Shiva dial-in security loophole

Article View: comp.os.netware.connectivity

Article #46

Back to comp.os.netware.connectivity Previous Next

#46

From: Phil Schuman
Date: Fri, 21 Feb 1997 00:00

20 lines
1510 bytes

I've noticed this sequence to be a dial-in security problem - 
	- dialing into a Shiva - 

1. We don't have virtual sessions setup - but it would not matter either way - 
2. A user dials into Shiva - uses internal name list to gain access
3. Logs into Novell world - NDS or Bindery - does not matter
4. Then disconnects - BUT does not logout
5. ANY USER DIALING INTO SHIVA WILL GET CONNECTED TO THIS ACTIVE
	 AND LOGGED-IN USER SESSION
It's like an 'open desk' PC just logged-in 
waiting for someone to walk by and use it !!

Is there any way of logging out a user session 
or signalling Novell when the carrier drops on the dial-in modem ??

What are other folks doing - 
as this must be an ongoing security nightmare for remote access ??

Phil -

Technical Details

Message-ID: <5ekdpk$j9r@eve.enteract.com>

Path: arc1-ca.pugleaf.net!unknown!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: fe659,153cc7b0162b03c0,start
X-Google-Attributes: gidfe659,public
X-Google-Thread: f7e47,153cc7b0162b03c0,start
X-Google-Attributes: gidf7e47,public
X-Google-Thread: 10d5fa,153cc7b0162b03c0,start
X-Google-Attributes: gid10d5fa,public
X-Google-Thread: fa939,153cc7b0162b03c0,start
X-Google-Attributes: gidfa939,public
From: pschuman@interserv.com (Phil Schuman)
Subject: Shiva dial-in security loophole
Date: 1997/02/21
Message-ID: <5ekdpk$j9r@eve.enteract.com>
X-Deja-AN: 220426952
Content-Type: Text/Plain; charset=US-ASCII
Organization: phil's org
Mime-Version: 1.0
Newsgroups: comp.os.netware.connectivity,bit.listserv.novell,chi.internet,comp.dcom.lans.novell