Newsgroups: comp.bbs.waffle
Subject: Re: Functionality of Waffle 1.65
From: rthomas@hakatac.almanac.bc.ca (Robert N Thomas)
Date: Thu, 24 Sep 92 05:08:19 GMT
Organization: Sir HackAlot's Castle BBS, Port Alberni, B.C., Canada
Keywords: Patches, COLOR, SECURITY, ENVIRONMENT


In article <1992Sep23.000900.4527@jack.sns.com> you write:
>Hi Folks!
>
>While I am waiting for a disk from Tom.......
>
>I have the following question for those of you running (UNIX) Waffle 1.65.
>
>Have the methods changed to allow shell access to users?

   Nope..  Fact of the matter is WAF165 has a number of problems which I 
have spent a fair amount of time dealing with...

>By this I mean can users that join the bbs now have their own Shell Accounts?
>This was not possible in 1.64 withour some kludges.

SHELL ACCESS (How to HACK a waffle site)
=========================================

   Quite simply, if a SHELL user can gain any access to your waffle executable,
then the BBS system is vunerable.  Especially if waffle is suid to some account.
Once inside, the user running the program simply runs some external program,
and then SHELLS to unix, and then HACKS the system...

   A number of sysadmins force users to use unix's su command to gain access
to the BBS.  This type of sysadmin may have forgotten the following:

WAFFLE=/usr/hacker/hacksys.static
export WAFFLE
su bbs

   The WAFFLE environment variable is preserved, hence allowing a "hacker"
to create a set of BOGUS system files, and hence they get a SHELL, and may
freely CD over to the "real" waffle system files, and nuke your system.

   Without doing some code modifications to your WAFFLE 1.64 or 1.65 waffle
release, you may as well consider your system insecure.  If any user has
shell access, then they have the capability of hacking the WAFFLE BBS.



STANDARD UNIX APPLICATIONS and WAFFLE (I mean games, chat programs)
====================================================================

     Most of these allow the user to SHELL..  On a "secure" system, I 
have had alot of FUN shelling 10 to 20 copies of WAFFLE, NETHACK, and CHAT
over and over again.  (assuming the sysadmin is using the su approach, or
if you like the WAFFLE as a shell approach).  In order to stop this, go
HACK all your existing applications, and fix them so they don't shell.

Myself, being a SHELL user, I don't like having to do this because maybe
I want to shell.  Ok then have two sets of executable programs for every
external program you run that SHELLS..  I home you have the source!

     Also under this approach, if a user can get any access to your waffle
executable program, the BBS system is hackable...  They RUN the BBS, and
shell to a borne shell from any external application what allows you to shell.

   Games such as NETHACK will not run, as waffle did not initialize the 
operating system so it knows "what type of terminal" the user is using.


STANDARD UNIX EDITORS and WAFFLE (forget about vi, and emacs)
==============================================================

      If you give a user access to VI (as shown in the standard config),
you grant them access to "hack" your waffle BBS system.  All one does is
type in :r admin/password, and "poof" you now have access to read the
password file.  The user does need to know "exactly" where the password
file is..  Once VI loads you waffle password file, the user is free to scroll
around, and look at the "neat" passwords.

       For my SYSV system, I had a heck of a time even getting VI to run
properly.  The operating system was not informed of what type of terminal
the user was using, hence VI would come up in a wierd LINE edit type mode.
The :r admin/password still would work however...


HOW WAFFLE RUN'S HERE AT SIR HACKALOT'S
========================================

   SHELL users run the waffle program directly, without the need of SU or
any other gunk.  There is also a BBS account which uses WAFFLE as the system
SHELL..  The system is nice and secure, and I have NO PROBLEMS with it.  I
have tried all of the above SHELL hacks without success...

   When a user uses STATUS and selects the terminal, waffle IMMEDIATLY informs
unix of what's happening!   This allows me to run games like NETHACK and such
in a TERMINAL independent manner...

    Here, users "may" use VI (I gotta compile EMACS) to edit messages, or
they may also use the "standard" waffle message line editor..  Being the
sysadmin, I know the password file is at /usr/lib/waffle/admin/password, and 
everytime I try and load it, the system tells me to "get stuffed".

    I Could allow my BBS user's to SHELL, the only problem with this is, they
may run TRN, ELM, SMAIL, MAIL, and MAILX and send EMAIL message to the GOD
of internet, and tell him "YOUR A JERK", etc..  The only name that would
be attached to this is BBS, which is not good.  I could let them use the
restricted shell rsh, but then the BBS user could hang around in NETHACK
for 100 Hours, and the BBS wouldn't know any better (Yeah I know about
watchdog "TRUST ME")..

    I do however allow BBS users limited SHELLING capability, and a very 
LIMITED access to only certain specific programs..  If they stay online too
long, a "hacked up watchdog Like" clone program NUKES them, even in 
subshells!!.

  Allowing BBS users SHELL access is like saying GO AHEAD, STAY ON AS LONG AS
YOU LIKE!

  When I want to run an application, ANY APPLICATION, I simply go and RUN
the thing knowing the BBS is still secure...

                        BLACK AND WHITE WORLD
                      =========================

   The world is already BLACK and WHITE enough, without having to look at a
BLACK and WHITE BBS...  Here at Sir HackAlot's the waffle BBS supports 
color on terminals which have such capabilities..  

>I have been working on this for a short period of time now in 1.64 and I do not want
>to do work which Tom has already done if it is not necessary. I am a great believer
>in not reinventing wheels! I will finish this though if it has not been done.

   Agreed..  I asked, no response, and then I went to work hacking on source
code!!!  I spent about 3 weeks SLAVING over how to make the above possible..

>So, any comments or suggestions on how to proceed?

   I have created some "patches" for waffle 1.65 (I suspect they might also 
work for WAFFLE 1.64).  They are still in beta test, and hopefully I'll 
hear something..  Any "programmers/waffle hackers" interested in trying 
this stuff???  I hunting for input on this stuff, before throwing out
into the world...

Cheers.....

						----- Robb ----

P.S. - Sir HackAlot's BBS can be reached as (604) 724-0067..  If you want
       to test color mode, term vt100-c or term pcplus  ! ! ! !