	Setting up the WEB interface to SET PASSWORD

The Set Password utility provides a WEB interface to the SET PASSWORD command.
It requires OpenVMS (tested on 7.1 & 7.2, but 6.2 should be OK), and the OSU
Web Server (it uses the DECnet task interface so it probably won't work on
other webservers).

It presents a form to the user allowing him to enter username, old password
and new password.  The program verifies the old password, and if it is
validated, will change the password.  If not, the program logs the attempt
into the Intrusion Database.  The following are checked during password
validation:

* Password must consist of letters, numbers and/or "$" character(s).
* UAF minimum password length.
* UAF LOCKPWD and GENPWD flags (change is not allowed if either is set).
* Password must be different from the current one.
* Password must not be in the dictionary (unless UAF record allows this).
* Password must not be in the history file (unless UAF record allows this).

An optional DCL command  SETPASS /old=<old-password> /new=<new-password>
is also included.

1.	If you wish to compile and link the program from its sources, incant:

	$ @COMPILE
	$ @LINK

2.	The file SET-PASSWORD.HTML is a basic fill-in form for the set password
	utility.  You can customize this file to suit your local requirements.
	Do not change the names of the input fields.

3.	Place the SET-PASSWORD.HTML file in your web server area, and place a
	suitable link to it from your own WEB pages.

4.	The SET-PASSWORD.COM procedure should be placed in the WWW_ROOT:[BIN]
	directory.  Note that this file expects the SETPASS.EXE file to be
	in a directory referenced by the logical name LOC_EXE.  You can either
	set up this logical name, or edit the SET-PASSWORD.COM file
	appropriately.

5.	Place the SETPASS.EXE file in the location referenced by step 4.

6.	You must install the SETPASS.EXE with the following privileges:

	SYSPRV
	SECURITY

	The former is required because the SET-PASSWORD.COM file runs in
	a non-privileged context (usually under the user WEBSERVER), and it
	therefore has to change other people's passwords.  The latter is
	required in order to call the security routines to perform intrusion
	detection.

7.	Create the identifier WEB_DAEMON and grant it to whatever username
	the web server runs under.

Note that the SETPASS.EXE program also provides a DCL command that will change
another user's password (once you can give the old one too of course).  Check
the SET-PASSWORD.COM file for the syntax. If you don't want all and sundry
having access to this facility (even though knowledge of the old password is
required), you can place an ACL on SETPASS.EXE restricting access to the
WEBSERVER account.  The WEB_DAEMON qualifier allows the user to use the /WEB
qualifier.  The presence of this qualifier only affects the log entries made
in the intrusion database if a password change fails.  Without this qualifier,
the username of the person trying to make the change is identified (which is
what you want for use of the DCL SETPASS command).  If /WEB is specified, the
remote IP address of the browser and the target username is logged.  This is
only relevent for the WEB server, hence the identifier.

		IMPORTANT

Please note that you should never install a program with SYSPRV privileges
unless you are happy about the security implications.  It it were me, I would
never install such a program I picked off the Internet without reading and
understanding the source code, and recompiling it myself.  Please note that
ultimately you are responsible for the security of your machine.


