From: terry@cs.weber.edu (A Wizard of Earth C)
Subject: Re: Locking out users
Reply-To: terry@icarus.weber.edu
Organization: Weber State University  (Ogden, UT)
Date: Fri, 2 Oct 92 17:40:06 GMT

OK, not to be a dick, but:

In article <1992Oct2.032213.27887@sol.ctr.columbia.edu> kibirev@csa.bu.edu (oleg kibirev) writes:
>Don't you think that too much of the  recent traffic in  this group is
>about locking   out users, erasing   accounts   and  installing stupid
>"security measures" that prevent programs from running  and users from
>doing there work?

	This statement of what the traffic has been about is nearly correct,
except the words "programs" and "users" should be prefixed with the word
"unauthorized".

	The main discussion has centered around locking out "crackers" --
what we have been calling "hackers" here because we no that the vast
majority of "modern hackers" don't understand the distinction.

>Sure, there are  lots of ways you can  do this. Run  rm -rf ~user, set
>their   shell  to   /usr/games/fortune  or   remove    the entry  from
>/etc/passwd. If  this doesn't work, hit the  Big Red Switch and nobody
>will ever compromize security of  your computer.  And, does it  really
>take a unix.wizard to do oppresive job???

	Again, an authorized user will never be "oppressed" (a wording
loaded with connotations about peoples "rights" to use *my* idle CPU
time) because there won't be barriers to him or her.  The barriers are
for unauthorized access.

>Do some sysadmin ever realize that the computer and they are here only
>because there are users  who need to do  the work? Do they  understand
>that when a smart user is  getting around their restrictions, it often
>just means that these restrictions need to be revised?

	This is a diatribe, but I will answer it anyway.  Yes, some
restrictions are too stringent.  An authorized user will go through
channels to remove them, as long as doing so works.  I wouldn't say
that "often" is an appropriate adjective for the majority of "getting
around" restrictions.

	Most "getting around restrictions" involves restrictions like
the individual not having an account on the machine or not being given
root "because he deserves it".

>I suggest  redirecting this  thread to alt.fashist.admin.  Most people
>here know how to cancel articles, right?

I think you meant "fascist" -- although locking out unauthorized users
is certainly "fashionable" for the obvious reasons.

When "MOD" broke into a machine I help administer and "got even" with me
personally for someone being allowed to use my account getting on "#hack"
on IRC, *DAMN STRAIGHT I LOCKED IT DOWN*.  We used to run nearly a public
access UNIX until that event.  Now all network connections are checked
against allowed host/user combinations.  Authorized users can't tell that
there's additional security at all, and we can still police our own back
yard for authorized user's not following the rules.  If we hadn't done
it this way, we would have been forced by the people with the real power
to cut our Internet connection... so they nearly screwed us out of years
of effort (what it took to get on in the first place).

The main problem with breakins is that you don't know who did it without
"beefed up" security in the first place.  By then, it's usually too late;
show me someone whose house burned to the ground, and I'll show you
someone who buys a smoke detector (if his insurance covered rebuilding).

Then you have to basically reinstall the system and reload from backups of
non-system software to insure that /bin/login or "getpwent()" in libc
haven't been replaced... unless of course you trust people who would
break in in the first place.

It's a lot easier dealing with someone local (you probably won't even lose
your account) than the FBI, and a lot of policy decisions at educational
institutions are enforced such that non-local break-ins *must* be
reported to the campus attorney, and he's often part of the state
attorney generals office for the state the educational institution is in;
many colleges are state govenment institutions.  Fail to report it and
lose your job when someone finds out (restoring the system from install
tapes and backups is a good hint that something happened, even for the
most idiotic of bureaucrats, by the way).

The problem is that there are authorized users, the curious, and assholes;
and lately the assholes have vastly outnumbered the curious.

>P.S: About this script  to sign off users:  there  is a VERY easy  way
>around it.  All it takes is a single keystroke.

That's precisely why it's not really a "wizardly" soloution.  It *will*
deter the casual asshole, however, and that's pretty much what it's for.  A
determined asshole will always get in, either because it'll be an inside
job, or because a tradeoff has to be made between security an usability
(which is what nailed my machine).  But then again, a determined asshole
will end up prosecuted.

Obviously the cannonical soloution is to patch TCP/IP for network
connections, and /bin/login to read /etc/png (personna non grata), probably
of the format:

	username filename

where the file named "filename" get's it's contents spit at the user when
he tries to log in.

Sources for login are in the Net/2 release on gatekeeper.dec.com and
wuarchive.wustl.edu.


	You are entitled to your opinions, but you are not entitled access
to computer equipment unless the people responsible for it say you are.



					Terry Lambert
					terry@icarus.weber.edu
---
Any opinions in this posting are my own and not those of my present
or previous employers.
-- 
-------------------------------------------------------------------------------
                                        "I have an 8 user poetic license" - me
 Get the 386bsd FAQ from agate.berkeley.edu:/pub/386BSD/386bsd-0.1/unofficial
-------------------------------------------------------------------------------
Newsgroups: comp.unix.wizards