Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!ucsd!ucbvax!GARNET.BERKELEY.EDU!rusty
From: rusty@GARNET.BERKELEY.EDU (rusty wright)
Newsgroups: comp.unix.ultrix
Subject: ultrix 4.0 enhanced security
Message-ID: <9008300308.AA06175@garnet.berkeley.edu>
Date: 30 Aug 90 03:08:08 GMT
Sender: daemon@ucbvax.BERKELEY.EDU
Lines: 23

I have some questions/problems regarding the 'Enhanced Security' of
Ultrix 4.0 and am hoping that someone out there can help.  I've
installed Ultrix 4.0 and the Mandatory Upgrade.

1) When I try to use the 'su' command from a DECterm window it won't
let me and says 'Requires secure terminal'.  I'm assuming that I could
fix this by putting 'secure' for each of the ttyp and ttyq lines in
/etc/ttys since that's what the su man page says.  This seems just a
trifle bogus since by doing that I would potentially be allowing
people to login (or attempt to if they're a cracker) as root over the
network with rlogin or telnet.  Can I get rid of this 'feature' be
configuring my system with Upgrade Security instead of Enhanced
Security?  Or does anybody know how to get rid of it besides adding
the 'secure' flag to each of the network tty lines in /etc/ttys?

2) I can't find anything in any of the documentation about either how
to or if I can downgrade from Enhanced Security to Upgrade Security.
The manual page for secsetup only says that secsetup is used to
'enable the enhanced security features' and nothing about disabling
them.  The reason I need to downgrade my security level is that it
turns out that Ultrix/SQL doesn't work with Enhanced Security.  Does
anybody know of any other add-on/layered products that don't work with
Enhanced Security?