Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!zaphod.mps.ohio-state.edu!sol.ctr.columbia.edu!cunixf.cc.columbia.edu!cs.columbia.edu!abrams
From: abrams@cs.columbia.edu (Steven Abrams)
Newsgroups: comp.sys.novell
Subject: Re: Auto backups to tape
Message-ID: <ABRAMS.90Dec6181150@division.cs.columbia.edu>
Date: 7 Dec 90 00:11:50 GMT
References: <826@macuni.mqcc.mq.oz> <1990Dec6.053018.17389@qiclab.uucp>
Sender: news@cs.columbia.edu (The Daily News)
Organization: Columbia University Department of Computer Science
Lines: 66
In-Reply-To: leonard@qiclab.uucp's message of 6 Dec 90 05:30:18 GMT

dbielik@sunb.mqcc.mq.oz.au (Danny Bielik) writes:
<I am running Novell ELS II V2.12 in Non-dedicated mode, and I have it set up so
<that there is an account whose sole purpose is to wait for 1am and then do a 
<full backup to tape.

<Now, I have this problem, where, whilst it is waiting for a backup, someone
<can come along and CTRL-C and break into an account with full supervisor
<priveleges.  Now I need a way to disable CTRL-C and CTRL_BREAK in order to
<stop anyone from doing this.  I also don't want any TSR memory overhead, so it
<has to be a program that is run then finished, not stay-resident.

A solution would be to run a program which waits until 1:00 AM and
then logs in as the backup account -- the backup account then gets
its login script re-written a bit so that it doesn't wait -- it just
always does the full backup.   This solves the problem of having the
machine hang out logged into supervisor, although if you bang on ^C
enough during backup, you can get out and be supervisor.

There's another security issues you might want to consider for this
setup: 

If a user sets the clock on his personal machine to be 12:58 AM and
logs in as this backup user, the backup software may abort in a way
that permits him/her to ^C out of it before the login script logs him
out.  Voila, anyone can use this account to become supervisor.

Solution:  Use the setup described above, where the account doesn't
wait, it does the backup, and restrict this account to be able to
login ONLY between 12:55 AM and 1:05 AM and ONLY from the machnine(s)
with the tape drive.    Time and Station account restrictions were new
in Novell ANW 286 v2.15, and I believe they exist in ELS as well.  I
never touched the stuff, so I'm not sure.

As for solving the Ctrl-C problkeem, try this:

Write a program that installs a bogus keyboard driver (latch on to the
keyboard hardware interrupt at the lowest level) that chucks any keys
typed and does nothing with them.  This would be an absolutely TINY
TSR, i.e. < 1k, if written in ASM. The first command in the login
script for this backup user should load this bogus driver.  Also, you
might want to put this in the batch file that logs in as the backup
account.  Afterwards, run a de-install program that restores the
keyboard driver.   

Cobining all methods described above leaves one remaining security
hole, which is: 

A user gets physical access to the machine with the tape backup
between 12:05 and 1:05 AM, logs in as the backup user and manages to
bang on ^C sufficiently hard and often to cause the login to be broken
out of sometime after connection established and BEFORE the login
script is actually started.  

Of course, station+time restrictions on the account plus a locked door
on the machine is probably the best solution...

~~~Steve

--
/*************************************************
 *
 *Steven Abrams             abrams@cs.columbia.edu
 *
 **************************************************/
#include <std/dumquote.h>
#include <std/disclaimer.h>