110 lines
4.4 KiB
Plaintext
110 lines
4.4 KiB
Plaintext
|
NETWORK SECURITY SUPPLEMENTAL INFORMATION - PROTECTING THE DECNET ACCOUNT
|
|||
|
|
|
|||
|
|
The most important thing that needs to be done to protect a system
|
|||
|
|
against the current WORM attacks is to modify accounts where
|
|||
|
|
USERNAME=PASSWORD. This is the default configuration for the DECNET
|
|||
|
|
account. This can be changed easily, but there appears to be some
|
|||
|
|
confusion about the effect that this has on a network. Changing the
|
|||
|
|
DECnet default password DOES NOT IMPACT the normal operation of DECnet
|
|||
|
|
in any way.
|
|||
|
|
--------
|
|||
|
|
|
|||
|
|
The following section provides some background material to illustrate
|
|||
|
|
this point:
|
|||
|
|
|
|||
|
|
On your system, issue the following commands from a priviliged
|
|||
|
|
(CMKRNL,BYPASS,SYSPRV) account:
|
|||
|
|
|
|||
|
|
$MCR NCP (or $RUN SYS$SYSTEM:NCP)
|
|||
|
|
NCP> show executor characteristics
|
|||
|
|
|
|||
|
|
This will produce a list that resembles the following:
|
|||
|
|
|
|||
|
|
|
|||
|
|
Node Volatile Characteristics as of 31-OCT-1989 11:02:23
|
|||
|
|
|
|||
|
|
Executor node = 6.133 (NSSDCA)
|
|||
|
|
|
|||
|
|
Identification = DECnet-VAX V4.7, VMS V4.7
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
Nonprivileged user id = DECNET
|
|||
|
|
Nonprivileged password = DECNET
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
.
|
|||
|
|
|
|||
|
|
This is your DECnet executor database. The information listed is the
|
|||
|
|
default configuration for your node. The information contained in this
|
|||
|
|
list includes "Nonprivileged user id" and "Nonpriviliged Password".
|
|||
|
|
|
|||
|
|
This information is what DECnet uses for userid/password when the
|
|||
|
|
connecting process a)does not have a proxy, b)does not specify a
|
|||
|
|
username/password as part of the access string, and c)does not
|
|||
|
|
have a different userid/password defined for the network object
|
|||
|
|
being invoked.
|
|||
|
|
|
|||
|
|
The access information contained in the executor database is used for
|
|||
|
|
reference only. The candidate userid and password (in this case DECNET
|
|||
|
|
and DECNET respectively) are then passed to LOGINOUT to validate them
|
|||
|
|
against the *REAL* information contained in SYSUAF.DAT. If the
|
|||
|
|
information matches, the access is allowed. If the information does not
|
|||
|
|
match, the connecting user gets the following error messages:
|
|||
|
|
|
|||
|
|
Unable to connect to listner
|
|||
|
|
Login Information Invalid at Remote Node
|
|||
|
|
|
|||
|
|
--------
|
|||
|
|
|
|||
|
|
In order to correctly change your default network password so that your
|
|||
|
|
system cannot be easily exploited by the current DECnet WORM, the
|
|||
|
|
following 2 steps must be followed:
|
|||
|
|
|
|||
|
|
1) Change the password for user DECNET in SYSUAF.DAT:
|
|||
|
|
|
|||
|
|
UAF> modify DECNET/Password=NEW_DECNET_PASSWORD
|
|||
|
|
|
|||
|
|
*NOTE*
|
|||
|
|
It is advisable at this time to check that
|
|||
|
|
certain other attributes of the DECNET user
|
|||
|
|
are properly set:
|
|||
|
|
|
|||
|
|
The ONLY access method for this account should
|
|||
|
|
be NETWORK. The BATCH, REMOTE, INTERACTIVE,
|
|||
|
|
and DIALUP fields should all read "--no access--"
|
|||
|
|
|
|||
|
|
The value of PRCLM should be set to ZERO. This is
|
|||
|
|
the number of (SPAWNed) sub-processes allowed.
|
|||
|
|
|
|||
|
|
The flag LOCKPWD should be set. This prevents
|
|||
|
|
anyone but a priviliged user from changing the
|
|||
|
|
password. The following command can be used:
|
|||
|
|
|
|||
|
|
UAF> MOD DECNET/FLAGS=LOCKPWD/PRCLM=0/NOBATCH/NODIAL/NOINTER/NOREM/NETW
|
|||
|
|
|
|||
|
|
|
|||
|
|
2) Change the password for DECNET in your network executor database:
|
|||
|
|
|
|||
|
|
NCP> set exec nonpriviliged password NEW_DECNET_PASSWORD
|
|||
|
|
NCP> define exec nonpriviliged password NEW_DECNET_PASSWORD
|
|||
|
|
|
|||
|
|
The important thing to remember is that the password must be changed in
|
|||
|
|
BOTH places, otherwise your network WILL break. The worm is breaking
|
|||
|
|
nodes by penetrating the DECNET account, and changing only the UAF
|
|||
|
|
password with the $SET PASSWORD command. By not changing the NCP
|
|||
|
|
password, the network no longer accepts INBOUND connections.
|
|||
|
|
|
|||
|
|
For more information, consult the VAX/VMS manuals:
|
|||
|
|
|
|||
|
|
VMS V4.X - Volume 6 "Networking Manual"
|
|||
|
|
VMS V5.x - Volume 5A&5B "Guide to DECnet-VAX Networking"
|
|||
|
|
---------------------------------------------------------------------------
|
|||
|
|
Ron Tencati | NCF::TENCATI /6277::TENCATI
|
|||
|
|
SPAN Security Manager | Tencati@Nssdca.gsfc.nasa.gov
|
|||
|
|
NASA/Goddard Space Flight Center | (301)286-5223
|
|||
|
|
Greenbelt, MD. USA |
|
|||
|
|
---------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|