🚀 go-pugleaf

The following consistsof my perspectives and opinions regarding some of
the events that have taken place in the past few months.  I cannot
say that everything here is presented exactly as events occured, I can
only say that this is how I have seen things.  I am not trying to present
a compete catalogue of events, that would be unreasonable.

I may express personal opinions, and I would like to state at the outset
that I am not speaking officially, merely as an individual caught up in
these events.  I mean no one any malice, and I do not intend to give
insult to anyone named in the following text.

I especially do not intend to offer any insult to Randy Suess, and I wish
to state that at the outset as I suspect that I have managed to quite
unwittingly present myself to him in a less than favourable light.

My apologies for any typos and mispellings.

In December of 1992 there was a small secuirty breach in the network of
The University of Chicago which hosts the /usr/group/chicago E-Mail and
News project machines.  Th breach was not in a machine administered by the
Computer Science dept, or the Computer services people.  It was identified
and closed by the staff at The U of C.

Parts of the /etc/passwd file for clout.chi.il.us were found on one of the
compromised machines.  The password file was accessable via NIS, and could
have been read by anyone.  This is no longer the case.  The password file
has been run through crack, and all passwords that were broken have been
changed.  Furthermore, even administrative passwords that weren't cracked
have been changed.

The clout.chi.il.us machine was not compromised, however we carried out an
immediate security audit on the machine, and closed all of the potential
security holes we found.  There weren't many of them, and they weren't
very serious, but we felt a responsability to be paranoid.

Matt Crawford, who has preformed security audits for other machines at The
U of C has been very helpful in this, and I would like to publically
express my thanks to him!

A brief aside, the two machines clout.chi.il.us and machine.chi.il.us are
quite different and separate.  The clout.chi.il.us machine is runby the
clout subgroups of the E-Mail SIG of /usr/group/chicago.  It is
administered by a group of volunteers who share responsability for the
operation of the machine, and share the load of running a complex system
providing mail services for several hundred sites in the Chicago area.

The machine.chi.il.us machine is NOT run by the same project.  It is, and
has always been administered independantly from clout.chi.il.us.  It is
not part of the Clout project, and never has been.  At one time,
machine.chi.il.us shared resources with clout.chi.il.us, namely the /usr
partition of the file system.  This, and the fact that both machines were
initially configure by La Monte Yarroll is the whole of their relation to
each other.

The machine.chi.il.us machine has been administered by Randy Suess ever
since it was initially set up by La Monte Yarroll.  When it was sharing a
/usr/partition with clout.chi.il.us every interruption in the operation of
clout (and these are a regular occurance with clout, it is constantly
having more connections added to it, and the load it is subjected to is
continually increasing) caused machine.chi.il.us to hang, or crash until
clout.chi.il.us could be reset.

This was not an acceptable state of affairs, and Randy Suess is to be
commended for his heroic efforts to keep the system operating smoothly
despite such awkward conditions.  However, with unpredictable
interruptions, and inadequate drive space machine.chi.il.us was loaded to
the max simply providing one full news feed.

In the late summer of 1992 Randy Suess made the News SIG (the functional
group of under which machine.chi.il.us is supposed to be run) a very
generous offer.  A few months previously the News SIG had re-activated
itself to address some problems that were affecting news distribution in
the Chicago area.  The News SIG wanted to improved news distribution in
the area, the current machine.chi.il.us (at that time a Sun 3/50) was not
able to accept higher loads.  Randy Suess offered to allow the News SIG to
use one of his computers with a high capacity multi-port serial board.

Randy Suess would continue to act as sole administrator for the machine,
and would offer to take time out of his schedule to even fix problems on
site.

The News SIG, while having a few reservations, opted to accept this very
generous offer with a few conditions.  Randy Suess configured a
replacement computer at his home, set up all software on it, and in
September of 1992 the switch was made.

The News SIG's projects moved forward, and the main project to improve
distribution of the chi groups went onward to considerable success.  Oddly
enough, surprisingly little use was made of the "new" machine.chi.il.us.
Eventually, Randy Suess opened machine.chi.il.us up for a small number of
news connections, the News SIG was never fully made aware of how far this
went, though Randy Suess was operating based on some preliminary plans
that had been made some time ago, but not acted on by the SIG itself.

The issue of other connections to machine.chi.il.us is rather murky, and I
certainly don't know all the details myself.  I do know that some of the
confusion that resulted from the lack of understanding contributed to a
lot of the friction that has been going on now.

A few weeks after the breach at The U of C a message was sent anonymously
to root@clout.chi.il.us by someoone calling themseves a "cracker" telling
us that there was a security hole on machine.chi.il.us and pointing out
how to exploit that hole.  The message also pointed out the security
problems on clout that had alredy been fixed.  This message is included at
the end of my post for reference.  It is filled with poorly executed
corrections, and is generally a rather poor technical specimen of an
anonymous E-Mail message.  Incidentally, it is trivially easy to forge
anonymous E-Mail.

At the time I initally learned of the first security problems I didn't
even think of machine.chi.il.us.  It was not a machine with a large number
of UUCP connections, a group of administrators or a particularly high
profile.  I have never been an admin for machine.chi.il.us, and quite
frankly the idea that machine.chi.il.us would be involved in the security
problems never really entered my mind.

So, when I saw the "hacker" message, I was quite surprised.  I IMMEDIATLY
called Randy Suess as a courtesy to inform him that someone with severly
limited credibility was claiming to have found a serious security hole on
machine.chi.il.us.  I was quite surprised by the response I got.  Possibly
I called Randy Suess at a bad time, but his response to me over the
telephone was angry, abusive, and very disturbing.

I will not go into details other than to say that Randy gave me the
impression he thought I was acusing him of criminal incompetence, rather
than extending him a courtesy (namely that of informing him that some
un-named person was claiming to have compromised a system he administered,
I did not trust the "hacker" and wished to check with the someone who I
felt would be able to deal with things).  Randy called me back a few
minutes later to apologize for his angry response, and I apologized for
anything on my part that could have been misconstrued by him as critical
or acusatory.

At this point I felt that Randy had been informed, and things were well on
their way to swift and sane resolution.  I was still quite disturbed by
Randy's abusive phone call, but I do not know Randy very well, and that
coupled with his prompt return call and our mutual apologies for
misunderstanding lead me to believe that things were Okay.

They weren't.

The security breach on machine.chi.il.us was real, and it turned out to be
quite annoying.  Annother clout.chi.il.us admin who had become aware of
the cracker and the hole went onto machine.chi.il.us and verified the
existence of a hole, and closed it.  This might not have been the most
polite course of action, and might have been interpreted in a poor light
ry Randy Suess, I personally do not believe any malice was intended, nor
do I believe that any insult was intended.

However, I can quite easily see where Randy Suess might have been insulted
by this.  I think that the political conditions that lead to this
innocuous act being a potential insult are intlerable, and deeply regret
even the possibly that I might in any way have contributed to them, even
thought I am pretty sure I didn't.

Some time later the News SIG had a regularly scheduled meeting.  At this
meeting it was decided that some of the arrangements origianlly made With
Randy Suess were not acceptable, and that it was felt that the SIG could
not risk offending the good nature of The University.  For these, aand
other reasons it was decided to thank Randy Suess for his help so far, and
to search for a new computer to replace the one he was letting the News
SIG use.

Randy Suess no longer needed the use of machine.chi.il.us for himself, and
he had given me the impression that he was no longer interested in
participating in News SIG projects.  He had at several times indicated
that he wished to take his machine back.  I considered the fact the he had
not removed the computer already simply as annother example of Randy being
generous and giving the group time to find a replacement.

Somehow the decision of the News SIG to thank Randy for his help and look
for new hardware was reported to Randy by someone who claims to be the
"cracker" as having been a decision to throw Randy out for some imagined
incomptence.  This was not, and is not true.  However incorrect the insult
was made.

At this point things exploded.  The Executive bord of /usr/group/chicago
was called in and started examing the situation.  A board member, Ron
Heiby, started an investigation of the whole affair, and those who are
interested should consult him.

Shortly before Ron Heiby had a chance to present his findings to the board
yet one more factor came into play.  At the time the new machine.chi.il.us
was installed by Randy Suess, our hosts The University of Chicago informed
us that there were planning to move the project computers to a different
room at some time in the future.  The time of the move was the Wednesday
the day before Ron was to make his report to the board meeting.

That Tuesday I talked to Dave Ihnat, I wass given the impression that
Randy was planning to take his computer home before the move so as not to
have to worry about it being damaged, or parts lost during the move.  I
assured Dave that Randy's physical access privaledges had not been
revoked, and I consulted with other /usr/group/chicago board members about
Randy taking hiiis equipemnt home.  The consensus as I saw it was that it
would be fine if Randy wanted to take his equipent home, after all it was
his, and that we appreciated his letting us use it.

Wednesday morning when I came in to move clout.chi.il.us I was rather
surprised to see machine.chi.il.us still there.  I immediatly called
Randy, and to my surprise he said that he had not heard anything about
removing the machine, I offered to carefully move it to the new room and
set it up if possible until formal decisions were made.

I moved clout.chi.il.us to the new room, and set it up.  I sent out
message to the clout admin group informing them of the new direct Telebit
phone number.  And if you need it, please contact one of the clout admins.

I was not able to set up machine again howvere.  In the old room
machine.chi.il.us had been connected to the network with a 10base2 thin
coax connection.  In the new room the ethernet connection was to a
multiport AUI hub.  I was not going to go inside a machine that did not
belong to me, and that was not familiar with, and that I had nothing to do
with the administration of and make the hardware changes necessary to
re-connect it.

I simply placed it in the mew room, and carefully made sure that
everything was neat and intact.  I called Randy Suess to inform him of
this, and as he had left by then left a message onhis answering machine to
the effect that I had not reconnected machine owing to a problem with the
ethernet, and that he could come down and either take it home if he wanted
or leave it (and I thought it would be understood, change it to accept
AUI) until the board of /usr/group/chicago made a formal decision the next
night (Thursday).

I believe this message was misinterpreted rather seriously by Randy Suess,
as later that evening I was called and the following message was rbought
to my atention
In article <C27EBC.50H@chinet.chi.il.us> randy@chinet.chi.il.us (Randy Suess) writes:
>
>	Well, the little ego boys have done their thing, and machine has
>	been shut down.  (BTW, that is my personal equipment, and if I
>	don't see it REAL soon, some people are going to be very unhappy)

I presume I am one of the "little ego boys," well, I feel I was justified,
in all my actions, I feel I have acted in good faith, and I apologize if I
made statements that were interpreted wrongly.  If that makes me an "ego
boy" so be it.

>	So, as of this moment, all outside email connections other than
>	to clout have been severed at chinet, and all outgoing news feeds
>	have been terminated.  Those wanting email feeds, send email
>	to rrezaian@clout.chi.il.us.  Those wanting news feeds, send
>	email to steve@simon.chi.il.us.   

I do not know why Randy is acting in a manner that seems to be intended to
punish his friends for actions on my part or the parts of others that he
might have thought (rightly, or not, it is irrelevant) slighted him.

I find this incomprehensible, and that I think is symptomatic of the
misunderstandings that abound.  I obvously don't understand what Randy was
trying to say or show here.

I would like to say that anyone inconvienienced by this is welcome to get
a  mail connection to clout, and anyone not inconvienienced by this is
ALSO welcome to get a mail connection to clout, that's why it's there.

>	Be sure you know how to kiss butt.

I do not intend to dignify this with further comment.

>
>-- 
>	I am created Shiva the Destroyer; Death, the shatterer of worlds!
>	Who is this dog meat who stands before me now?
>	That's the biz, sweetheart.
>Randy Suess					 randy@chinet.chi.il.us

For those who have not fallen asleep, or getten sick of my boring and
mistake ridden prose, I include the text of the carcker message recieved
on clout.chi.il.us.  I include it without comment, as I do not feel it
deservers being dignified by further comment.  If the person really wished
to help they would not have hidden  behind anonymity.

Begin included message:

>From hacker Fri Jan 15 05:37:47 1993
>Return-Path: <hacker>
>Received: by clout.chi.il.us (Smail3.1.28.1 #1)
>	id m0nCpCG-00047nC; Fri, 15 Jan 93 05:26 CST
>Message-Id: <m0nCpCG-00047nC@clout.chi.il.us>
>Date: Fri, 15 Jan 93 05:26 CST
>From: hacker
>To: root
>Status: OR
>
>Hello. You're probobly wondering who i am. I am knoThe best i can tell you is i am a
>hacker (or a cracker, as you may prefer). Anyways, i understand the importance
>of the machines Clout.chi.il.us and machine.chi.il.us. I am sending you this
>letter to let you know onthat on machine.chi.il.us, you have a gaping hole.
>
>By telnetting to port 25, you can fakemail from a user account (say, bin, as
>it is a hihgh lveelvelevel account) and send it thru the decode alias. If you notice,
>when you type "vrfy decode", it profduces the output:
><|/usr/bin/uudecode>
>
>Well, by sending a .rhosts file with + + as its content, you are capable of 
>rlogiiing ging in with little to  not password.
>
>To fix this, go into /etc/alias.pag and put a # in front of the decode alias.
>Do the asame for ypalias.'s alias. file.
>
>Like i said, i hiope you don't percive me as a threeat. I just know the importance
>of these machines to the *.chi.il.us domains, as on one machine, i am a usedr.
>I'm afraid that i cannot give you a means of contacting me, but if i come across
>any further security holes, i will be more than happy to mail you immediately 
>about them.
>
>Oh, on clout.chi.il.us, you may want to change the /etc/hostname/l.le0 yto something a little less guessable, as with certain utilityies, one can grab your
>copy of yppasswd.
>
>nAnyways, i hope yo udonu don't take this in the wrong way. I'm not thumbing my nose,
>i just want to help. Permissions seem to be set correctly on the systems, but
>you may want to set the ownership of many of your directorys to root, just for
>securitys sake., especially in the /usr/* directorys, as they contain many bin
>writable, but root owened igilrfiles, with chancgiving ona person a chance to create root owned
>shells...
>
>Hacker

End included message.

I hope that this whole mess ends shortly, and ends with a minimum of
further rancor.  I am already quite distressed by the damage that has been
done.  Randy Suess, a person who has done quite a lot for the Chicago net
community has been rather ill treated by the whole affair, and I for one
am not happy about how I have been treated by things either.

In fact I am downright angry.  I suspect that Randy Suess is probably as
angry as I am, he has every right to be.  I don't think anyone, with the
possible exception of the rather juvenile twit whose continued actions
have only served to inflame the situation (I speak of none other than the
"cracker") has reason to be anything other than angry.

I only hope that time and maturity of spirit, if not common courtesy will
win out.
--
Russell Rezaian			|  rrezaian@austral.chi.il.us