From: yates@a.chem.upenn.edu (John H. Yates)
Newsgroups: rec.games.mud.tiny
Subject: Re: Tiny logs ...
Keywords: tinylogs, twinks, flame, penn, idiocy
Date: 14 Oct 92 04:03:06 GMT
Organization: University of Pennsylvania

In article <A700E2224F015032@ghostwheel.dartmouth.edu> takkyon@dartmouth.edu (Dr. Tachyon) writes:
    (much deleted)

As the one *most* responsible for the well being of the privately owned 
group's UNIX machine that wreaked this havoc, one that some group members 
share the root password  on (hey, they bought it, it IS theirs, I try 
to educate them but...),  I'd like to address this part of this post.

>
>As Lydia says, the logs were posted from a guest account at upenn.  This
>is a revoltingly bad security problem.  IMNSHO someone should *not* be
>able to do this.  Period.  There is little or no excuse for allowing it

No one should be able to leave their car without locking it either.
Let's make it a law. Hey it happens. This is the real world.

When this machine arrived 3 years ago, I dutifully plugged guest from
anyones use, set it up on the network, set up sendmail to work on
our campus net, and let it run. The only time
I ever log in on it is when something is broken or something is needed.
The group shares sysadmin tasks. One of them made a terrible mistake
in giving guest a trivially guessable password. They also installed
rn themselves, and not completely correctly, which is why the articles
cannot be cancelled from guest on the machine. I have now identified why
that happened, and hope that my staff member can reinstall rn tomorrow
morning and then I can cancel the articles. (no guarantee, the problem may
still have a header mismatch, but I am trying.)

>to happen.  Perhaps the upenn sysadmins ought to spend less time worrying
>about whether cs students exceed their cpu time limits, and more time
>fixing the security holes in their system.
>

cs has nothing at all to do with this private machine in another department.

I am personally responsible, at various levels, for a mixed vendor
set of about 55 IP addressable machines. I do the best I can
and lobby continually for more permanent support staff (unsucessfully
so far). Some group members need to know their root passwords because
many are UNIX competent, and know what they should or should not do,
and I am only logged on 12-16 hours a day (more truth than fiction),
and researchers work 24 hours a day (it sure seems).
Sometimes they make mistakes, as one did on sg1. Other peoples mistakes
are even less controllable by me than my own mistakes, of which I
try very hard not to make in sysadmin at least.

I have personally spent most of the last 7 hours on this problem,
trying to cancel the articles, trying to contact the group's sysadmin
which evidently there is none for this group, and tracing logins and
network connections logs to snag the perpetrator. It is now midnight
and tomorrow is another day.

I also perused this group a little for the first time. I saw that
people were already concerned with people keeping logs and hiding
etc. My personal opinion is that it is rather naive of the game
users to believe that someone is not recording what they say,
and that it could eventually get into the wrong hands. Are the
authors of the game to be trusted any more than any other average
stranger?

Words of wisdom: if you don't want it to be repeated, don't say it
in public (if at all), and this game seems to consist of what I would
call public rooms, whatever you call them, where some listeners can hide
and record. Sheesh! And I get complaints about guest security? This
game is a security disaster waiting to happen. I just wish the
perpetrator had penetrated someone elses machine, or perhaps mailed
you all the stuff to your US Mail boxes, which they probably could
map to, but for the cost of stamps.

John
yates@a.chem.upenn.edu
P.S. I expect to ignore all flames and followups to this post.
     I continue to try to clean up the mess I inherited, but
     that's as far as I can commit my further time.
Newsgroups: rec.games.mud.tiny