Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uwm.edu!csd4.csd.uwm.edu!jeffd
From: jeffd@csd4.csd.uwm.edu (Jeffrey Alan Ding)
Newsgroups: comp.sys.novell
Subject: Re: Security
Message-ID: <11467@uwm.edu>
Date: 27 Apr 91 03:29:05 GMT
References: <"910426181402.75470.3414.EHL28-1"@CompuServe.COM>
Sender: news@uwm.edu
Organization: University of Wisconsin - Milwaukee
Lines: 23

In article <"910426181402.75470.3414.EHL28-1"@CompuServe.COM> 75470.3414@CompuServe.COM (Suzanne Villemaire) writes:
>What's a good way to make a back door for a netware 386 v.3.1 single
>server lan.
>


Add Supervisor to the managed users or groups field for your name.  That
way, you can make yourself a supervisor any time you want.  I also don't
think the security program picks it up.  The v2.15 security doesn't.  This
trick works even better with v2.15 because the current v2.15 that has been
shipping doesn't include a syscon that uses the work group manager stuff.
Of course, you have to be supervisor in the first place to do what I
suggest.  But if you ever subsequently lose supervisor privilage, there is
your quick back door.

I know this trick works with v2.15 but it would be interesting to see it
also works with 3.11.  I don't have 3.11 so anyone out there want to
try it out?

This is a grave bug in security if you ask me, cause nothing reveals it
and the only way you can find out is to look at every user individually.

jeffd@csd4.csd.uwm.edu