110 lines
4.4 KiB
Plaintext
110 lines
4.4 KiB
Plaintext
NETWORK SECURITY SUPPLEMENTAL INFORMATION - PROTECTING THE DECNET ACCOUNT
|
||
|
||
The most important thing that needs to be done to protect a system
|
||
against the current WORM attacks is to modify accounts where
|
||
USERNAME=PASSWORD. This is the default configuration for the DECNET
|
||
account. This can be changed easily, but there appears to be some
|
||
confusion about the effect that this has on a network. Changing the
|
||
DECnet default password DOES NOT IMPACT the normal operation of DECnet
|
||
in any way.
|
||
--------
|
||
|
||
The following section provides some background material to illustrate
|
||
this point:
|
||
|
||
On your system, issue the following commands from a priviliged
|
||
(CMKRNL,BYPASS,SYSPRV) account:
|
||
|
||
$MCR NCP (or $RUN SYS$SYSTEM:NCP)
|
||
NCP> show executor characteristics
|
||
|
||
This will produce a list that resembles the following:
|
||
|
||
|
||
Node Volatile Characteristics as of 31-OCT-1989 11:02:23
|
||
|
||
Executor node = 6.133 (NSSDCA)
|
||
|
||
Identification = DECnet-VAX V4.7, VMS V4.7
|
||
.
|
||
.
|
||
.
|
||
Nonprivileged user id = DECNET
|
||
Nonprivileged password = DECNET
|
||
.
|
||
.
|
||
.
|
||
|
||
This is your DECnet executor database. The information listed is the
|
||
default configuration for your node. The information contained in this
|
||
list includes "Nonprivileged user id" and "Nonpriviliged Password".
|
||
|
||
This information is what DECnet uses for userid/password when the
|
||
connecting process a)does not have a proxy, b)does not specify a
|
||
username/password as part of the access string, and c)does not
|
||
have a different userid/password defined for the network object
|
||
being invoked.
|
||
|
||
The access information contained in the executor database is used for
|
||
reference only. The candidate userid and password (in this case DECNET
|
||
and DECNET respectively) are then passed to LOGINOUT to validate them
|
||
against the *REAL* information contained in SYSUAF.DAT. If the
|
||
information matches, the access is allowed. If the information does not
|
||
match, the connecting user gets the following error messages:
|
||
|
||
Unable to connect to listner
|
||
Login Information Invalid at Remote Node
|
||
|
||
--------
|
||
|
||
In order to correctly change your default network password so that your
|
||
system cannot be easily exploited by the current DECnet WORM, the
|
||
following 2 steps must be followed:
|
||
|
||
1) Change the password for user DECNET in SYSUAF.DAT:
|
||
|
||
UAF> modify DECNET/Password=NEW_DECNET_PASSWORD
|
||
|
||
*NOTE*
|
||
It is advisable at this time to check that
|
||
certain other attributes of the DECNET user
|
||
are properly set:
|
||
|
||
The ONLY access method for this account should
|
||
be NETWORK. The BATCH, REMOTE, INTERACTIVE,
|
||
and DIALUP fields should all read "--no access--"
|
||
|
||
The value of PRCLM should be set to ZERO. This is
|
||
the number of (SPAWNed) sub-processes allowed.
|
||
|
||
The flag LOCKPWD should be set. This prevents
|
||
anyone but a priviliged user from changing the
|
||
password. The following command can be used:
|
||
|
||
UAF> MOD DECNET/FLAGS=LOCKPWD/PRCLM=0/NOBATCH/NODIAL/NOINTER/NOREM/NETW
|
||
|
||
|
||
2) Change the password for DECNET in your network executor database:
|
||
|
||
NCP> set exec nonpriviliged password NEW_DECNET_PASSWORD
|
||
NCP> define exec nonpriviliged password NEW_DECNET_PASSWORD
|
||
|
||
The important thing to remember is that the password must be changed in
|
||
BOTH places, otherwise your network WILL break. The worm is breaking
|
||
nodes by penetrating the DECNET account, and changing only the UAF
|
||
password with the $SET PASSWORD command. By not changing the NCP
|
||
password, the network no longer accepts INBOUND connections.
|
||
|
||
For more information, consult the VAX/VMS manuals:
|
||
|
||
VMS V4.X - Volume 6 "Networking Manual"
|
||
VMS V5.x - Volume 5A&5B "Guide to DECnet-VAX Networking"
|
||
---------------------------------------------------------------------------
|
||
Ron Tencati | NCF::TENCATI /6277::TENCATI
|
||
SPAN Security Manager | Tencati@Nssdca.gsfc.nasa.gov
|
||
NASA/Goddard Space Flight Center | (301)286-5223
|
||
Greenbelt, MD. USA |
|
||
---------------------------------------------------------------------------
|
||
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|