From: sysop@robot.nuceng.ufl.edu (Shawn A. Clifford)
Subject: re: hide directory
News-Software: VAX/VMS VNEWS 1.41    
Reply-To: sysop@robot.nuceng.ufl.edu
Organization: Nuclear Engineering Sciences - Univ. of Florida
Date: 11 Dec 1992 11:46 EST  

In article <9212101505.AA17670@ucbvax.Berkeley.EDU>, BOB@AENEAS.IMS.DISA.MIL ("Bob George") writes...
>Subj:	HELP!!! Security problem for gurus.
> 
>#	I need to avoid certain people to scan a directory of mine. This
>#	could seem a very trivial issue, if it was not for the following:
> 
>#	o  Some users of mine have (and need to retain) *ALL* privileges
> 
>#	o  I don't want to clear the DIRECTORY file characteristic bit
> 
>#	o  I don't want to do encrypting or any other tricky thing
> 
>#	o  I want to be able to access my directory whenever I need to
> 
>#	In other words: do you know of a feasible method of protecting
>#	private areas without resorting to the traditional & documented
>#	practics? Impossible? That's what I fear! Sigh!
> 
> 
>Pretty much so.  You could (as you mentioned) encrypt the files in 
>question, but you didn't want to do that.  Just about anything else
>you would do is counting on someone else's (somewhat easily obtainable - 
>not like an encryption key which only you know) lack of knowledge to 
>protect your files.  Something which could hide the files a little, but 
>they could be found by a method similar to finding them with the directory
>bit cleared (ANAL/DISK/REPAIR), is to rename the xxxxxx.dir file to 
>something without a .dir extension (EX: xxxxxx.dat).  Then the files in the
>directory are mostly unaccessable through normal means.   Commands like 
>anal/disk will find them and dumping the disk will display them to say 
>nothing about more esoteric means of finding the file in the index.sys, 
>looking up it's header and then just dumping that file's blocks.  To 
>re-access the directory, just rename it back to a xxxxxx.dir file.  Easily
>done, but if suspected, easily circumvented also.  Good luck,
>                                                               :\/\/\/:
>                                    bob                        :______:
>                                                               : (o)(o)
>+----------------------------------------------------------+  c:   ___:
>| Bob George     Internet : BOB@AENEAS.IMS.DISA.MIL        |   :     _)
>| Disclaimer:    Opinions expressed are mine and mine only.|   : ,___:
>+----------------------------------------------------------+   : __ /
>                                                               /____\


There is another option, at least it used to work under V4.x.  If you modify
the directory entry, by editing the parent directory file, so that the '.'
in the directory name is a blank ' ' character, then ACP does not display the
directory.  You used to be able to access the files in the directory, just
like normal.  One way of accomplishing this is to make a copy of the parent
directory file, edit it, and then do a COPY/OVERLAY back on top of it.  I use
a program that loads the file into a global section and then writes the section
back to disk without creating a new version... looks kinda like Norton's
file editor in hex.

*WARNING*  I believe that if the system manager does an ANALYZE/DISK/REPAIR
that the modified directory entry and its contents get zapped to SYSLOST.
You might be able to fix that with SET FILE/NOMOVE, but I don't know since I
haven't tried this since V4.x.

Good luck!

-------------------------------------------------------------------------------
Shawn A. Clifford, System Manager | Internet: sysop@robot.nuceng.ufl.edu
Nuclear Engineering Sciences      |		sac@eng.ufl.edu
University of Florida             | Home Phone: 904/335-4914
Gainesville, Florida  32611       | Work Phone: 904/392-1450  FAX: 904/392-3380
-------------------------------------------------------------------------------