A-Shell Consolidated Reference

Share This Topic
MicroSabio Website
Documentation
- A-Shell Reference
- ATE
- PDFX
- ATSD
- All Docs
Support

Zoom Window Out
Larger Text | Smaller Text
Hide Page Header
Show Expanding Text
Print Topic
Share This Topic
Save Permalink URL

Security / Login

ATS has no built-in login mechanism; upon receiving a connection, it simply launches an A-Shell session, passing it the command line arguments specified in the ATSDSRV.INI file. That works great if your application already has its own login mechanism; it also prevents users from just bypassing it to run amok at the dot prompt. Otherwise, unless you don't care at all about security, you should implement some kind of simple login, especially if your ATS server is exposed to a non-secure network, like the Internet. Here are a few pointers about implementing an ATS-compatible login...

u Startup Command

The startup command is specified in the ATSDSRV.INI file CommandLine parameter. Typically this is a DO file which may set a few environment parameters and then launches your login program. For example:

LOG BAS:

SET NOCTRLC

:<Welcome $NU

System: $NS Version $SV

Terminal emulation: $ND

RUN LOGIN

u Prompting for User Name and Password

Although you have free reign to do this any way you like, or not at all, observing the following will help maximize both security and compatibility with a range of terminal emulators:

•	Minimize screen operations; plain text teletype-style / UNIX-style prompts are best

•	Don't echo the password

•	Time out after 10-15 seconds

•	Set a limit of 3-5 attempts

For example, in the code below, we use simple teletype-style prompts for user name and password. (INFLD works in teletype mode when row and col are both set to 0.) Type ||g disables GUI mode (just in case), ] strips trailing blanks, / eliminates timer-related displays, I eliminates the field markers and i eliminates echoing of keyboard characters for the password.

? "Please log in"

ok = 0

do while ok = 0

count += 1

if count > 3 then ? "too many tries" : exit

? "User name: ";

timer = 10

xcall INFLD,0,0,10,0,"A||g]/I",user$,inxctl,1,0,exitcode,timer

if exitcode = 11 then ? "time out" : exit

? "Password: ";

xcall INFLD,0,0,10,0,"A||g]/Ii",pw$,inxctl,1,0,exitcode,timer

if exitcode = 11 then ? "time out" : exit

ok = fn'check'credentials(user$,pw$)

loop

if ok = 0 then xcall MIAMEX, MX_EXIT ! exit ashell on failure

xcall CCON ! now we can re-enable ^C

Note that your routine to validate the user name and password can also take into account information about the user and workstation that can be retrieved without user intervention, via GETUSN.SBR (user name and machine ID) and MX_GETIP.SBR (IP address).

u Configuring ATE for Automatic Login

The ATE Connection Properties dialog includes a Login tab where you can plug in the name, password, and/or additional startup text:

atsd_img1

Although the dialog is mostly self explanatory, the following points may help clarify potential issues related to interfacing with your custom login program.

•

First, the auto-login logic is mostly based on the way UNIX login works. Although the dialog contains fields labeled "Login Name" and "Login Password", ATE has no way of knowing if those are the actual field prompts; they might as well be labeled "First" and "Second". If you see no need to prompt for both a name and password and instead will validate the user with a single input prompt, you can use either of the first two ATE login fields to hold the login text. (The first field will be ignored if left blank and the second field is non-blank.)

•

Second, to help ensure that the ATE auto-login synchronizes with—or at least doesn't over-run—the ATS login prompts, you can specify either a delay or the option to wait for the ":" (colon) character signaling the end of the prompt. Waiting for the ":" is the most reliable (immune to transient delays in the network or on the server), but to work, the login program must use simple teletype-style prompts like in the example above (i.e. like UNIX uses). If too many output characters are sent after the ":" and before the input operation, ATE will assume that it was not the indicator at the end of the prompt but some spurious byte sent as part of the initial screen initialization. Note that the wait operation applies independently to both the Name and Password fields (if applicable), so the program display the prompt and then input the field before displaying/inputting the next field. Displaying both prompts first and then inputting them, as in a typical GUI or screen-oriented dialog, will not work.

Please enable JavaScript to view this site.

A-Shell Consolidated Reference