🚀 go-pugleaf

In article <9210013.1347@mulga.cs.mu.OZ.AU> pdt@mundil.cs.mu.OZ.AU (Peter David THOMPSON) writes:

[situation deleted for brevity]

>>>He does, however, have a .rhosts entry on YY allowing him to 
>>>login from XX, and indeed, the system logs show that this 
>>>took place last night. However again, A didn't perform this login.
>>>In fact, he'd changed his password on machine XX yesterday, 
>>>and on checking through the system logs on XX which just 
>>>happen to be publicly readable, the only person using XX 
>>>at the time of the remote login, was XX's system administrator.

A question that needs to be considered is whether another accouct besides
the one to XX and YY are in the .rhosts file. If so, then breaking that 
account would give access to XX and YY also. And if this person is breaking in,
it is likely that they could cover their tracks, even with the sysadmin on,
depending on the experience of the sysadmin.

>>>Now, all questions of technical security aside, the evidence
>>>seems to point to the admin on XX impersonating A and removing 
>>>the file belonging to A.

I don't see how this can be set aside. In the US, you have to show beyond a 
reasonable doubt that something illegal happened. If this relates to some
crime be considered for prosecution, it wouldn't take more that a 3rd
year undergrad w/ an understanding of Unix to give reasonable doubt.

[stuff about australian law deleted here]

>>>	2)	If A logs in to YY from XX and uses his
>>>		program, does this give the XX admin the
>>>		right to act as he did?
>XX has the authority to do what they want on their system. The binary is
>not on their system.
>>If YY sysop deletes the binaries (or denies access by a group) there is a
>NONONO! Read the problem. It's XX who denies the use of the program. YY has
>no such restrictions. It was also XX who deleted the binary, not YY.

The way I intrepreted the problem, there is no direct evidence to establish
that XX removed the file, only the fact that he was on. Changing the 
times on files and contents of the system logs are easy for a sysadmin to
do, or more importantly, an outsider who as root priviledges (breakin).
You cannot really separate the technical questions from the ethical ones,
especially if you plan to use the results of the former in legal actions.

>Garbage. IF it was YY who had deleted the file, A would have no recompense.
>The question is: if XX (henceforth called the paranoid sysadmin, or PS)
>deletes a file ON A SYSTEM NOT UNDER THE PS's CONTROL, to enforce restrictions
>that the PS imposed on THE SYSTEM UNDER THIER CONTROL, is it moral/legal?
>
>Well, I'm not qualified to give a legal opinion, but morally:
>  * the sysadmin is entitled to take action within the limits of their power
>  and their domain to enforce their policies.
>  * YY's system is not within the domain of XX.
>  * Remote logins from XX to YY are within the domain of XX.
>  * The prohibition is on RUNNING program I.
>  Therefore, PS had no right (morally speaking) to remove the binary. The
>  only right the PS had was to remove the .rhosts file. If A had actually
>  run I from a session on XX, he would have been in trouble; but the
>  things that PS can do should be restricted to the things under their control.

It still has not been established to me that PS was one removing the file. The
evidence presented here suggests it as a possibility, but I find it very hard
to believe that this person actually did it. If the two sites are independent,
it is unlikely that PS has root access on YY. He could log into it as A, but
there would really be no reason to do so. It is more likely that the accounts
have been broken into from somewhere outside.

I do not believe that admin XX would breech the security of another system,
and maybe put his own job in danger, to remove a program. This just doesn't
seem reasonable to me, even though it might be possible.
  
[stuff deleted for brevity]

>>>If the admin didn't in fact "do it" then the question remains:
>>>		"whodunnit?" ;-)
>>Unix is not secure. There are a lot of backdoors.

Something to remember............

>># This is not legal advice. If you intend to act on these statements you should

Ditto here.

>* These opinions belong to pdt@mundil.cs.mu.OZ.AU unless otherwise specified.

-pmm

-- 
Paul M. Mickel				Internet:mickel@oes.orst.edu
Oregon State University                 UUCP: ...hplabs!orstext!mickel
Corvallis, OR 97331   USA               #include <stddisclaimer.h>