ProfitPress Mega CDROM2 …eeware (MSDOS)(1992)(Eng)/ProfitPress-MegaCDROM2.B6I/UTILITY/FILE/DCOM344.ZIP/LOGIN.DOC

Text File | 1990-02-24 | 17.0 KB | 364 lines

               ┌────────────────────────────────────────────┐
               │                 LOGIN.DOC                  │
               ├────────────────────────────────────────────┤
               │ This file provides temporary documentation │
               │      on dCOM's new user login system.      │
               └────────────────────────────────────────────┘



INTRODUCTION
────────────

A need has been recognized where in many situations it is common to share a
PC among several users, and since we're human, there tends to be a little
distrust from time to time.

To help give the primary user some peace of mind while away from his/her PC,
we have implemented a login system which allows designated the access rights
(privaleges) available to other users while in dCOM's utility mode.  These
rights dictate whether a user is capable of such things as opening files
(copying, printing, or editing), modifying files (deleting, renaming, moving,
hiding, or editing w/save), changing configurations, saving configurations,
running programs, exiting dCOM, viewing hidden files, or even whether they
can enter the utility mode.  Additionally, user groups are also assignable
which are used in conjunction with the macro keys and/or its Menu Mode, to
control which users have access to which menu (macro key) selections.



AFFECTED AREAS
──────────────

The /MP switch which used to invoke the menu mode, not allowing users to
escape out to the utility mode unless they knew the system password, no
longer has any relevance and has been retired.  Whether a user has this
capability is now governed by their Rights in the Access Control Menu.
Actually, for that matter, there is no more "system" password.  There is
however, a "current" password, which is established differently depending
on whether the login system is used.  If the login system is active (a /L
switch was specified on dCOM's command line), the user's password becomes
the current password.  If the login system is not active, the password for
the SUPERVISOR's entry in the Access Control Menu becomes the current
password.

Outside of logging in, the only instance in which the current password is
now used is when rectivating the screen blanking feature (Shift-Ctrl-B) and
when invoking the Access Control Menu, if the login system is not active.
(If the login system is active, the user must be a supervisor to gain entry
to the Access Control Menu.)

The screen blanking feature (Shift-Ctrl-B), still works as it did before,
where if a password is active, it must be entered to reactivate the screen
and keyboard.  If no password is set for the logged in user, pressing
Shift-Ctrl-B again will reactivate the screen.

The Alt-A command, which used to allow changing the System Password, now
invokes the Access Control Menu (described in a following section).

If the login system isn't used (the /L switch isn't given), when dCOM is run
the current user will be considered the SUPERVISOR, with total access to all
rights and groups.  Additionally, even though the login system isn't active,
dCOM will still lookup the SUPERVISOR in the Access Control Menu (Alt-A),
and use the SUPERVISOR's password as the "current" password.  If you don't
wish to use the login system but still want the screen blanking feature
password protected, be sure to edit the Access Control Menu and set the
SUPERVISOR's password accordingly.



OVERVIEW
────────

Enabling the login system serves a variety of needs.  Some people may just
wish to have their computer password protected when it is first turned on.
Others, may have more of a concern with what capabilities are available to
other users using their computer.  Or, what capabilities are available while
using a network drive.  Or, from a menuing perspective, what menu functions
(macro keys) are available to which users.  And lastly, maybe just keeping
track of usage, and which users were on when, using the login system in
combination with the audit trail feature.  Of course, all of these capabi-
lities are now provided to you using the login system.



ACCESS CONTROL MENU
───────────────────

The heart of the login system is the Access Control Menu.  Handling how this
menu is invoked varies depending on whether the login system is active.  If
the login system is active, any user with a supervisor group flag may enter
and edit the Access Control Menu.  If the login system is not active, the
current password (which will be the SUPERVISOR's password) will be prompted
for (provided its been set), before access is allowed.

If the login system is active and the current user does not have a supervisor
group flag, pressing the Alt-A command to invoke the Access Control Menu will
only dislay a window showing the current user's name, rights, and groups.

Under the Access Control Menu you define a list of users which will have
access to your computer, and what privaleges they will have.

The Access Control Menu will initially default with two entries, SUPERVISOR
and GUEST.  Both entries play a role under different situations and shouldn't
be deleted carelessly.  The SUPERVISOR entry establishes the active password
in the event that dCOM is run without the /L switch.  One of the first orders
of business should be to enter a password for the SUPERVISOR entry so that
other users can't log in using its name.  The GUEST entry controls the rights
and groups of users not successfully logging in.  By default, a guest user
will have access to dCOM's utility mode, but that's it - a guest user won't be
able to access configuration menu's, modify files, exit dCOM, or run programs.
If you wish your guest users to more or less privaleges, then edit the GUEST
entry appropriately.  If you don't wish to allow invalid login's then delete
the GUEST entry.  If there are a large number of users fitting a certain
description, instead of building all their names in the Access Control Menu,
you could just tell them all to log in using the name "guest".  If you don't
enter a password for the GUEST entry, one won't be asked for.

Normally, the primary supervisor would immediately add his login name under
the Access Control Menu and give himself a group flag of "$" (making his name
a supervisor with full rights and privaleges).  If the primary supervisor
wants to further delegate some junior supervisors, he would add their names
under the Access Control Menu and give them a group flag of "#", which gives
them the same access privaleges as him except that they cannot modify other
users having a supervisor, or junior supervisor group flag.



ENABLING THE LOGIN SYSTEM
─────────────────────────

Whether the entire login system is enabled depends entirely on whether the
/L or /LA command line switches are provided when dCOM is first run.

The only difference between /L and /LA is that /LA enables the automatic
logout feature.  Both of them activate the login system and, as described
next, both accept the same parameters:

    /L[:name][,password]
    /LA[:name][,password]

Although giving both the user name and password on the command line is rather
self-defeating, it is provided as an option non-the-less.  Providing both the
user's name and password on the command line results in the computer never
prompting for a login when initially powered up, but would still allow the
user to manually generate a logout using Alt-L (which leaves the display
prompting for a new login), at times when he/she will be away from their
computer for a period of time (of course other users soon figure out all they
have to do is reset the computer and it automatically logs in...).

The automatic logout feature (using /LA instead of /L) is provided for those
situations where it is like pulling teeth trying to get users to comply with
logging themselves out when they are through with the computer.  Or, if you
just want the comfort of knowing that if you get up and walk away from your
computer, that it will log itself out automatically after a certain period of
time.  In order for the automatic logout feature to activate, dCOM's screen
saver must be enabled.

When the automatic logout feature is active and the screen saver trips due to
no keyboard or mouse activity and, the display is in the utility mode, or in
the macro key menu mode, the user will automatically be logged out.  When the
screen is restored (by pressing any key), the login prompt will be displayed.
Automatic logouts may be inhibited by using the Shift-Ctrl-B hot-key to blank
the screen.



LOGGING IN
──────────

If just the /L or /LA command line switches are provided with no name and no
password, dCOM will display the login screen and prompt for both the user's
name and password.  If the user enters a valid name which has no password
entered in the Access Control Menu, dCOM will then automatically proceed to
log in the user without prompting for the password.  If the user enters an
invalid name, dCOM will act dumb and proceed to prompt for the password, which
will of course then fail.

If a name is provided with the /L or /LA switch, but no password, dCOM will
automatically use the name and advance to prompting for the password.  The name
however, is still changeable by pressing the up arrow to edit it.

If both the name and password are provided with the /L command line switch,
dCOM will not display or prompt the login menu even if the name and password
don't match with a valid user.  If the name and password don't match with a
valid user, dCOM will automatically attempt to log the user in as GUEST.

When the login prompt is active, the user is given three attempts to give a
correct name and password.  After three invalid attempts dCOM automatically
logs the user in as GUEST, if GUEST exists as a valid entry.  If GUEST does
not exist as a valid entry in the Access Control Menu, dCOM will just beep
and start over, prompting for a new name.

Be sure to configure the GUEST entry in the Access Control Menu to only have
the rights and groups with which you are comfortable with when an unknown user
is on your system.  If you don't wish GUEST to have access to the utility mode
then remove the group "1" flag (which is assigned by default) from its entry.
If you don't wish invalid login's to automatically revert to using GUEST, then
delete GUEST from the Access Control Menu.

Successful login's are automatically logged to the log file (DCOM.LOG) if the
Audit Trail feature is enabled (using the /A command line switch).



LOGGING OUT
───────────

Logging out can be done in one of three ways:

   1)  Using the Alt-L, logout/login command from the utility mode.
   2)  Using the macro LOGOUT command from within a macro key.
   3)  Automatically after the screen saver times-out by using the /LA switch.

If the menu mode is active in the background (the /M command line switch was
specified) but the current user had escaped out of it to the utility mode,
logging out from the utility mode either manually or automatically, will
reinvoke the menu mode when a new user logs in.

If a automatic logout occurs while in the menu mode and the current macro file
is a gosubed macro file, dCOM will automatically return to the root macro file
after a new user logs in.

Internal hard disks are automatically parked (shipped) when a logout occurs,
be it from an automatic logout or user initiated.

Logout's are automatically logged to the log file (DCOM.LOG) if the Audit
Trail feature is enabled (using the /A command line switch).



USE WITH THE MENU MODE
──────────────────────

Using the login system in conjunction with the macro key menu mode is done by
specifying both the /L (or /LA) and /M command line switches.

The thing to remember is that the user is already logged in when the first
macro file's menu is displayed.  Therefore, it is now useless to setup the
first macro file with the only option being to login.

You can provide menu options to log out with using two different methods:
1) You can setup a macro key to use the macro LOGOUT command (which then
immediately logs out the current user and prompts for a new user to login) or,
2) You can use a new macro switch, /L which, if given on a macro's title line,
causes the key to be considered a special login/logout macro key.

When a macro key is given the /L switch on its title line, there is no need
to build any executable lines beneath it (unless you want to use them as
subroutines for other macro keys to call).   dCOM detects that the key is a
special login/logout key before it checks whether there are executable lines
in the macro key, and proceeds to do the appropriate logout or login function
when the key is executed.  Another feature of the /L switch is that the title
is automatically managed for you (depending on whether a login or a logout
should be the next option picked).  The only reason to even bother entering
anything for the title of a macro key having the /L switch is to give dCOM a
template for whether to display the title text in uppercase, lowercase, or a
mix thereof.

After a logout has been performed by executing a macro key having the /L
switch, all other macro key titles will disappear until the login macro key
is pressed again and a new user logged in.  Actually, when dCOM is between
logouts and logins (no man's land), the only command dCOM will recognize is
to execute a macro key having the /L switch to log back in.

You can restrict the availability of macro keys to certain groups of users
by using the /G macro title line switch.  For instance, if a macro key title
line has a "/G:ADF" group switch, only users which have a group flag of A, D,
or F will be allowed to execute the macro key, or even see the macro key's
title when the menu is displayed.  Note that the /G switch on a macro title
is an "OR" condition, a user having any one (or more) of the group flags
specified will have access to the macro key.

Lastly, a new macro variable, %LN, now expands into the logged-in user's name.



RIGHTS
──────

The Rights you give a user in the Access Control Menu govern what privaleges
they will have in the Utility Mode, should they even have the right to use it.


  U - Utility
  ───────────
  This right enables a user to have access to the utility mode.  If a user
  is not given this right, they will not be allowed to exit the menu mode or,
  if the menu mode isn't active, denied access to log on.  (Note: If you are
  preventing people from accessing the utility mode, you should ensure that
  the GUEST entry cannot do so either).


  R - Run Programs
  ────────────────
  This right is required to run other programs or Dos Commands.


  X - Exit
  ────────
  This right is required to exit dCOM.


  O - Open Files
  ──────────────
  This right is required to copy, print or edit (without saving).


  M - Modify Files
  ────────────────
  This right is required to delete, rename, set the hidden or read-only
  attributes, edit (with saving), or overwrite files during a copy or move.


  C - Change Configurations
  ─────────────────────────
  This right is required to view and/or change various configuration
  menu's or operating modes (i.e. the spooler, sort mode, etc...)


  S - Save Configurations
  ───────────────────────
  This right is required to permamently save changes made to the various
  configuration menu's.


  V - View Hidden Files
  ─────────────────────
  This right is required in order for the user to change the view mode
  to show hidden files.



GROUPS
──────

There are three kinds of assignable groups; Standard (A-Z), Auto Rights (1-4),
and supervisor ($ or #).  All said, each user may have up to 32 different
groups assigned.  Standard groups only apply to macro keys which have the /G
switch on their title lines, to deseminate which user groups have access to
their function.  The Auto Rights groups (1-4) automatically give the user
varying degrees of rights which, if suitable, save the supervisor from having
to edit everyone's rights to his satisfaction.  Giving a user a supervisor
group flag ($ or #) allows that user to edit the Access Control Menu and also
automatically gives him/her all assignable rights.  The difference between the
two supervisor flags is that the "#" flag is considered a junior supervisor
and cannot modify access control entries for other supervisors.  Typically
there might be one (maybe two) users with the full supervisor ("$") group,
and then maybe a small number of junior supervisors with the "#" flag.





                                                          Dave Frailey
                                                          January 1990

                                                          DAC Micro Systems
                                                          40941 176th St E
                                                          Lancaster, CA  93535

                                                          Voice: 805/264-1700
                                                          Data:  805/264-1219