HDTenEightyP/NetNews huggingface dataset:
Newsgroups: bit.listserv.novell
Date:         Fri, 2 Oct 1992 11:21:43 EST
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         Greg Monroe <MONROE@DUKEFSB.BITNET>
Subject:      Some questions about the Dutch NGN security problem.

I think I understand the theory behind the security problem the Dutch NGN
group found.  I want to see what others think about the following:

Basic theory:  The thief waits until a supervisor or other targetted
 user is logged on.  They then fake a request at a very low network
 level from the user to tell the server to grant them various authorities.
 E.g., set an account to supervisor status or change directory access rights.

Some Assumptions:

1) The thief must be on the same subnet or a subnet between the targetted
   user and server.  This is so packets from the target can be examined.
   Also, there may be problems sending fake packets across Novell routers
   (then again, IPX is "connectionless" and this may not be a problem).

Is this true?  If so, that means that subnet physical security could help
greatly.  (Doesn't solve the problem, just helps keep out the only slightly
dishonest folks).

2) Since, the break in consists of granting more authority, the thief
   needs an existing account for most things.  However, they could possibly
   change a logged in user's password to gain access.  But changing it
   back would be impossible so the theft would be obvious.  Also, if the
   supervisor was logged on, the thief could possibly create an id to
   gain access.

I guess the question here is how much can a packet-faker get away with
undetected?  In other words, if the server needs to respond to the request,
would the actual user would see the response and be alerted?  What are the
limits to security changes by fake packets?

If we are to properly assess our risks, we need enough information to have
a valid model.  After all, a totally secure system with easy access is
currently only a dream, like the burglar proof house.  What we can do
is to properly assess the risks and take appropriate actions to achieve
the best balance for our particula situation between ease of use and security.

Greg Monroe  <Monroe@DukeFSB.BitNet>
Duke's Fuqua School of Business
Durham, NC  27708-0114
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Newsgroups: bit.listserv.novell
Date:         Mon, 28 Sep 1992 08:57:00 LCL
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         "(DKEARNS)" <DKEARNS.TCC@KLAVEN.TCI.COM>
Subject:      Re: Help! Server Crash Nov3.11

> I keep having this server crash!  I have a 486 50 with 16 Meg RAM.  The
> server only started crashing after I added a second drive to it.  The
> first Drive was a 600Meg Micropolis ESDI.  The Drive I added is a 300 Meg
> Micropolis Drive. I am using an Ultrastor Controller w/ the upgraded ROMS
> (009).  I am combining the two drives as ONE VOLUME.  But IT KEEPS
> CRASHING ABOUT ONCE A WEEK!.  It gives an ERROR...error writing to
partition #3
> then Drive deactivated due to drive failure.  I ran the Surface analysis
on
> BOTH drives and it RUNS FINE it finds no new errors.  WHY DOES IT KEEP
DOING
> THIS!!!!  I Have to run Vrepair after it crashes and once I had to do a
> FULL RESTORE because Vrepair could repair it!
>
> AAAARRGGGHHHH!!!!!>
> Is Anybody else using the VOLUME SPANING MULTIDRIVES Feature of
> NOVELL?????

We're using spanned volumes on 3 out of 5 servers (but I do make sure to
DUPLEX any spanned volumes)...


It appears that your server thinks there are more partitions available than
are physically there. Even if you have a small DOS partition that's 0, 1
and 2 - there's no partition 3. Load install and check the disk setup...

-dave

+--------------------------------------------------------------+
| Dave Kearns                 |                                |
| Director, Info Services     | dkearns@klaven.tci.com         |
| Thomas-Conrad Corp.         | dkearns@tcc [MHS via NHUB]     |
| 1908-R Kramer Lane          | dkearns@tcc [MHS via CSERVE]   |
| Austin, TX 78758            | 76704,62 [CompuServe]          |
| (512) 836-1935              |                                |
|"There is nothing so inefficient as doing efficiently that    |
| which shouldn't be done at all."                             |
+--------------------------------------------------------------+
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Original_To:  BITNET%"novell"
Original_cc:  TPM4017
Newsgroups: bit.listserv.novell
Date:         Mon, 28 Sep 1992 10:46:00 CDT
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         TPM4017@PANAM.BITNET
Subject:      re: netport fixes

A couple of days ago, there was question about fixes to the
Intel Netport (e.g. not able to reconnect after server is brought back
up). I received a note from intel which states that many of the fixes
are available from their BBS (1-503-645-6275 U.S. +44-793-432-955 Eu.).
The file for ethernet is ETHUPGRD.EXE and token rings is TKUPGRADE.EXE.

Hope this helps,
Tim McCollum
University of Texas - Pan American
TPM4017@panam1.panam.edu
From: A.Orde@LEEDS-POLY.AC.UK (Angus Orde)
Newsgroups: bit.listserv.novell
Subject: Server Process: MUXPRC - Help!
Date: 2 Oct 92 19:30:00 GMT
Reply-To: Novell LAN Interest Group <NOVELL@SUVM.BITNET>
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Via:        UK.AC.LSPLY;  2 OCT 92 12:33:15 BST
Via: courier (novell-smtp-gateway.leeds-poly.ac.uk); Fri, 2 Oct 92 12:33:18 GMT
Encoding:   28 TEXT
X-Mailer:   Network Courier V2.1b

One of our old fileservers is crashing on a regular basis. It is an IBM Model
80 with 2 x 115Mb drives and Netware 2.15c SFT. It will power up OK, then if
anyone tries to login, it crashes with the error:

NMI parity error
Server Process: MUXPRC

This does not happen at exactly the same point every time. Sometimes you're
not even asked for a password, sometimes you can get all the way in.

I have tried swapping just about every component, and with another server of
exactly the same configuration, with only the hard disks from the original,
it still gives this error. It does NOT appear to be a memory error (the
second fileserver worked fine with ITS hard disks) but I need the information
on the hard disks (backups not up to date enough! oops!!).

Any help/suggestions would be greatly appreciated.

Cheers,

Angus
****************************************************************************
Angus Orde                           Email:    a.orde@leeds-poly.ac.uk
Leeds Polytechnic                      Tel:    (UK) 0532 832600 x 3084
Computing Services                     Fax:    (UK) 0532 833145
****** How many different topologies and protocols can you juggle ?? *******
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Organization: Golda Meir Library, UW-Milwaukee
Priority:     normal
X-Mailer:     Pegasus Mail v2.3 (R4).
Newsgroups: bit.listserv.novell
Date:         Mon, 5 Oct 1992 15:40:50 CST
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         Einar Bergsson <EINAR@GML.LIB.UWM.EDU>
Subject:      Bootp.....

   Hey Net-Landers!

   Does anyone know if there is a bootp available on the net for
netware 3.11?  Or better yet, if I could make the IP gateway in the
server, (You know, the TCP/IP router in netware) forward bootp
packages to another UNIX based bootp server.
Thanks....

    -Einar-
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Organization: Seebeck Computer Center
Priority:     normal
X-mailer:     Pegasus Mail v2.3 (R4).
Newsgroups: bit.listserv.novell
Date:         Sun, 27 Sep 1992 15:21:53 CDT
Reply-To:     jford@seebeck.ua.edu
From:         JFORD@SEEBECK.UA.EDU
Subject:      Re: Security Risk...

>From:          Brett Warthen <BRETT@INFINITE.MHS.COMPUSERVE.COM>
>Subject:       Security Risk...

>Regarding the recent security risk to NetWare networks discussed on this
>list (the Dutch one, not the KNOCK one revisited)...
>
>I just wanted to let everyone know that Novell has released an NLM for
>NetWare 3.11 to address the potential problem (nothing yet on other
>versions of NetWare).  The filename is SECURE.ZIP and it is available in
>Library 1 of NOVLIB on CompuServe and (hopefully) Novell's FTP mirror site
>of NOVLIB.

It is now on risc.ua.edu in /pub/network/novlib/01/secure.zip



----------
James Ford - Consultant II, Seebeck Computer Center
             jford@seebeck.ua.edu, jford@risc.ua.edu
             The University of Alabama (in Tuscaloosa, Alabama)
From: JRD@USU.BITNET (Joe Doupnik)
Newsgroups: bit.listserv.novell
Subject: Re: Security Breach Discovered!
Date: 1 Oct 92 21:01:18 GMT
Reply-To: Novell LAN Interest Group <NOVELL@SUVM.BITNET>
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
X-Envelope-to: NOVELL@SUVM.BITNET
X-VMS-To: IN%"NOVELL@SUVM.BITNET"
X-VMS-Cc: JRD
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT

>I had quite a surprise this morning.  At 9:06:11 every user on one of our
>servers (invcluding me) received the following message:
>
>"Security breach against station 12 neutralized."
>
>This is the message which Novell latest security patch generates.  I was a
>little surprised to see it since I didn't think any of our students would
>find out quite this quickly about this newest way to break into Novell.  But
>as it turned out, I think there is a bug is Novell's patch.  It took me a
>little while to figure out who was on station 12 because the security NLM
>had dropped the connection.  I had to use PAUDIT to generate a list of
>logins/logouts (which turned out to be a VERY large file), but in the end I
>had located the user, and she was someone that works across the hall from me
>and had been using Pegasus Mail at the time of the incident.  She never
>recieved the broadcast message herself, but did get the message "Error
>receiving from server" as she tried to read a mail message and had to reboot.
>Apparently the security NLM somehow thought that she was doing something
>naughty when she actually wasn't.
>
>This incident certainly doesn't give me a lot of faith about the
>effectiveness of this patch.
>
>
>___
>Paul Steele, Network Services Manager              902-542-2201x660
>Acadia University, Computer Centre            FAX: 902-542-4364
>Wolfville, Nova Scotia, Canada, B0P 1X0  Internet: Paul.Steele@acadiau.ca
------------
Paul,
        Yes, others have noted the same effect and I reported this to Novell.
Considering the haste in which the patch was prepared I am not surprized.
I presume the patch will be revised shortly to eliminate this effect, as
well as cover another corner lifted by the Dutch Univ group over the past
few days ("guns and armor" syndrome). Please note that you can defeat the
lockout (see the .DOC file), and probably safely at this time because the
cracker is not in public hands so far as I know (and I'm trying to keep it
that way).
        It would be useful for Novell to know the precise conditions
leading to the false lockout so they could reproduce it. Could you contact
Janet Perry, janetp@novell.com, about this?
        Thanks,
        Joe D.
From: THERRING@INDYVAX.BITNET
Newsgroups: bit.listserv.novell
Subject: Pegasus Mail
Date: 5 Oct 92 19:29:24 GMT
Reply-To: Novell LAN Interest Group <NOVELL@SUVM.BITNET>
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
X-Envelope-to: NOVELL@SUVM.BITNET
X-VMS-To: IN%"NOVELL@SUVM.BITNET"
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT

I have heard that the Pegasus mail package is freeware.  I was wondering where
I might find it.  At an anonymous FTP site?  I know there has been plenty of dis
   cussion regarding Pegasus on this list, but I have never had the need to pay
much attention.  Any information about where to find the program or any
documention would be greatly appreciated.

Please respond directly.

Thanks,

TOdd Herring
LAN Admin Asst
THERRING@INDYVAX.IUPUI.EDU
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
X-Vmsmail-To: SMTP%"novell@suvm.acs.syr.edu"
Newsgroups: bit.listserv.novell
Date:         Mon, 5 Oct 1992 05:38:04 -0400
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         BRUNIJ@NOBEL.ISD.UPMC.EDU
Subject:      NCSA Telnet & ODI

It has probably been posted before but I missed it.

We use NCSA Telent with SMC Boards and their packet driver 8003PKDR.EXE.

We are going to convert to ODI.  What is needed to make NCSA Telent work with
ODI?  Or can it work with ODI?

BRUNIJ@NOBEL.ISD.UPMC.EDU
Newsgroups: bit.listserv.novell
From: shyen@bnl.gov (Sharon Yen)
Subject: Questions on NetWare NFS
Reply-To: shyen@bnl.gov
Organization: Brookhaven National Laboratory
Date: Tue, 29 Sep 1992 18:31:58 GMT


Hi folks,

I need some clarification here from the users about what NetWare NFS
software package can do and can not do.  My understanding is that
NetWare NFS turns the NetWare server into a NFS server.  So that UNIX
users can access NetWare server file system as an extention of their native NFS file system.  

Question 1:
What about none UNIX environment that supports NFS such as VMS running MultiNet? Does NetWare NFS allow a user on a VMS machine running MultiNet to access the NetWare server files?  MultiNet is a software package that provides the NFS protocol for VMS systems to allow the integration with UNIX systems.  

Question 2:
Very often a UNIX machine that is used as a NFS server is also a client at the same time.  Does NetWare NFS provide the capability to allow the Novell NetWare server to mount other NetWare servers' file systems or
other NFS server file systems?  

Having posted the above questions, let me give the readers some back ground information regarding why I'm asking these questions.  We are on the subject of network file integration.  Many of our PC users who are not on the Novell network use PC-NFS to access NFS file systems on the UNIX hosts and VMS hosts.  Many Novell NetWare users here have the needs to access their files on the VMS and UNIX machines as well.  The true task here is can NetWare NFS handle this need.  I think the answer is NO. Then what N



etWare product(s) can be used to achieve that?

I hope someone from Novell is reading this.

Sharon Yen <yen@bnl.gov or shyen@bnl.gov>
Brookhaven National lab





Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
X-Envelope-to: NOVELL@SUVM.BITNET
X-VMS-To: IN%"NOVELL@SUVM.BITNET"
Newsgroups: bit.listserv.novell
Date:         Wed, 30 Sep 1992 11:26:00 EST
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         "SHEL SAX (802)388-3711X5323" <SAX@MIDD.BITNET>
Subject:      printing advice

Being new to Novell setups, I'd like to ask for printing advice.  We're
setting up a 20 workstation classroom/lab and need to provide printing
services.  The current plan calls for one laser printer and two ink jet
printers. First question, what printers would you recommend. Second, does
anybody make a 'black box' or interface for a printer so that it can sit on
the network cabling directly rather than having to hang of a server or
workstation running rprinter.  Thanks.
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Newsgroups: bit.listserv.novell
Date:         Tue, 29 Sep 1992 17:25:26 PST
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         RON ZELMAN <rzelman@SMTPLINK.COH.ORG>
Subject:      nwipxspx.dll

We're installing the Sybase nlm and are attempting to load the client
portion.  We're getting an error 'Missing nwipxspx.dll'.  This sounds like
some sort of windows product.  Does anyone have any information on where to
obtain this library?  Thanks.

*************************************************************************
Ronald J. Zelman                         Internet:  rzelman@coh.org
Technical Services Manager
City Of Hope Medical Center
Duarte, CA  91010
*************************************************************************
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Newsgroups: bit.listserv.novell
Date:         Wed, 30 Sep 1992 12:13:41 HOE
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         Ramon Ros <ZCCBRRG@EB0UB012.BITNET>
Subject:      Source routing on IBM Token-ring

    Does anyone know if its possible to acces a v2.x server via
IBM bridge on token-ring? I've tried it loading route.nlm on the
server but it only works on 3.11.

    We have another problem. If seems that you can only acces a v3.11
server via IBM bridge if in your local ring exists a server with
route.nlm loaded. Does anyone have noticed this?

Thanks in advance.
Ramon Ros. Universitat de Barcelona.
zccbrrg@eb0ub012.bitnet
From: MAILBOX@ZEUS.ICE.NL (Zeus Mailbox)
Newsgroups: bit.listserv.novell
Subject: Mac with uucp/internet
Date: 6 Oct 92 12:17:46 GMT
Reply-To: mailbox@zeus.ice.nl
Organization: ETB-Lubbers Nederland B.V.
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
X-Pmrqc:      1
X-Mailer:     Pegasus Mail v2.3 (R3).

Dear Netters,

This one is little of the usual Netware subject but maybe someone has
a solution;

I want to put a mac in internet via a uucp connection (modem) to a
uucp-mailer.
Is there a mac-version of uucp/rmail/sendmail ???

Greetings...

Henno.



mailbox@zeus.ice.nl (Henno Keers)                     Zeus mailbox
---------------------------------------------------------------------
ETB Lubbers Nederland B.V.                            Nijmegen
Korenpad 1                                            6534 AS
Tel. +31 80 540111                                    The Netherlands
Newsgroups: bit.listserv.novell
From: donp@novell.com (don provan)
Subject: Intermittent incomplete IPX pakcets (was Re: GPI running MUXPRC)
Organization: Novell, Inc., San Jose, California
Date: Mon, 28 Sep 1992 17:34:53 GMT

In article <01GPB6OMB25U91VXJT@CC.USU.EDU>, Joe D. writes: 
>Here several times a week I see a flurry of incomplete
>packets from one or two stations, as recorded on the NW 3.11 screen. It sort
>of looks like a bad board or wiring (I vote for a failing board).

Actually, whenever i've seen this happen it's turned out to be a
misconfigured board with the interrupt set incorrectly.  It seems odd,
but with some boards (like the ne2000), telling the driver the wrong
hardware interrupt doesn't cripple the board, it just makes it screw up
in some corner cases.  The results i've seen have included intermittent
incomplete IPX packets.  Under the right conditions, the workstation
might not even notice the problem, since any lost requests will be
retransmitted.  Could that be the problem?
						don provan
						donp@novell.com
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
X-Envelope-to: NOVELL@SUVM.BITNET
X-VMS-To: IN%"NOVELL@SUVM"
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Newsgroups: bit.listserv.novell
Date:         Wed, 30 Sep 1992 08:45:26 -0600
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         "JASONB@ZENO.MSCD.EDU" <JASONB@MSCD.BITNET>
Subject:      Can some of help me SIGNOFF

My name is Jason Beatty <JASONB@ZENO.MSCD.EDU> and I am having some problems
trying to "SIGNOFF NOVELL", can anyone please sign me off.

Thanks.

Jason B
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Newsgroups: bit.listserv.novell
Date:         Tue, 6 Oct 1992 09:09:11 MST
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         Skip Knox <DUSKNOX@IDBSU.BITNET>
Subject:      Re: Bindery Closed Message

Thanks for the interrupt message, I'll turn that off.  One reason a
person might want to turn it off is because that increases the message
scroll rate and many net supervisors (like me) are too lazy to bring up
an editor to read the whole error log.  The interrupt errors could cause
some other kind of message to scroll off the screen.

But the Bindery Closed thing bugs me.  Assuming someone did know my
supervisor password (they don't, but I have a supervisor equivalent
account and that one is known by three or four of us here in the lab),
what command would they have to issue to create that error message?
Remember, I had an Open and Close message four times within the space
of one minute.

Ellis "Skip" Knox       dusknox@idbsu.idbsu.edu
PC Coordinator & Faculty Computer Lab Supervisor
Professor of History
Boise State University  Boise, Idaho
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Subject: (no subject given)
Newsgroups: bit.listserv.novell
Date:         Wed, 30 Sep 1992 23:20:38 -0500
Reply-To:     rmendis@rs6000.cmp.ilstu.edu
From:         rmendis@RS6000.CMP.ILSTU.EDU

tell listserv at suvm sign on novell
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU
Mailer: Elm [revision: 66.25]
Newsgroups: bit.listserv.novell
Date:         Mon, 5 Oct 1992 10:40:51 CDT
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         Charles Hofstaedter <charlesh@STEDWARDS.EDU>
Subject:      Security Hack and NW4MAC

Hello netters!!

With all this discussion about programs that usurp supervisor prviledges
is there any word about using the supervisor account when logged in to
a Mac?  Does this provide the same hole as being logged on as supervisor
in the Netware environment?  Is Mac supervisor and Novell supervisor the
same thing?  Any comments are appreciated.
--
Charles Hofstaedter
Computer System/Network Administrator
St. Edward's University
3001 S. Congress Ave.
Austin, TX 78704
(512)448-8674
Internet Address: charlesh@acad.stedwards.edu
Newsgroups: bit.listserv.novell
From: pyrros@braindamaged.cis.udel.edu (Christos T. Pyrros)
Subject: Re: Warning about 486/50 CPUs in servers
Organization: University of Delaware, Newark
Date: Tue, 29 Sep 1992 10:17:02 GMT

In article <NOVELL%92092901140649@SUVM.SYR.EDU> Novell LAN Interest Group <NOVELL@SUVM.BITNET> writes:
>Ryan Jone's problem reminded me of something I meant to pass along to
>the list (sorry Ryan, I don't think this is your solution).
>
>Recently, our build it/fix it guru was telling me about how the Intel 486/50
>chips have been having problems with heat disappation.  This could cause
>all sorts of problems with the OS and PC.  The recommended solution
>was lots of ventilation, either an oversized fan or double fan case (a
>lot of 'clone cases' now have this option).

Our 486/50/32 Mb RAM ISA server was crashing once every two months with
Parity errors.  I thought they might be related to bank switching. We
had 3 fans at this point.

After removing the cover and placing 2 65 CFM fans to cool the motherboard
and hard drives directly, the server has never crashed (4 months now).

We now have a total of 5 fans on this server, which has 2 Gb of disk.  Runs
great!

Chris
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU