Re: Passwords & telnet/ftp

John Sullivan (js10039@thor.cam.ac.uk)
Sat, 8 Jun 1996 01:51:14 +0100


In article <96Jun8.000045+1000est.65134-8404+8433@arvidsjaur.anu.edu.au> you write:
>> Use ssh. It's the best thing since sliced bread.
>
>indeed!
>
>> Heh. We can't do it that way, because then anybody could just read
>> /etc/passwd and send the proper (or rather, "improper") encrypted password
>> directly without having to worry about have to know and type the real
>> password. This is an issue even with shadow passwords, because _if_ the
>> shadow file is ever readable you're then wide open (instead of at least
>> having the normal crypt() security).
>
>Pity Microsoft didn't relise this.

And a great many other things.

Microsoft Mail also has severe security problems: it's not
client/server. To send or receive mail, you need to have full
read/write access to the mailbox you're sending to. (To send external
mail, outside of the local domain, say X.400 or SMTP email, this means
access to the *system* mailbox.) It's quite possible to delete the
whole lot by doing a DELTREE on the servers mail directory.

New versions of course implement Microsoft 'Advanced Security', which
means that whereas before the server mail directory was permanently
mounted as a DOS network drive, now you actually have to type 'MAP M:
//server/mail$' before it lets you do a DELTREE on the drive. (still
no password required.)

>Just one of the many bits of trivia you discover when implementing SMB :-)

Or trying to set up an NT server for mail and fileservice.

John

-- 
i built it up now i take it apart climbed up real high now fall down real far
no need for me to stay the last thing left i just threw it away
i put my faith in god and my trust in you
now there's nothing more fucked up i could do
<p><a href="http://callisto.girton.cam.ac.uk/users/js10039/">Me.</a>