From: szabo_p@maths.su.oz.au (Paul Szabo)
Subject: Re: Correct ACL's for a closed system?
Keywords: ACL closed system node_data
Reply-To: szabo_p@maths.su.oz.au (Paul Szabo)
Organization: Mathematics, University of Sydney
Date: Thu, 16 Apr 1992 03:38:43 GMT

In article <1992Apr14.062932.19358@sserve.cc.adfa.oz.au>
jrm@alpha.ma.adfa.oz.au (John R Marley) writes:
> Does anyone out there know what the correct ACL's are for the
> /sys/node_data* directory tree on Domain/Os SR10.3.5 are?

I do not know what the 'correct' ACLs are, but they (even the 'closed' ones)
are insecure anyway. (You might want to waste time by looking in
/install/templates/apollo/os.v.10.3/ip.closed_sysv .)

I have scripts which will set the ACLs to something reasonably secure.
Now I made these scripts available by anonymous FTP from maths.su.oz.au
(129.78.68.2), in file protect/scripts.tar.Z .

Below is the protect/README file. Enjoy!

(Dave Shaw, Willem Jan Withagen: please put this on your archives as well.)

---

-------------------------- DISCLAIMER - WARNING --------------------------
While I expect the use of these scripts to make your nodes more secure than
what they are at present, they may in fact open up any number of holes, or
render your system un-useable. These scripts come with no warranty of any
kind. They do work for us, but use them at your own risk, after you have
assured yourself of their fitness for your purposes.
-------------------------- DISCLAIMER - WARNING --------------------------


HOW TO USE

Unpack the archive scripts.tar.Z, using something like
  zcat scripts.tar.Z | tar xvf -

Execute protect_software to secure your node, using something like
  protect_software //nodename
Copy the other files to appropriate places.

If you run netman (have any diskless nodes), then execute
  /sys/net/netman.rc template any
before running protect_software (or maybe run it again: it cannot hurt).


NOTES

protect_software will happily change ACLs on trees pointed to by links, e.g.
if you installed /domain_examples by a link
  /domain_examples -> //master_node/domain_examples
This will of course take quite a long time, besides being wasteful (as the
directory will be protected, again, when running on //master_node). We have
all such links pointing to /master instead, e.g.
  /domain_examples -> /master/domain_examples
  /bsd4.3/usr/man -> /master/bsd4.3/usr/man
where /master is a link pointing to some appropriate place. (When install++
asks for a //nodename, just enter /master.) The protect_software script will
first rename the /master link, so that none of the linked directories are
found while changing ACLs, and renames it back when finished.

These scripts work together. Probably you can use the new /etc/rc with the
default Apollo permissions, but I am not sure whether the original /etc/rc
would work after protect_software. You need to replace /sys/net/netman.rc
(this is a link to netman_bin.sh or netman_com.sh) otherwise your protection
would be quite useless.

Do not change permissions in arbitrary ways. Opening things up may allow
seemingly unrelated attacks, while tightening things might make the node
unuseable.


REQUEST

If you can make your nodes more secure please let me know, I would love to
hear from you. On the other hand, if these scripts cause you some trouble,
just drop me a line and I will try my best to help you.


Paul Szabo - System Manager   //        School of Mathematics and Statistics
                              //   University of Sydney, NSW 2006, Australia
szabo_p@maths.su.oz.au        //        Phone (+61 2) 692-3806, FAX 692-4534
Newsgroups: comp.sys.apollo