🚀 go-pugleaf

In article <1992Nov16.140459.1543@ornl.gov> h23@ORNL.GOV (HEIN JR R C) writes:
> If the person(s) who stold the machine look at this group, then they have
> all the information they need to break the security of the machine.  
> 
> PLEASE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
> 
> Don`t post everything, if you must know the details e-mail someone,
> don't just leave it sit so anyone can read it.
> 
> The odds are that the person(s) who stold this cube will not read this, 
> but what if I was a planning to steal a cube.  I now know how to get 
> around the root password.
> 
> PLEASE!!!!!!!!!!!   make life easier on those of us trying to make
> security better, and use discression when posting.
> 

If they know how to use the net, then they probably are computer literate and  
will know how to use the on-line documentation to find out how to change the  
password.


--
Robert John Andersen           
(919) 380-6523 (v,w)
andersen%reality@glv.com - NeXT mail!

Outside of a dog, a book is man's best friend.
Inside of a dog it's too dark to read.

>>>>> "Richard" == HEIN JR R C (h23@ORNL.GOV)

Richard> PLEASE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Richard> Don`t post everything, if you must know the details e-mail someone,
Richard> don't just leave it sit so anyone can read it.

Security by obfuscation does not work, it never did, and it never
will. 

If you have access to the metal you can *always* get at everything in
the box, do anything, get any type of access. The procedures for doing
so on all kinds of platforms are "public knowledge", readily
accessible to everyone who wants it and available from a great number
of sources.

Anyone who owns a computer has a legitimate need to have this
information and vendors should *always* print it in the *standard*
documentation. When you forget your root and hardware password, we all
know it will happen saturday night in a panic situation with a
life-or-death deadline monday morning. Make sure you know how to
handle this *before* you need to do it.

Trying to keep the procedure for handling these things secret is
folly. There are simply too many people out there who need to know. I
understand that people feel bad about their stolen property, but this
is not and never was never the goal of having root or hardware
passwords.  Hardware password exist so that you can make workstations
publicly available and not worry too much about people becoming root
by rebooting the box.

Getting around these things takes at most 30 minutes, including taking
the box apart. It must be so since I, as an owner, must be sure that I
can always get a my box.

The fact that hardware passwords does not give you much in the way of
protection and that well prepared people can get around it quickly is
something else again. Never trust a machine that people can touch.
Never.

/Lars
--
Lars Fischer, fischer@iesd.auc.dk | It takes an uncommon mind to think of
CS Dept., Aalborg Univ., DENMARK. | these things.  -- Calvin