DIR  is  the  directory specification of theFdirectory where log files from non-secure EXACT jumps will be created.HThe default value  of  JUMP_USER_DIR  is  "SYS$LOGIN:".   An alternativeHvalue  may be, for example, "SYS$DISK:[]" to force these log files to beHcreated in the user's current directory.  JUMP does  NOT  support  ODS-5
filenames.HThe JUMP_USER_DIR logical name may be defined in user or supervisor modeHby the user.  This  allows  user-specific  specification of the locationHfor  recorded session log files for EXACT jumps when NOT in Secure mode.HNOTE, however, that any explicit System Manager definition in  EXECUTIVEHmode,  or  specifying  Secure mode,  will  *always*  override  any  user!definition in outer access modes.2 Rights_IDHTo use the double check  feature  of  JUMP  to  increase the security ofHchecks  on authorised users, the Rightslist identifier JUMP_ACCESS  mustHbe created  and granted to ordinary users who are to  be given access to3JUMP.  The value of the identifier is not relevant.HIf the JUMP_ACCESS Rightslist identifier  is not used, JUMP_DOUBLE_CHECK *must* be defined to be "FALSE".
2 Access_ListHThe JUMP Access List  file  contains  access  lists  to determine who isHspecifically authorised to JUMP, or prohibited from JUMPing, and to whomHaccess  is  to be granted or denied.  Lists may contain any  mixture  ofH(wildcarded) usernames, (wildcarded) UICs, UIC  identifiers  and  Rights/identifiers.  Identifiers cannot be wildcarded.HSystems Programmers are validated against the Access List file, but theyHare allowed access  to  all  accounts  regardless  of  whether access isHgranted  or  denied.   If  access is specifically denied  to  a  SystemsHProgrammer, a warning is generated to this effect when the jump is made.HThe JUMP Access List file may also contain options to mandatorily enableHor  disable  the  functionality   of   the  NOTIFY,  RECORD_SESSION  and6SECURE_MODE qualifiers for specific JUMP access lists.HAn example Access List file is  included  in  the JUMP distribution - itHincludes full details of all options and the format of the file.  PleaseREAD this file carefully!HNote: This file is OPTIONAL.  If the file does not exist,  all access isconsidered to be unspecified.3 Usernames_and_IdentifiersHThe JUMP Access List file contains access  lists made up of symbols thatHcan  represent usernames, UICs, UIC identifiers and Rights  identifiers.HProblems can arise when the UAF contains a username  and  an  identifierHthat have the same name.  If the identifier is the UIC identifier of theHusername,  there  is  no issue.  If, however, the identifier is either aHUIC identifier for a different UIC  or  a Rights identifier, there is an=ambiguity that might lead to unintended access being allowed.HTo avoid ambiguity and  ensure  access  is  only granted where intended,+JUMP has adopted the following conventions.HWhen a username and an identifier  have  the same name, the name will beHtreated  as  a  username and the identifier with the same name  will  beHignored.  To force a name to be recognised as an identifier, rather than*a username, enclose it in square brackets.HFor example, "DEVELOPMENT" will always be treated as a username.  On theDother hand, "[DEVELOPMENT]" will always be treated as an identifier.	2 OptionsHOptions which mandatorily enable, disable or modify the functionality ofHthe  EXACT,  NOTIFY,  RECORD_SESSION   and  SECURE_MODE  qualifiers  forHspecific  JUMP  access lists may be specified in the Access  List  file.HSee the example Access List file  in  the  JUMP  distribution  for  fulldetails.HChaining, i.e., JUMPing from a  process  which  is itself a JUMP pseudo-Hterminal, can be prohibited with an option.  See the help for "Chaining"Hand  the  example  Access List file in the JUMP  distribution  for  fulldetails.
2 ChainingHChaining, i.e., JUMPing from a  process  which  is itself a JUMP pseudo-Hterminal,  can  be prohibited with an option.  (See the  example  Access5List file in the JUMP distribution for full details.)HThis means that once a user  has  JUMPed  to another user, further JUMPsHfrom  that target user's account in the current session by the  originalHuser can be prevented.  For example, SALLY JUMPs to  HARRY.   HARRY  hasHaccess  to  JUMP  to EDWIN.  Setting the appropriate option will preventHSally from JUMPing to  EDWIN  whilst  JUMPed  to HARRY.  HARRY can still!login as HARRY and JUMP to EDWIN.HThe logical name JUMP_CHAIN can also  be defined to prevent chaining forall JUMPs by all users.
2 Facility_IDHJUMP uses a Message file  to  signal  messages.  The Message source fileHspecifies  a Facility ID.  This can be changed to a site-specific value.The default value is 111.2 Software_VersionsHJUMP is written almost  entirely in  HP Pascal.   There is a  very small)Macro routine, used to parse identifiers.HJUMP supports only OpenVMS VAX, OpenVMS Alpha and OpenVMS IA64  versions)which have all of the following features:  Pseudo-terminals  LIB$TABLE_PARSE  Callable MAILHThe Persona Security Block  (PSB)  and the SYSGEN parameter ARB_CONTROL,Hintroduced  in  OpenVMS  Alpha V7.2, are fully supported.   The  PERSONAsystem services are not used.HThe current version  of  JUMP  has  been  built  and  tested as follows:'  OpenVMS VAX   V7.1   (HP Pascal v5.6)'  OpenVMS Alpha V7.3-2 (HP Pascal v5.8)'  OpenVMS IA64  V8.2   (HP Pascal v5.9)H***  CAUTION: JUMP has dependencies on the underlying architecture   ***H***        (VAX, Alpha or IA64) and the version of OpenVMS.  Any     ***H***        changes to either of these REQUIRES JUMP to be re-linked. ***JSuggestions, comments, criticisms, bug reports, bug fixes ... all welcome.2 InstallationHComprehensive  installation  instructions  can  be  found  in  the  file1INSTALL.TXT.  Refer to this file to install JUMP.HIt is strongly  recommended  that  you  thoroughly  read  this HELP fileH(JUMP.HLP)  and  the example Access List file  (JUMP_ACCESS.DAT)  beforeinstalling JUMP.	2 ChangesHA summary of changes in  various  versions  of  JUMP can be found in thefile CHANGES.TXT.2 Author5The author and maintainer of JUMP is Jonathan Ridler.JUMP is maintained on behalf of$    Information Technology Services,     The University of Melbourne,    Parkville, Victoria,    AUSTRALIA, 3010.'Internet: jump-enquiries@unimelb.edu.auCOPYRIGHT NOTICEHThis  software  is  COPYRIGHT  (c)  2005  Jonathan  Ridler.   ALL RIGHTSHRESERVED.   Permission  is  granted for  not-for-profit  redistribution,Hprovided all source code, object code and documentation remain unchangedHfrom the original distribution, and that all  copyright  notices  remainintact.2 AcknowledgementsHThe  author  gratefully  acknowledges  the  influence  on  JUMP  of  thefollowing people:E  John Wastell - first version based on John's Macro version of JUMP.;  Eric Wentz - some ideas drawn from Eric's program BECOME.@  Anthony McCracken - pseudo-terminal creation code derived from/                      Anthony's program GLOGIN.F  Jeremy Begg - secure log file code based on code supplied by Jeremy.D  Bob Beckerhof - testing of early versions and helpful suggestions.G  Hunter Goatley - some code inspired by HGLOGIN. Also, one of the bestC                   OpenVMS FTP sites outside of HP! Thanks, Hunter!G  Ian Robinson - provision of facilities at the University of MelbourneI                 for continued development of JUMP. (And a great friend!)I  Others - numerous others (you know who you are) who have kindly tested,           commented, etc.JSuggestions, comments, criticisms, bug reports, bug fixes ... all welcome.'Internet: jump-enquiries@unimelb.edu.au2 DisclaimerEDISCLAIMER: This software is provided "AS IS".  It does NOT come withCany representations or warranties, implicit or otherwise, as to itsHmerchantability or fitness for any particular purpose.  The user assumesEALL risks and responsibilities associated with installing and runningthis software.	2 Version=The current version of JUMP is V5.0 2005-02-19 (19-Feb-2005).