🚀 go-pugleaf

From article <1992Nov12.084549.5128@unix.brighton.ac.uk>, by ddv@unix.brighton.ac.uk (Domenico De Vitto):
> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.


Would you like to require people to read c.s.m for a couple of months before
they're allowed to purchase a computer?

--
Jeff Stehman			Systems Staff, G-18A Jordan
stehman@cs.clemson.edu		Dept. of Computer Science
(803)656-2639			Clemson University

In article <1992Nov12.142251.9131@hubcap.clemson.edu> stehman%citron.cs.clemson.edu@hubcap.clemson.edu writes:
>From article <1992Nov12.084549.5128@unix.brighton.ac.uk>, by ddv@unix.brighton.ac.uk (Domenico De Vitto):
>> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
>
>Would you like to require people to read c.s.m for a couple of months before
>they're allowed to purchase a computer?

Now that's just rediculous... at our site there are maybe two or three
people who read c.s.m, but 90% of our (hundreds of) users know not to
use dictionary words for passwords on their /personal/ accounts, never
mind the root account.  And we're talking here about users who barely
know enough to get in and out of mail and wouldn't know Unix from Messy
Dogs.

And that's completely beside the point that somebody charged with the
responsibility for administering a multi-user computer system has a
responsibility to acquire at least some basic knowlege about security
issues.  There are dozens of good books on the subject, plus several
highly readable short summary documents available freely on the Net...
in short, the level of negligence in evidence here is inexcusable.

--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629

In article <1992Nov12.142251.9131@hubcap.clemson.edu> stehman%citron.cs.clemson.edu@hubcap.clemson.edu writes:
>From article <1992Nov12.084549.5128@unix.brighton.ac.uk>, by ddv@unix.brighton.ac.uk (Domenico De Vitto):
>> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.

>Would you like to require people to read c.s.m for a couple of months before
>they're allowed to purchase a computer?

No, I'd like too see vendors ship a decent version of password, say
npasswd.

I'd also like to see a two-three page readme on securing your
workstation, and some slightly tougher defaults, like not putting that
"+" in Sun's /etc/hosts.

Closing a few simple holes probably makes an awful lot of difference.



Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all because of elections.  How true that is.

In article <1992Nov12.142251.9131@hubcap.clemson.edu> stehman%citron.cs.clemson.edu@hubcap.clemson.edu writes:
>From article <1992Nov12.084549.5128@unix.brighton.ac.uk>, by ddv@unix.brighton.ac.uk (Domenico De Vitto):
>> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
>
>Would you like to require people to read c.s.m for a couple of months before
>they're allowed to purchase a computer?

Yes.
--scott

ddv@unix.brighton.ac.uk (Domenico De Vitto) writes:
>Any org. that has a _root_ password in _a_ dictionary gets all it deserves.

They didn't explicitly say that they cracked the root password. 
-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

He is truly wise who gains wisdom from another's mishap.

In article <1992Nov12.142251.9131@hubcap.clemson.edu> stehman%citron.cs.clemson.edu@hubcap.clemson.edu writes:
>From article <1992Nov12.084549.5128@unix.brighton.ac.uk>, by ddv@unix.brighton.ac.uk (Domenico De Vitto):
>> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
>
>
>Would you like to require people to read c.s.m for a couple of months before
>they're allowed to purchase a computer?

it would be a good idea for anyone connecting a machine to the internet
to do so, or similar.  But this would seem to be common sense ....


-- 
 Annal  Natrach, Usthvah Spethed,         carl@ecr.mu.oz.au (IRC: Bleve)
 Dochoel Dienve                           carl@munagin.ee.mu.oz.au
					  carl@montebello.ecom.unimelb.EDU.AU
 Merlin, where are you?  Call your dragon, to weave a mist...

In article <16987@umd5.umd.edu> matthews@oberon.umd.edu (Mike Matthews) writes:
>In article <1992Nov12.142251.9131@hubcap.clemson.edu> stehman%citron.cs.clemson.edu@hubcap.clemson.edu writes:
>>Would you like to require people to read c.s.m for a couple of months before
>>they're allowed to purchase a computer?
>
>There is a *BIG* *DIFFERENCE* between buying a computer and running a Unix
>system, especially one that's got classified information on it (at least,
>stuff that the public should NOT see).  Imagine a convicted killer going free
>because his file's been tampered with.
>
>And IF someone is running those systems, they had damn well BETTER know how
>to make the systems secure.  There should be *NO* passwords that are easily
>guessable (ideally), but *DEFINITELY* not the root one.
>
>>Jeff Stehman			Systems Staff, G-18A Jordan
>>stehman@cs.clemson.edu		Dept. of Computer Science
>>(803)656-2639			Clemson University
>------
>Mike Matthews, matthews@oberon.umd.edu (NeXTmail accepted)
>------
>Whenever you find that you are on the side of the majority, it is time
>to reform.
>		-- Mark Twain

A little note:  Because of the foibles in UNIX security, you would be a
*FOOL* to connect up a computer with your business's vital records or
trade secrets to the internet directly.  The best way to protect
sensitive data is to have the computer not connected to any network,
or to hide it behind at least two firewalls, one specially created to
block all incoming stuff, except for mail and news.  (Even that is
not secure...  Remember the debug mode in SendMail a couple of years
back...  The worms crawled in, the worms crawled out :-)

I am not a security expert, but if you are so horribly worried about
some data, keep it on a seperate computer safely locked up with Medeco
locks on the door, and good metal doors.  Internet connections can be
given to another computer for receiving mail, etc.

Here is another item:  If the data is vital, back it up, and store
the data and the backups on removable media.  Then, when you leave,
store the original in a safe that is bolted down, and store the backups
in a secure area, like a safety deposit box at your local bank.  This
method will secure from basically everything but scavenging for
palempsits (spelling?), or putting the operator under duress.

Any other ideas?

-- 
********** ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) **********
Windows NT:                  * Disclaimer:  I speak for myself *
                             ***********************************
You WANT your hard drive trashed now.

In article <84008@ut-emx.uucp>, ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
[lots deleted]
|>Here is another item:  If the data is vital, back it up, and store
|>the data and the backups on removable media.  Then, when you leave,
|>store the original in a safe that is bolted down, and store the backups
|>in a secure area, like a safety deposit box at your local bank.  This
|>method will secure from basically everything but scavenging for
|>palempsits (spelling?), or putting the operator under duress.
|>
|>Any other ideas?

In a lot of places it is standard practice to make _two_ backups.  One is
used for day-to-day restores and is stored somewhere handy, normally near
the computing system.  The other is taken off-site and held somewhere really
safe, like a bank or a firesafe.  This is very similar to the previous
poster's idea, except that it doesn't need the original data to be stored
on removable media.  Incidentally, it's a good idea to invest in a firesafe
and make sure that at least one copy of your backups is put in it.

If you think that this is all way too much, just ask yourself one question -
how long would your company last if all the data from your computer system
disappeared?

Lezz Giles

In article <1992Nov13.195515.19232@jato.jpl.nasa.gov> dave@jato.jpl.nasa.gov writes:
>ddv@unix.brighton.ac.uk (Domenico De Vitto) writes:
>>Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
>
>They didn't explicitly say that they cracked the root password. 

>>filed with the charges stated. ``He then transferred the password file
>>to a Boeing Company computer, where he decrypted the passwords.''
>>      That process gave Anderson the ``root'' password, which allowed

If decrypting the passwords gave him the root password, then yes, Dave,
they cracked the root password.

>>>Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
>>
>>They didn't explicitly say that they cracked the root password. 
>
>>>filed with the charges stated. ``He then transferred the password file
>>>to a Boeing Company computer, where he decrypted the passwords.''
>>>      That process gave Anderson the ``root'' password, which allowed
>
>If decrypting the passwords gave him the root password, then yes, Dave,
>they cracked the root password.

  Oh, come on... what do you think is more likely: these two kids
broke the DES encryption scheme, or the newspaper confused decrypting
with running the encryption on a /usr/dict/words file and greping
it with the /passwd file.
  I'll grant you they cracked the root, and thus system, but unless
I see some more details I'm going to be really skeptical of claims
they came up with the inverse DES function.

                                      -- Nick


-- 
   _/   _/  _/  _/_/_/   _/   _/  Sea Shells to C shells,  Waikiki to
  _/_/ _/  _/  _/   _/  _/_/_/     the Internet, a wave, is a wave...
 _/ _/_/  _/  _/       _/ _/                     
_/   _/  _/   _/_/_/  _/   _/  CompSrv: 71232,766 * I-Net: Nick+@pitt.edu

In article <1992Nov12.084549.5128@unix.brighton.ac.uk>, ddv@unix.brighton.ac.uk (Domenico De Vitto) writes:
> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
> 
> Dom

Any company that uses a braindead operating system that makes passwords readable
in encrypted form in the first place is braindead.

50,000 crypts per second in FORTRAN on a Cray sounds nice. I have played
with much faster machines than that though, imagine what the CRAY will
do once it has the bucket of Alpha chips bolted on... say a 1024 point
array running 200 Mips... Exhaustive search starts to look quite 
feasible.

If a computer is delivered in an unsecure state IT IS THE MAUFACTURERS
FAULT!

We should NOT go arround patching up garbage, especialy when the garbage
costs a significant amount of money. I for one don't see why I should
spend time patching a $2000 operating system.

It's one thing for a manufacturer to screw up and throw out a security
flaw. But the open password file has been present in UNIX for ten years.

AND I DO KNOW THAT A "PROTECTED" PASSWORD FILE IS NOT SAFE EITHER !

But I DO Know that it is a damn sight safer, especialy when there is
a pinhead sysop.

In the real world computers have to be built for pinheads. People
who try to sell a product that requires intelligence to operate it
are not going to sell much.

I for one would rather spend my time learning about something a
bit more interesting than the failings of 1970's spaghetti code
operating systems.


Phill Hallam-Baker
With 10 years UNIX experience I have the right to say it sucks.

stanley@skyking.OCE.ORST.EDU (John Stanley) writes:
>>>filed with the charges stated. ``He then transferred the password file
>>>to a Boeing Company computer, where he decrypted the passwords.''
>>>      That process gave Anderson the ``root'' password, which allowed
>If decrypting the passwords gave him the root password, then yes, Dave,
>they cracked the root password.

"That process gave Anderson the root password". That could also mean
that by getting a random account on the machine they _acquired_ root
access, and then changed the password. 
-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

Penitent (adj.) - 1. Someone who has been made incapable of enjoyment.

zeus@vxcrna.cern.ch writes:

>Any company that uses a braindead operating system that makes passwords readable
>in encrypted form in the first place is braindead.


>In the real world computers have to be built for pinheads. People
>who try to sell a product that requires intelligence to operate it
>are not going to sell much.

The design of the Unix password was deliberately open so people wouldn't
think they were safe ( eg using cat as a password) when they were not.
Yes it is time that a new password algorithm were produced tha cannot be
cracked as "easily" as the unix one, but hiding the passwords isn't the
answer. ( so someone getws ahold of one of your backup tapes and there
are the passwords in all their (encrypted) glory- then what do you do.
And if you want the computer designed for pinheads, they are presumably
precisely the ones who would let someone get a copy of their backup
tape.