From: ffan@skat.usc.edu (Frankie Fan)
Newsgroups: comp.os.vms,vmsnet.sysmgt
Subject: Re: HELP: how to stop and prevent break in?
Date: 13 Nov 1992 10:30:19 -0800
Organization: University of Southern California, Los Angeles, CA
NNTP-Posting-Host: skat.usc.edu

bern@Uni-Trier.DE (Jochen Bern) writes:

>In <1ds5eqINN185@merak.usc.edu> ttytst@merak.usc.edu (Guess what) writes:
>>We got very strange things happened on one account where we found the
>>owner of files are not only the owner of the account but also another one.  
>>	OWNER=[my,WHO] 
>>All the files and directories under that account have two owners and we are
>>sure that the other one is illegal. What we need to know right now is how
>>to prevent this kind of things happened again and how to remove the illegal
>>one from the ownership without SYSTEM ADMINSTATROR's Privilage.  Thanks in
>>advance.

>There is no such Thing as two-Owner-Files in VMS. I suppose you did a
>DIR /OWNER to obtain the cited Output, right? Then what you observe is
>DCL reporting that the File belongs to a named User (WHO) which is a
>Member of a named Group (my). Example given, I have an Account BERN
>on a Machine where I'm "just another User", short "CIP". They've put
>me in a Group CIP, and everytime I do a DIR /OWNER, I see:

>	PRIVATE.DIR;1        [CIP,BERN]

>etc.. If you want a Proof, do a HELP SET FILE /OWNER. It says "...sets
>*THE* Owner UIC of the File...". If you want harder Proofs, look into
>the DCL Concepts Manual; BookReader doesn't work in this Moment, so I
>couldn't look it up myself.

>Talking about File Protection, the one and only Command to read the
>File's security-related Settings is DIR /SECURITY. Currently, it's
>equal to DIR /ACL /OWNER /PROTECTION, but I assume that DEC will upgrade
>/SECURITY whenever new Items arise. If you're REALLY concerned about
>File Protection, I've got a "check all them Files"-Procedure ready;
>EMail me if you want to try it out. Greetings,
>								J. Bern
>-- 
> /  \  I hate NN rejecting .sigs >4 lines. Even though *I* set up this one. /\
>/ J. \ EMail: bern@[TI.]Uni-Trier.DE / ham: DD0KZ  / More Infos on me from /  \
>\Bern/ X.400 Mail: S=BERN;P=Uni-Trier;A=dbp;C=de  /   X.400 Directory, see \  /
> \  /  Zurmaiener Str. 98-100, D-W-5500 Trier    /     X.29 # 45050230303.  \/


Thanks for the explanation of the ownerships in the posts, but the
problem we encountered is that the first name S892999 shown below is
essentially a user's name.

~~~~~~~~~~~~~~
	$ dir login.com;3 /security

	Directory $DUA0:[STUD.S882000]

	LOGIN.COM;3          [S892999,S882000]     (RWED,RWED,,)
                                 ^       ^
	Total of 1 file.         |       |
                                 |       |
             Another user's name--       --- owner of the account

~~~~~~~~~~~~~~

I'm just wondering if there is a possiblity that the name of a group
can be the same as the name of a user. Or is there any way to check
the group name in VMS? like "ypcat group" in UNIX running NIS.  

Thanks in advance.
~~~~~
 Kan Frankie Fan
    Technical Support Group                Internet: ffan@usc.edu
    University Computing Service           BITNET:   ffan%usc@uscvm.BITNET
    University of Southern California      Phone:    (213)740-2867
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Disclaimer: all above are my own opinion and there is nothing to do with
                either USC or UCS.

Newsgroups: comp.os.vms