🚀 go-pugleaf

I believe that I've got a security problem in the making and would
appreciate any advice that net.wisdom might be able to provide.  I
am administering a growing network of 386 machines running Sys V rel
4 UNIX.  We will likely form an internetwork with several other
companies in the next few months. (And I hope to have them connected
with the rest of the world in the near future.)
 
There is a product that, due to decisions made from on high, did not
receive more than cursory scrutiny before purchase.  Unfortunately,
this package, which "handles all of its security internally," specifies
that all of its files and directories must bear rwxrwxrwx permissions,
that is except for the two executables owned by root that have the 's'
bit set for the owner.  Perhaps I'm missing something, but not only
are they leaving the barn door open, they seem to have forgotten to
build the barn in the first place.
 
I tried to point out the dangers involved with such permissions, not
only for direct attacks on root, but due to the very fact that all
the accounting data is world accessable and easily vulnerable to
corruption and erasure attacks, even if they bothered to encrypt their
data.  I suggested some simple solutions (eg: setuid to their specified
uid rather than root), but was told that it was "not an application
problem" but a "system problem."  Furthermore, I was told that "all
users access a UNIX system through a menuing program" and that they
should "never have shell access!"  I gather that these are nice DOS
and Novell people, that have done the minimum to get their package
running under UNIX. ( To quote the nice lady, "I've never heard of
TCP/IP." )
 
I am limited by lack of handy reference materials at this job, and
was wondering if some folks could provide a few pointers to published
(via network or book) materials that I might point them to for an
education, or suggest ways to adaquately encapsulate this nightmare.
(I'm toying with a couple of ideas, but am by no means satisfied with
them yet.  I'm really leaning toward having them return the package.)
 
Thanks in Advance,
Paul J. Mech


 This is from
     mech@bluemoon.rn.com
who doesn't have his (or her) own obnoxious signature yet