🚀 go-pugleaf

In <3pcdvo$eul@wendy.ibmpcug.co.uk>, lms@soton.ac.uk (Leslie Styles) writes:
>Is there any way to remove Supervisor from the Intruder Detection Lockout
>scheme. Although we do want to use lockout for all our user accounts, we
>don't want people to be able to lock the Supervisor account by simply
>typing login supervisor and not giving a password three times.
>

Not that I know of. However if the SUPERVISOR account is locked out the 
Console Command ENABLE LOGINS will will reset the SUPERVISOR account.

This will only affect the SUPERVISOR account and no others.

WARNING if you are using the Console Lock feature of the MONITOR.NLM any
failed attempt at the password will be taken as an attempt at the SUPERVISOR
password.

It is recommended that the SUPERVISOR password is not used for the Console
Lock password because if the SUPERVISOR account is locked you are stuck.

Hope THAT helps...

Cheers
Jim Pye
CNE/CNI
Wellington, New Zealand

eMail jtpye@ibm.net
CIS 100240,27

*** Hey!!! I've got my 32 bit multitasking OS already -- OS/2 Warp ***

Leslie Styles (lms@soton.ac.uk) wrote:
: Is there any way to remove Supervisor from the Intruder Detection Lockout
: scheme. Although we do want to use lockout for all our user accounts, we
: don't want people to be able to lock the Supervisor account by simply
: typing login supervisor and not giving a password three times.

No. Give your supervisor a 'backdoor' account - use that account to unlock the
supervisor.

Ted Slade
tedslade@kingston.ac.uk

In article <3pcdvo$eul@wendy.ibmpcug.co.uk>
   lms@soton.ac.uk (Leslie Styles) writes:
>Is there any way to remove Supervisor from the Intruder Detection Lockout
>scheme. Although we do want to use lockout for all our user accounts, we
>don't want people to be able to lock the Supervisor account by simply
>typing login supervisor and not giving a password three times.

The safest way is to create a supervisor-equivalent user (keep the 
username and password secret).  Then you can log in, run syscon to
reset the supervisor account, etc.

-------------------------------------------------------------------
Phil Randal                                philr@hwcces.demon.co.uk
Environmental Services Department
Hereford and Worcester County Council
Worcester, UK

In <3pcdvo$eul@wendy.ibmpcug.co.uk>, lms@soton.ac.uk (Leslie Styles) writes:

>don't want people to be able to lock the Supervisor account by simply
>typing login supervisor and not giving a password three times.

If people are screwing around locking out the Supervisor, it would seem to me
that they may also be screwing around making actual attempts to crack the
password, thus keeping it from locking might not be such a good idea.
However as someone else pointed out, a backdoor account might be just what
your looking for.
							Kane

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.1

mQCNAy+t/7wAAAEEAKLiAc/nuY3e9vEgzwTgDk3XmgzUCHYL8DFRjGISpdW8a2+U
JWR0/d2vUbkywZ7nWvNnAI6mhwfURogw6TVmAFDqaLsBwJg/njfLlWoWnFiWEzi0
uWDkEDM25Z+TBBYGAZLXWDpxsmIvGfeIQZdBIfAGlLaYE9dUEE4s1mB+g9A5AAUR
tA1rYW5lQHRpYWMubmV0
=bmrz
-----END PGP PUBLIC KEY BLOCK-----

Also, I believe that "enable login" at the server console will unlock 
the Supervisor account.

And I agree with you there should always be at least one 
super-equivalent account, or one other account that is MANAGER of 
Supervisor.  Most of the "network manager is gone, we don't know the 
password" problems could be avoided with strategy like this.

In article <3pcl2s$31o@mercury.kingston.ac.uk>, bs_s474@kingston.ac.uk 
says...
>
>Leslie Styles (lms@soton.ac.uk) wrote:
>: Is there any way to remove Supervisor from the Intruder Detection 
Lockout
>: scheme. Although we do want to use lockout for all our user accounts, 
we
>: don't want people to be able to lock the Supervisor account by simply
>: typing login supervisor and not giving a password three times.
>
>No. Give your supervisor a 'backdoor' account - use that account to 
unlock the
>supervisor.
>
>Ted Slade
>tedslade@kingston.ac.uk

-- 
Kevin Parris
kparris@sunbelt.net

In <3pcdvo$eul@wendy.ibmpcug.co.uk>, lms@soton.ac.uk (Leslie Styles) writes:

>don't want people to be able to lock the Supervisor account by simply
>typing login supervisor and not giving a password three times.

You can always get back in by typing "enable login" on the console.
Rconsole should work even if supervisor is locked out.

-Andrew
-- 
==========================================================
Andrew Gillham                       gillham@andrews.edu
LAN/WAN/Netware/Unix Analyst
Resume -> http://www.cs.andrews.edu/~gillham/resume.html

In article <3pchj8$fah@news-s01.ny.us.ibm.net>, jtpye@ibm.net says...
>
>In <3pcdvo$eul@wendy.ibmpcug.co.uk>, lms@soton.ac.uk (Leslie Styles) 
writes:
>>Is there any way to remove Supervisor from the Intruder Detection Lockout
>>scheme. Although we do want to use lockout for all our user accounts, we
>>don't want people to be able to lock the Supervisor account by simply
>>typing login supervisor and not giving a password three times.
>>
>
>Not that I know of. However if the SUPERVISOR account is locked out the 
>Console Command ENABLE LOGINS will will reset the SUPERVISOR account.
>
>This will only affect the SUPERVISOR account and no others.
>
>WARNING if you are using the Console Lock feature of the MONITOR.NLM any
>failed attempt at the password will be taken as an attempt at the 
SUPERVISOR
>password.
>
>It is recommended that the SUPERVISOR password is not used for the Console
>Lock password because if the SUPERVISOR account is locked you are stuck.
>
ENABLE LOGIN will clear the SUPERVISOR account from the console, but if the 
supervisor password is used to lock MONITOR, that same supervisor password 
will _still_ unlock MONITOR. (You are not hosed, as stated above). A good 
safety measure for the worst case scenario might be to get a copy of SETPWD 
from netlab2.usu.edu. Keep it on diskette, and if push comes to shove, 
power cycle the server and start the core os w/o the AUTOEXEC.NCF. Then you 
can load SETPWD to change _any_ account password.

>Hope THAT helps...
>
>Cheers
>Jim Pye
>CNE/CNI
>Wellington, New Zealand
>
>eMail jtpye@ibm.net
>CIS 100240,27
>
>*** Hey!!! I've got my 32 bit multitasking OS already -- OS/2 Warp ***

-- 
---------------------------------------------------------------------------
T.C. Wolsey -- Systems Engineer     
MCS Computerland           * The opinions expressed may not be my own, *
1762 Central Avenue     * but they may be those of my other personalities *
Albany  NY 12205                     
                                               Voice  --  (518) 452-3700
tc@albany.net                                  Fax    --  (518) 452-3939
----------------------------------------------------------------------------

remember that even if people lock the supervisor account you can get back in
by typing " enable login"

In article <3pchj8$fah@news-s01.ny.us.ibm.net> jtpye@ibm.net writes:
$WARNING if you are using the Console Lock feature of the MONITOR.NLM any
$failed attempt at the password will be taken as an attempt at the SUPERVISOR
$password.
$
$It is recommended that the SUPERVISOR password is not used for the Console
$Lock password because if the SUPERVISOR account is locked you are stuck.

   This won't help in keeping the SUPERVISOR account from being locked
out due to console unlock attempts; I'm not sure if that's what you're
suggesting or not.  Regardless of whether the console lock password is
or is not the same as the SUPERVISOR password, you can end up locking
out the SUPERVISOR account.

   When you supply a password to try to unlock the console, MONITOR first
checks to see if it's the same password you gave when you locked the
console.  If it is, the console is unlocked and no check is made against
the SUPERVISOR password.

   If the passwords don't match, then MONITOR checks against the
SUPERVISOR password.  If that's what you entered, then the console is
unlocked.  If it isn't right, though, then you have just made a failed
login attempt as far as intruder detection is concerned.

   Note that nowhere in the process does MONITOR check to see if the
password which was used to lock the console is the same as the
SUPERVISOR password.  Even if it is, if you don't type it in
correctly when attempting to unlock the console, it will still be
checked against both the MONITOR and the SUPERVISOR passwords, as
MONITOR does not know or care if they're the same.

   Note corrected list of newsgroups in the Followup-To: line.
-- 
stephen@bokonon.UUCP                     ...!{xrtll,gts.org}!bokonon!stephen
----------------------------------------------------------------------------
Stephen M. Dunn, CNE, ACE, Sr. Systems Analyst, United System Solutions Inc.
104 Carnforth Road, Toronto, ON, Canada M4A 2K7          (416) 750-7946 x251