From: marks@mgse.UUCP (Mark Seiffert)
Newsgroups: comp.unix.sysv386
Subject: Re: Questions about MAS90 from SOA
Date: 3 Sep 92 04:50:00 GMT
Organization: mgse

In article <1992Aug26.150511.3758@crd.ge.com> davidsen@crd.ge.com (bill davidsen) writes:
>In article <Bt7stA.1o3@mudos.ann-arbor.mi.us>, mju@mudos.ann-arbor.mi.us (Marc Unangst) writes:
>
>| 2. The BBx interpreter, which is used to run MAS90, is installed owned
>| by root and with the SUID bit set.

It sounds like your system installed wrong. /usr/mas90/HOME/bbx2 should
be 644, owned by mas90, group mas90. /usr/mas90/HOME/bbx2run should be
chmod 4755, owned by root, group of mas90. bbx2run should be the program
that is exec'd by the .profile in /usr/mas90/HOME which was exec'd by
/bin/mas90. Users logging in and typing 'soa' at the shell prompt
will run /bin/mas90, which will exec /usr/mas90/HOME/.profile
which will suid to the real id and then exec /usr/mas90/HOME/bbx2.

>| 
>| 3. MAS90, as installed, allows the user to run /bin/sh through an
>| undocumented shell command.  Because of point (2) above, this means
>| that any MAS90 user can get a root shell.

Sentence one is true, sentence two is true, but only if you have bbx2
suid root instead of bbx2run.

>
>  That would let it out in my book, unless every user has the root
>password.

That is correct, bbx2 might need to be ran suid root for a special
application, but not MAS90.

>
>
>| 5. MAS90 is written with the assumption that a user will always be
>| logging in from the same port.  This assumption does not hold if you
>| are running it in an environment like ours, with users accessing the
>| Unix system over a TCP/IP network with telnet.


I think I know what you mean, you may want to look up the info on
setting the BBTERM environment variable to override the terminal type,
or set the terminal type to 'term' in the config.bbx file.

>
>  Therefore it seems that it just won't work, why go on with it?
>
>| 6. MAS90 pretends to use the standard Unix termcap format, but has
>| made several proprietary and incompatible extensions to it that force
>| you to use a separate termcap file.  (For example, it uses MA and MB
>| to turn on and off high-intensity mode.  What was wrong with so and
>| se?)
>
>  So what? It's dumb but doesn't really impact much.

and it does not use /etc/termcap, as far as I know, it ships with
HOME/soaterm, with extensions.

>
>| 7. MAS90 is run by logging in as "mas90", and then giving MAS90 your
>| MAS90 usercode and password.  This is very inconvenient, since all of
>| our other applications are run by logging in as a normal user.  In
>| addition, all of our users have their own login-id; if they are all
>| logged in as MAS90, it becomes impossible to find out who's logged in.
>
>  That one is easy, have a command which executes "su - mas90" and let the
>users type that to start the session.

There is already a mas90 command.

>
>  The security aspects sound a lot worse than any of the other problems.
>You *could* have a trusted program start mas90 with chroot, which will
>keep it from doing damage to the rest of the system when people use the
>shell escape to become root.

This is not as bad as it all sounds, this system is not installed right.
The installation procedure is pretty automatic, and I for awhile there
was a shipment of MAS90 that went out without the suid set on bbx2run. If
Marc or any others has questions about MAS90, please feel free to write to
me and I will do what I can. bbx2 is not supposed to be suid for MAS90,
setting /bin/vi suid root when it is not supposed to would create a few
security holes. MAS90 is supposed to be sold by trained people, and as it
may be, CPAs. Your dealer should be able to provide you with all the 
answers to your above problems and if they are not able to, a call to SOA
may help straighten things out.

Mark Seiffert

Disclaimer: I work for a company that developes MAS90 modules for the 
eyewear market, video rental, POS, vehicle management and others. I 
do not like bbx, but it does a good job and I feel that MAS90 is a 
solid product even if it is written in an advanced form of business
basic. So there, I said it, I program in BASIC, but not often.


>
>-- 
>bill davidsen, GE Corp. R&D Center; Box 8; Schenectady NY 12345
>    I admit that when I was in school I wrote COBOL. But I didn't compile.

Yeah, and I don't run my BASIC programs.

-- 
Mark Seiffert,  Metairie, LA.
uucp:           rex.cs.tulane.edu!mgse!marks or rex!mgse!marks
bitnet:         marks%mgse@REX.CS.TULANE.EDU
internet:       marks%mgse@rex.cs.tulane.edu or marks@mgse.UUCP
Newsgroups: comp.unix.sysv386