Conference noted::hackers_v1

    I think I would approach the problem in DCL with a simple batch
    job which would allocate the modem port, disable HANGUP (and possibly
    MODEM), set the Baud rate, OPEN the port as a sequential file, write 
    the dial command to the modem, and deallocate the device.
    
    I wouldn't think handling a modem response would be necessary, because
    a returned terminator character on the [now] deallocated port will
    merely trigger LOGINOUT, which is what you want anyway.
    
    Of course, there are several holes in this hack, including principly
    the need to override VMS port security precautions implemented with
    EIA signals.  I seem to remember that when control of a port changes
    from one process to another, VMS deliberately drops DTR (ostensibly
    to force the modem to hang-up, if possible?), which may adversely
    affect your modem connection.  If you defeat this behavior with
    creative wiring, or with modem straps, you should be VERY CAREFUL
    about permitting the modem to be used for in-dial traffic.
    
    You must also either set the device protections so you can write
    to it, or use adequate privilege.  Note that allowing write access
    to any port makes it vulnerable to unprivileged PASSWORD STEALING 
    programs.
    
    The last time I tried this was with connections directly through DMF-32
    and DZ-11 ports.  If your modem is on a DECserver, the process is
    probably different.
    
    					-- Brian (What's a hacker without
    						  a soldering iron anyway?)
                     

    	ACB, which is supported for internal use (though not available for
    customers) does a bit more than what you want.
    
    	You dial the VAX, give it your name and telephone number (not too
    expensive on phone calls) it validates the combination in a security
    database, and if it likes you then it phones you back and lets you log
    in.
    
    	It is used in several places in Europe for security reasons, since
    the incoming line is tied to ACB, and cannot be used to log in, while
    the other lines are set to outgoing only.
    
    	Ideally you should persuade your local IS to install ACB on some
    large system, with one (or more) incoming lines, and lots of outgoing
    lines. That is what I am using at the moment. I set host from the large
    system to my workstation. We have one incoming line to ACB, and about
    12 lines for it to choose from for the outgoing calls.

re: .2
    	You dial the VAX, give it your name and telephone number (not too
    expensive on phone calls) it validates the combination in a security
    database, and if it likes you then it phones you back and lets you log
    in.
    
It seems like a breach of security for you to have to type the telephone
number -- you should type your name and a "location identifier" (home,
office, customer_x, whatever) and it should dial the number associated
with that name in the database.  Letting you choose the number when you
call lets a wiretapper (who has your name and will soon have your
password) spoof you from "any" number.  The first ACB program I'd
heard of, used in the mid 1970's by police stations connecting to
a central database, used the answerback ID to index the database,
then called the associated number.  The caller should not be able
to directly control the number.

Martin.

    No Martin, no security problem. The computer does not dial the number
    you just typed in but rather the number that it has stored for you.
    Also, the name need not be the your `username'. Any odd identifier
    will do. In other words, you only trigger ACB to start dialing a
    previously recorded phone number. If the is a security breach then
    it will be on the administration side. Once ACB dialed (back) to
    you then it is the standard username/password (un)security.

    (Actually, I am connected through ACB 'as we speak'. It dialed
    from a central machine and I entered through a captive account
    with an obvious username and no password. The account only let's
    me do a SET HOST, or at least that's what they tell me, and I do
    not plan to investigate as I value the service too much.)

    Hein.

    	The current distribution point for the kit is SHIRE::ACBV1$KIT:*.*
    
    	For internal support you can currently call the Valbonne I.S.
    hotline (at least in Europe). I am not sure what may be done in the
    U.S. or GIA.

    	Incidentally, the directory includes about half a dozen examples of
    different control routines for different modems. If yours is not
    included it should be easy to take one of these as an example template.
    
    	The documentation is also in that directory.