At 11:14 12/08/97 +0300, dimitriou wrote:
>According to my knowledge, NetLogon uses the 'Workstation Trust 
>Accounts' to establish the secure communications channel.
>
>Does anyone know how these accounts are established, and especially
>how the passwords are initially exchanged ?
>
>Microsoft's Windows NT Resource Kit describes the establishment of 
>the 'Interdomain Trust Account' and says that a similar process 
>is used for the Workstation Trust Accounts. However, even in this 
>example, the initial password exchange is not "very clearly" documented.
>
>My assumption is that the Workstation sends the (randomly) generated 
>password in clear to the PDC when it joins the domain for the first 
>time, which I think is quite insecure (e.g. LAN sniffing).

The machine account password starts out as the hostname restricted to 14
characters. It is then changed on the first reboot after joining the domain
and then weekly thereafter. The current value can be extracted by running
lsadump $machine.acc from:
http://www.ntbugtraq.com/SCRIPTS/WA.EXE?A2=ind9708&L=ntbugtraq&D=1&P=1230

If you capture the first secure channel creation and rc4 encrypted
session and every password change thereafter, you have enough information
(I believe) to forge SIDs etc by pretending to be the DC. The machine
password won't be available in the clear though.

Paul
 From: Eric Germann [SMTP:ekgermann@cctec.com]
 Sent: Tuesday, August 12, 1997 12:27 AM
 To: Ray Arachelian
 Cc: Cornelis van der Laan; ntsecurity@iss.net
 Subject: RE: [NTSEC] double sid's installing workstations

 At 05:47 PM 8/11/97 -0400, Ray Arachelian wrote:

 >Any reason why a machine's SID can't be altered, and any keys
that depend
 >on that SID be altered too?
 >

 Only the fact you would have to change all the underlying keys
on the
 entire NTFS file system, all the security on registry keys,
etc....

 Is this a time consuming operation? What happens when you add an
NTFS formatted drive to an existing system? I guess I still don't
understand exactly what is affected or influenced by the SID.

 --- Gavin Adams
Paul,

Can you then comment on the Download Wizard available from
http://www.microsoft.com/kb/softlib/default.asp which supposedly detects
which files/patches etc... you need and automates the installation of
these? I haven't tried it with a machine that was "Ok" in its eyes, so I
haven't seen what it actually does, but the concept is quite cool for
Intranet server management. Would seem to be parts of SMS for Intranets,
which despite having risks that would have to be managed, could
seriously improve the remote configuration management of machines.

Can you get someone to comment for us as to precisely what it does and
how it does it? Is the underlying dB available with some instructions on
how we might modify it for our own use?

I'm asking on behalf of the list because I think this would seem to be
the answer to this thread's questions.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list: http://www.ntbugtraq.com

>1) Does anyone know secure this protocol really is?

You should consider augmenting the authentication component with SecurID
or any other one-time token authentication device which can function
over NT RAS.

>2) Am I correctly reading the usage of PPTP?

Yes, this is what PPTP was designed to do. PPTP is actually a couple of
protocols combined. Standard PPP is used for the actual data and session
management within a Generic Routing Encapsulation (GRE) session which is
controlled independently of the PPP session. TCP1723 constructs the GRE
tunnel (which is not encryption) within which the PPP session is
constructed and maintained. The PPP authentication and data can be
encrypted as Steve said, with 40 or 128-bit RC4. The authentication,
done within the PPP session, is done using normal NT-client mechanisms
(meaning it might be a LanMan hash being sent). Since client and server
can negotiate encryption for authentication prior to authenticating, the
hash is being sent within an encrypted PPP session with the server.

If access filtering is not used at the server, its possible then for an
attacker to attempt to authenticate with it, and the server will attempt
to validate the user. Since your sites are known to you, and you haven't
mentioned the need for roving access, I'd suggest that you have each of
your remote offices obtain a static IP address from their local
providers (should not be a considerable additional cost if any) so that
you can do access-filtering on TCP/UDP1723 and IP Protocol 47 (if
possible) to prevent your server from talking to any addresses other
than those you are aware of.

>3) Does anyone see an obvious glitch that I am overlooking? Seems too
good to be true as advertised.

The obvious glitch is that you have no supplied mechanism to filter the
traffic done with the PPTP client. You have no built in monitoring of
client activity, nor any way to filter what activity that client can do
(beyond putting a filtering device between the NT PPTP server and the
rest of your network).

Its relatively weak authentication makes it less desirable than other
solutions (i.e. Check Point SecuRemote, V-One SmartGate) for such
complete access.

OTOH, its an extremely simple way of connecting multiple MS-based sites
for NetBIOS access since its a tunnel not proxies or relays.

>4) What does PPTP cost in terms of data transmission speed?

I don't have exact figures, but there is some overhead associated with
the GRE packets (both in terms of CPU and bandwidth). More CPU if the
PPP is encrypted. However, PPP has the ability to be compressed, and
this is used within the GRE tunnel to, more or less, offset any
overhead. My testing, as with Jiva's, suggest that it is actually as
efficient as a normal 28.8 modem with compression.
---------
VPNs are wonderful things and can considerably reduce the cost of
maintaining a WAN. However, you have to consider the value of the data
you are permitting to be transmitted. If you have no method of
controlling what is traversing your VPNs, and your internal security
policies do not restrict access to information contained on your
systems, then you are essentially saying that any data within any of
your offices can be transmitted across this VPN.

Given that assumption, you have to then consider the life of the data.
Someone's criminal record, for example, has a life-span equal (or
possibly greater than) the person's life-span. Any location which this
data may reside should then be secured appropriately, i.e. it needs to
be secured for the person's life-span. If you make that data available
to the Internet (encrypted within an encapsulated channel), where in
that form it can be captured by unknown sources, the question then
becomes how long will it take for that data to be decrypted.

Strong authentication is crucial of course, but even strong
authentication will place the data in the public. If the encryption
methods are not strong enough on the data, your strong authentication is
doing only have of what's needed. With stories about criminal activities
from 30 or more years ago haunting some politicians, its obvious that
sources might pay to have data captured that might take 1, 2, or even 10
years to decrypt.

Encryption methods that use changing keys is essential, as are the use
of ciphers that are extremely long and complex.

If your traffic can be limited to administrative data that has a short
value-life, then I'd say that PPTP is probably adequate for your needs
(with stronger authentication). Otherwise, consider Check Point
SecuRemote. SmartGate requires a Firewall in addition to itself, as does
the Altavista Tunnel. Both offer alternatives to SecuRemote which have
to be judged within the full context of your needs. Recognize that IPSec
should be coming within the next 6 months and when it does, it will
replace (for free) much of the value of a proprietary tunnel server.
Obviously these tunnel vendors (Digital and V-One, etc...) will do
everything in their power to provide functionality beyond what IPSec
offers. Whether IPSec has any value within your environment is a matter
of deciding whether or not you think you might extend your Extranet
beyond organizations under your complete funding and control. If so,
then IPSec (or some value-added implementation) is likely the way you
want to go.

> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list: http://www.ntbugtraq.com
> 
Treu, Jill S wrote:
> 
> Does anyone know of a way to recover/reset a lost/forgotten local
> Administrator password without re-installing?
> 
> There must be a way to get around the security???
> 
> jill.s.treu@jci.com

IF FAT:
1. Boot machine to DOS
2. Delete %System32\Config\SAM
3. Reboot the machine. 

IN NTFS:
1. Install NT in a different directory
2. Boot to new NT installation
3. Delete old installation's %System32\Config\SAM
4. Reboot to old installation
5. Delete new installation from file system and BOOT.INI

All passwords and accounts will be reset to installation defaults.

http://home.eunet.no/~pnordahl/ntpasswd/

The free-ist, easiest, utility I've found to do it.

Greg...

> -----Original Message-----
> From: Treu, Jill S [SMTP:Jill.S.Treu@jci.com]
> Sent: Monday, August 11, 1997 1:40 PM
> To: ntsecurity@iss.net
> Subject: 
> 
> 
> 
> 
> Does anyone know of a way to recover/reset a lost/forgotten local
> Administrator password without re-installing?
> 
> There must be a way to get around the security???
> 
> 
> jill.s.treu@jci.com
> 
> Use scopy from the resource kit

Is there a version which emulates xcopy, or is there a better way to
replicate multiple directory structures? The benefit of xcopy is
the output which we use to maintain a database of changed files.

I've played with directory replication and that may be a possibility now
that I know there is a registry key for changing the frequency of
updates...

Ta,

Kevin

I just tried it and all it said I needed was the additional OutLook
converters. It lets you choose what to add.... seems harmless.

Jason

> -----Original Message-----
> From: Russ [SMTP:Russ.Cooper@rc.on.ca]
> Sent: Tuesday, August 12, 1997 7:15 AM
> To: 'Paul Leach'
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Hotfixes 
> 
> Paul,
> 
> Can you then comment on the Download Wizard available from
> http://www.microsoft.com/kb/softlib/default.asp which supposedly
> detects
> which files/patches etc... you need and automates the installation of
> these? I haven't tried it with a machine that was "Ok" in its eyes, so
> I
> haven't seen what it actually does, but the concept is quite cool for
> Intranet server management. Would seem to be parts of SMS for
> Intranets,
> which despite having risks that would have to be managed, could
> seriously improve the remote configuration management of machines.
> 
> Can you get someone to comment for us as to precisely what it does and
> how it does it? Is the underlying dB available with some instructions
> on
> how we might modify it for our own use?
> 
> I'm asking on behalf of the list because I think this would seem to be
> the answer to this thread's questions.
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list: http://www.ntbugtraq.com
On Tue, 12 Aug 1997, Adams, Gavin wrote:

> Only the fact you would have to change all the underlying keys
> on the
> entire NTFS file system, all the security on registry keys,
> etc....
> 
> Is this a time consuming operation? What happens when you add an
> NTFS formatted drive to an existing system? I guess I still don't
> understand exactly what is affected or influenced by the SID.

Even if it is time consuming, it's unimportant. When you're installing a
new system from scratch from an image, most of the NTFS security
permissions will be to groups such as "Everyone" and "Users" Are these
keyed into the machine SID? Even if they are, this is no more than
walking the directory tree and applying new ACL's. Since you're doing a
big huge install - whose goal is to be automated across a network to MANY
machines, an extra 15-30 mins is no big deal.

If the install is part of a domain, then it's likely that most NTFS perms
will be DOMAIN account's, so the SID's are already correct. Etc... (That
is if you could get the new machine installed and on the domain that way.)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

I tried the Hotfix off the web and it told me it only worked on NT versions 
for US, Canada, and the UK? I'm pretty sure I'm running the US version unless 
I've been transported to a different country without my knowledge.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Nash, Jason X [SMTP:nashwj@rlghncntx000.usps.gov]
Sent: Tuesday, August 12, 1997 10:12 AM
To: 'Russ'; 'Paul Leach'
Cc: ntsecurity@iss.net
Subject: RE: [NTSEC] Hotfixes

I just tried it and all it said I needed was the additional OutLook
converters. It lets you choose what to add.... seems harmless.

Jason

> -----Original Message-----
> From: Russ [SMTP:Russ.Cooper@rc.on.ca]
> Sent: Tuesday, August 12, 1997 7:15 AM
> To: 'Paul Leach'
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Hotfixes
>
> Paul,
>
> Can you then comment on the Download Wizard available from
> http://www.microsoft.com/kb/softlib/default.asp which supposedly
> detects
> which files/patches etc... you need and automates the installation of
> these? I haven't tried it with a machine that was "Ok" in its eyes, so

At 13:39 8/11/97 -0500, you wrote:
>
>
>
> Does anyone know of a way to recover/reset a lost/forgotten local
> Administrator password without re-installing?

Yep - see our web site for a list of ways to do this, along with a large
number of other useful pages:

http://www.iss.net/vd/sitesn.html

There are companies who would like to charge you a lot of $$ to do this,
but all these URLs are for either free or cheap methods to do the same
thing. Hope this helps!


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Is there any problem with this list.....
Please send me some feedback to my email account.

Thanks
Try http://www.savilltech.com/ntfaq/sysconf.html#sysconf16

This may help you.

 Patrick

> > From:
> > j.h.h.jansen@PTT-Telecom.NL[SMTP:j.h.h.jansen@PTT-Telecom.NL]
> > Reply To: j.h.h.jansen@PTT-Telecom.NL
> > We want to disable CAD to prevent somebody doing this without 
> > knowing the password (he won`t be able to unlock the workstation).

---------------------------------------------------------------------------
Patrick (JC) Townsend | H.H. Wills Physics Laboratory
WFWG, WinNT, Mac & Network support | University of Bristol.
Tel: 0117-928-9000 x8936 | Tyndall Avenue,
email: patrick.townsend@bris.ac.uk | Bristol. BS8 1TL
web: http://vishnu.phy.bris.ac.uk/phynet/ | United Kingdom

Seems to be working fine...

Wojciech Tryc
-----------------------------------------------------
"There is nothing more permanent
than a temporary solution..."
-----------------------------------------------------
wojtek@tryc.on.ca wojtek@trytel.com
virterm@infreno.tusculum.edu virterm@nether.net
wojciech.tryc@kanatek.ca wojtek@fos.net
wojtek@biodome.org http://www.tryc.on.ca
-----------------------------------------------------


On Tue, 12 Aug 1997, Artur Oliveira wrote:

> Is there any problem with this list.....
> Please send me some feedback to my email account.
> 
> Thanks
> 
> 

As it says on the page you refer to:

The Download Wizard will now check your computer for exisiting Microsoft
software files and make suggestions for file updates that may be
appropriate for your computer's configuration. The Download Wizard will
NOT automatically change, add, or delete any files on your computer. You
will be given the choice to download and install each of these files
yourself. Important: Before downloading any files, be sure to check with
your system administrator. 

I.e., we make it easy to find out if there are updates that _may_ apply
to you (and screen out lots that for sure _don't_) -- you still have to
decide if you want them.

The backend for this is pretty heavyweight and labor intensive -- it's
not ready to be a product.

ZAW is the product that is supposed to support automation of admin of
workstation and servers in a corporate environment.

> ----------
> From: Russ[SMTP:Russ.Cooper@rc.on.ca]
> Sent: Tuesday, August 12, 1997 4:15 AM
> To: Paul Leach
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Hotfixes 
> 
> Paul,
> 
> Can you then comment on the Download Wizard available from
> http://www.microsoft.com/kb/softlib/default.asp which supposedly
> detects
> which files/patches etc... you need and automates the installation of
> these? I haven't tried it with a machine that was "Ok" in its eyes, so
> I
> haven't seen what it actually does, but the concept is quite cool for
> Intranet server management. Would seem to be parts of SMS for
> Intranets,
> which despite having risks that would have to be managed, could
> seriously improve the remote configuration management of machines.
> 
> Can you get someone to comment for us as to precisely what it does and
> how it does it? Is the underlying dB available with some instructions
> on
> how we might modify it for our own use?
> 
> I'm asking on behalf of the list because I think this would seem to be
> the answer to this thread's questions.
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list: http://www.ntbugtraq.com
> 
 Ray Arachelian wrote:
 
 > permissions will be to groups such as "Everyone" and "Users"
 > Are these keyed into the machine SID? Even if they are, this
 
 I'm resending this because I accidentally started a seperate 
 thread...sorry.
 
 Davi
 
 ====================================
 
 The machine SID is created when Windows NT is first installed. The SID 
 is created early in GUI setup. If you were to use this method to 
 install Windows NT on a large number of machines, you would end up 
 with all of the computers having the same SID. The SID is *not* 
 modified when the computer is attached to a network as claimed by 
 Binary Research.
 
 The NT4 Resource kit has a utility to display and compare the SIDs of 
 2 machines. Check out getsid.exe
 
 When a machine is installed, it is given a domain SID (I don't use the 
 word machine SID since some folks confuse that term with the SID of 
 the machine account (and that's a totally different concept)). For an 
 NT Workstation, NT Member server, or an NT PDC, that SID is computed 
 to contain a statistically unique 96-bit number. For an NT BDC, that 
 SID is identical to the SID from the PDC for the domain. (So feel 
 free to clone BDCs within a domain to your heart's content.)
 
 The domain SID is the prefix of the SIDs of all the user
 accounts and group accounts created on the machine. (That is, the SID 
 of the account is simply the domain SID concatenated with the RID of 
 the account.) The SID of the account uniquely identifies that 
 account.
 
 So, if two workstations have the same domain SID, the first
 account generated (and so forth) on each workstation represents (100%) 
 the same principal (e.g., the same user). The would be unfathomable 
 if you said you wanted to clone NT PDCs.
 
 For workstations (and member servers), we are lured into a sense of 
 false security by the fact that the SID of an account should never 
 leave the machine (e.g., I can't put the SID of an account on machine 
 A onto machine B via any existing UI and even if I did (by calling the 
 API myself) such a SID couldn't be used to grant the account on 
 machine A any access to resources on machine B).
 
 But wait, what about removable media? What if I wrote removable media 
 on machine A and caried that media to machine B? If I didn't clone 
 the machines, that'd just work. However, if I had cloned the 
 machines, and A\Bob had the same account SID a
 B\Fred, and a file on the removable media granted read access to 
 A\Bob, the B\Fred would have read access to the file. Bummer.
 
 There are lots of premutations of the above. Also you will encounter 
 problems when the machines attempt to join a domain. The problems are 
 random in nature.
 
 Beyond that, MS reserves the right to make the failure even more 
 spectacular in the future. One future example might be, when you 
 upgrade to NT 5.0 the machine SID must be unique to be
 inserted into the Directory Services tree. Not an unreasonable 
 expectation.
 

From: phil@aegisstar.com (Phil Brown)
>Or sun's domestic-grade "SKIP" product. Which works on NT now, I think.
>
>www.skip.com

You mean www.skip.org, which is just another name for skip.incog.com.

H. Morrow Long, Yale Univ IT ISO -Info Technology Services Info Security Officer
175 Whitney Avenue, New Haven, CT 06520-8276, (203)432-1248(voice) 432-0593(FAX)
INET: http://pantheon.yale.edu/~long/ mailto:Morrow.Long@yale.edu
PAGE: (203)370-3081, (800)347-2574, mailto:1165469@pager.mcb.com PIN# 1165469
At 08:00 AM 8/12/97 -0400, you wrote:
>>1) Does anyone know secure this protocol really is?
>
>You should consider augmenting the authentication component with SecurID
>or any other one-time token authentication device which can function
>over NT RAS.
The experience I've had is that ACEClient for NT won't work when the remote
access connection is made using PPTP. NT treats this connection as a
Ethernet/LAN connection and handles it with netlogon.dll. Unfortunately,
netlogon.dll is not "hooked" to the ACEClient and therefore will not get a
SecurID challenge.

Additionally, they will have to make the investment in ACEServer and the
required number of smartcards.
>
>>2) Am I correctly reading the usage of PPTP?
>
>Yes, this is what PPTP was designed to do. PPTP is actually a couple of
>protocols combined. Standard PPP is used for the actual data and session
>management within a Generic Routing Encapsulation (GRE) session which is
>controlled independently of the PPP session. TCP1723 constructs the GRE
>tunnel (which is not encryption) within which the PPP session is
>constructed and maintained. The PPP authentication and data can be
>encrypted as Steve said, with 40 or 128-bit RC4. The authentication,
>done within the PPP session, is done using normal NT-client mechanisms
>(meaning it might be a LanMan hash being sent). Since client and server
>can negotiate encryption for authentication prior to authenticating, the
>hash is being sent within an encrypted PPP session with the server.
>
>If access filtering is not used at the server, its possible then for an
>attacker to attempt to authenticate with it, and the server will attempt
>to validate the user. Since your sites are known to you, and you haven't
>mentioned the need for roving access, I'd suggest that you have each of
>your remote offices obtain a static IP address from their local
>providers (should not be a considerable additional cost if any) so that
>you can do access-filtering on TCP/UDP1723 and IP Protocol 47 (if
>possible) to prevent your server from talking to any addresses other
>than those you are aware of.
>
Additionally, if you dedicate that machine to being your remote access
server, you can turn on PPTP filtering and it will only accept PPTP packets
(all other post and protocol combinations will be dropped), remove the
encapsulation and forward them to the RAS service.
>
>>3) Does anyone see an obvious glitch that I am overlooking? Seems too
>good to be true as advertised.
>
>The obvious glitch is that you have no supplied mechanism to filter the
>traffic done with the PPTP client. You have no built in monitoring of
>client activity, nor any way to filter what activity that client can do
>(beyond putting a filtering device between the NT PPTP server and the
>rest of your network).
>
>Its relatively weak authentication makes it less desirable than other
>solutions (i.e. Check Point SecuRemote, V-One SmartGate) for such
>complete access.
>
>OTOH, its an extremely simple way of connecting multiple MS-based sites
>for NetBIOS access since its a tunnel not proxies or relays.
>
>>4) What does PPTP cost in terms of data transmission speed?
>
>I don't have exact figures, but there is some overhead associated with
>the GRE packets (both in terms of CPU and bandwidth). More CPU if the
>PPP is encrypted. However, PPP has the ability to be compressed, and
>this is used within the GRE tunnel to, more or less, offset any
>overhead. My testing, as with Jiva's, suggest that it is actually as
>efficient as a normal 28.8 modem with compression.
>---------
>VPNs are wonderful things and can considerably reduce the cost of
>maintaining a WAN. However, you have to consider the value of the data
>you are permitting to be transmitted. If you have no method of
>controlling what is traversing your VPNs, and your internal security
>policies do not restrict access to information contained on your
>systems, then you are essentially saying that any data within any of
>your offices can be transmitted across this VPN.
>
>Given that assumption, you have to then consider the life of the data.
>Someone's criminal record, for example, has a life-span equal (or
>possibly greater than) the person's life-span. Any location which this
>data may reside should then be secured appropriately, i.e. it needs to
>be secured for the person's life-span. If you make that data available
>to the Internet (encrypted within an encapsulated channel), where in
>that form it can be captured by unknown sources, the question then
>becomes how long will it take for that data to be decrypted.
>
>Strong authentication is crucial of course, but even strong
>authentication will place the data in the public. If the encryption
>methods are not strong enough on the data, your strong authentication is
>doing only have of what's needed. With stories about criminal activities
>from 30 or more years ago haunting some politicians, its obvious that
>sources might pay to have data captured that might take 1, 2, or even 10
>years to decrypt.
>
>Encryption methods that use changing keys is essential, as are the use
>of ciphers that are extremely long and complex.
>
>If your traffic can be limited to administrative data that has a short
>value-life, then I'd say that PPTP is probably adequate for your needs
>(with stronger authentication). Otherwise, consider Check Point
>SecuRemote. SmartGate requires a Firewall in addition to itself, as does
>the Altavista Tunnel. Both offer alternatives to SecuRemote which have
>to be judged within the full context of your needs. Recognize that IPSec
>should be coming within the next 6 months and when it does, it will
>replace (for free) much of the value of a proprietary tunnel server.
>Obviously these tunnel vendors (Digital and V-One, etc...) will do
>everything in their power to provide functionality beyond what IPSec
>offers. Whether IPSec has any value within your environment is a matter
>of deciding whether or not you think you might extend your Extranet
>beyond organizations under your complete funding and control. If so,
>then IPSec (or some value-added implementation) is likely the way you
>want to go.
>
>> Cheers,
>> Russ
>> R.C. Consulting, Inc. - NT/Internet Security
>> owner of the NTBugTraq mailing list: http://www.ntbugtraq.com
>> 
Ken Jones
Senior INFOSEC Engineer
Information Warfare and Secure System Engineering
MITRE Corporation
(617) 271-4873


At 20:55 8/11/97 -0400, you wrote:
>
>A night shift helpdesk user decided to explore the world of NT by
>downloading a NT password evaluation program off the net... namely
>SCANNTPLUS from ntsecurity.com
>
>Said user downloaded the demo vesion from the web site, intalled it and
>ran it. At one point the program cheerfully says that you need admin
>rights to run the program. Click ok to get them. you click on ok, the
>program tells you you must log in ... then automatically logs you out.
>when you log back in again , vollia! You are not in the admin group.

I tested this against both a patched and an unpatched copy of NT 4.0, and
it didn't change admin status.

>I'm sure this is a well known exploit, but I didn't expect it to come via
>a demo package. I found this by my daily security scan looking for users
>with admin rights. 

Considering the source...

I would, however, suspect your end-user of running getadmin himself. The
scannt app isn't making any kernel calls directly, and so couldn't be
exploiting that particular bug.

>As they said in the cartoon " I dono gwanny, dat putty da look like he
>wants to hack my NT box "

Looks like a false alarm from here.

I didn't test it vs. any user level but plain "user", so YMMV.

Could he have been a server op?


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

On Tue, 12 Aug 1997, David LeBlanc wrote:
> I tested this against both a patched and an unpatched copy of NT 4.0, and
> it didn't change admin status.
> 
> Considering the source...

Maybe I should have been more clear about ' scan ' . What I meant was I
went to look at the list of users that have admin status in user manager,
and there was one there that had admin that was not supposed to.
> 
> I would, however, suspect your end-user of running getadmin himself. The
> scannt app isn't making any kernel calls directly, and so couldn't be
> exploiting that particular bug.

This is possible. However in my own defence .. .before running to the list
with this story I tested this on a user level account I ahve set up for
myself, which is the same level and perms for all desk level users, and
the same bit happened. The dialog box, the logout and login, then poof. 

I'm going to check to see if this box has the most recent patches, etc...

Thanks for the assist. 

-----------------------------------------------------------------------------
The ehT
 Entropy Songs about happiness murmured in dreams yportnE
 Technician When we both of us knew naicinhceT 
 How the end always is
 - Cure 
-----------------------------------------------------------------------------

Another quick note - the tool doesn't do its job very well. I had one
account set up on this machine purposely for lame password testing from the
scanner, but it didn't find it.

It seems that a combination of pwdump and L0pthcrack would be the way to go
if you want to try and crack user's passwords.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 18:27 8/12/97 -0400, you wrote:

>Maybe I should have been more clear about ' scan ' . What I meant was I
>went to look at the list of users that have admin status in user manager,
>and there was one there that had admin that was not supposed to.

That is NOT a good thing.
 
>This is possible. However in my own defence .. .before running to the list
>with this story I tested this on a user level account I ahve set up for
>myself, which is the same level and perms for all desk level users, and
>the same bit happened. The dialog box, the logout and login, then poof. 

OK, but I've just checked it on an NT 4.0 with SP3 + hotfixes, and it was
no-go. I then checked it on NT 4.0 server at SP1, no hotfixes, and it also
didn't do anything.

Hmmm - let me take a look at something...


OK - I just ran it as an administrator, and it granted me the following
rights:

Replace Process level token
Act as part of the operating system
Increase quotas
Log on as a service

All of these rights are very excessive, and certainly not required to check
passwords - as Jeremy Allison's pwdump shows us, there isn't any need to do
anything but change permissions on that area of the registry.

I'd say that running that app isn't an especially good idea in the first
place, but I am quite curious as to why you're getting it to promote people
to admin, but I can't reproduce it.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |


I agree. However take a look at the demo dictionary, its rather small.



On Tue, 12 Aug 1997, David LeBlanc wrote:

> Another quick note - the tool doesn't do its job very well. I had one
> account set up on this machine purposely for lame password testing from the
> scanner, but it didn't find it.
> 
> It seems that a combination of pwdump and L0pthcrack would be the way to go
> if you want to try and crack user's passwords.
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
> 

-----------------------------------------------------------------------------
The ehT
 Entropy Songs about happiness murmured in dreams yportnE
 Technician When we both of us knew naicinhceT 
 How the end always is
 - Cure 
-----------------------------------------------------------------------------

Meanwhile MS gets a nice database of installed software?

Don

-----Original Message-----
From: Paul Leach [SMTP:paulle@microsoft.com]
Sent: Tuesday, August 12, 1997 12:56 PM
To: 'Russ'
Cc: ntsecurity@iss.net
Subject: RE: [NTSEC] Hotfixes 

As it says on the page you refer to:

The Download Wizard will now check your computer for exisiting Microsoft
software files and make suggestions for file updates that may be
appropriate for your computer's configuration. The Download Wizard will
NOT automatically change, add, or delete any files on your computer. You
will be given the choice to download and install each of these files
yourself. Important: Before downloading any files, be sure to check with
your system administrator. 

I.e., we make it easy to find out if there are updates that _may_ apply
to you (and screen out lots that for sure _don't_) -- you still have to
decide if you want them.

The backend for this is pretty heavyweight and labor intensive -- it's
not ready to be a product.

ZAW is the product that is supposed to support automation of admin of
workstation and servers in a corporate environment.

> ----------
> From: Russ[SMTP:Russ.Cooper@rc.on.ca]
> Sent: Tuesday, August 12, 1997 4:15 AM
> To: Paul Leach
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Hotfixes 
> 
> Paul,
> 
> Can you then comment on the Download Wizard available from
> http://www.microsoft.com/kb/softlib/default.asp which supposedly
> detects
> which files/patches etc... you need and automates the installation of
> these? I haven't tried it with a machine that was "Ok" in its eyes, so
> I
> haven't seen what it actually does, but the concept is quite cool for
> Intranet server management. Would seem to be parts of SMS for
> Intranets,
> which despite having risks that would have to be managed, could
> seriously improve the remote configuration management of machines.
> 
> Can you get someone to comment for us as to precisely what it does and
> how it does it? Is the underlying dB available with some instructions
> on
> how we might modify it for our own use?
> 
> I'm asking on behalf of the list because I think this would seem to be
> the answer to this thread's questions.
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list: http://www.ntbugtraq.com
> 

Sounds like it to me!
Mitch
At 01:00 AM 8/13/97 -0400, Donald M. Barnard Jr. wrote:
>Meanwhile MS gets a nice database of installed software?
>
>Don
>
>-----Original Message-----
>From: Paul Leach [SMTP:paulle@microsoft.com]
>Sent: Tuesday, August 12, 1997 12:56 PM
>To: 'Russ'
>Cc: ntsecurity@iss.net
>Subject: RE: [NTSEC] Hotfixes 
>
>As it says on the page you refer to:
>
>The Download Wizard will now check your computer for exisiting Microsoft
>software files 
Phone 212-722-7953 Fax 212-427-1169
e-mail mitch@kewling.com 
Imagination is more important than knowledge.....
Knowledge is limited.....
Imagination is not....... Albert Einstein, (1879-1955)
I'm on course from 11/8/97 to 15/8/97. If you had any urgent matters, please contact BAEY (Email id : DSSDBCC or Tel 321 5720).



ServerManager (from NT server or resource kit) can start and stop
services remotely, change startup values etc.

Regards,
Steffen

On Mon, 11 Aug 1997 13:02:07 -0700, you wrote:

:The netsvc.exe command-line utility in the Windows NT Resource Kit can
:start, stop, pause, continue, query, and list services on remote systems.
:
:
:>Subject: [NTSEC] Stop/Start Services
:>Author: PC:John.Rutkin@bankerstrust.com
:>Date: 7/25/97 9:33 AM
:>
:>Excuse the off topic question..
:>
:>Is there a command line utility that will enable me to stop/start NT services
:>on remote boxes, I obviously have admin rights on all the relevent boxes.
:>Sorry again as this is somewhat off topic.
:>
:>Thanks
:>
:>John Rutkin
:

---------------------------------------------
Steffen Krause skrause@astberlin.de
Dipl.-Inf., skrause@informatik.hu-berlin.de
Microsoft Certified Systems Engineer
Are there currently any dos attacks against an NT Server that would cause the target to 'fall-off' the network?

We have an NT40 Server, on token ring, located across the WAN that does the following, leaving no evidence in Event Viewer:

1. Will function properly for hours or days, even, then will fall-off.
2. Will not respond to a ping. All other hosts on the same subnet respond.
3. At the console, there is no sign of trouble. No BSOD. The sys admin has to reboot and then the machine is alive again.

As mentioned earlier, there are no messages in Event Viewer indicating any hardware or software errors.

It has SP1 installed. . Installing SP3 is currently not my decision, but is my recommendation. However, there is an identical machine (SP1) running in the same environment that is not having these problems.

Thoughts from the list are always welcome!

Cheers!

Simon

>The problem was that my HDD was infected by a boot sector virus(FORM-A),

I take standard virus removal stuff failed...

>Maybe it would be a nice function for NT to allow the creation of a set
>of repair disks that can actually save the entire boot sector to
>floppies, instead of just the files of the repair directory.
>

There is a util called DISKSAVE in the NT Res Kit \Faulttol

Forgive this lame-a__ question, but I recently found myself forced to submit a registration form which included my credit card info using MSIE 3.02.  As a rule, I would shy away from  this practice.

I am interested in comments from this illustrious group on how big a "boner" this was without looking up MS's opinion in KB.

Thanks!
Paul

it says i am in canada. it must not run with netscape.
better. . .i've decided not to yield control of my pc to bill gates and
the collective.

boris

Paul Leach wrote:

> As it says on the page you refer to:
>
> The Download Wizard will now check your computer for exisiting
> Microsoft
> software files and make suggestions for file updates that may be
> appropriate for your computer's configuration. The Download Wizard
> will
> NOT automatically change, add, or delete any files on your computer.
> You
> will be given the choice to download and install each of these files
> yourself. Important: Before downloading any files, be sure to check
> with
> your system administrator.



On Sun, 3 Aug 1997 19:50:54 +0100 (BST), you wrote:

>The problem was that my HDD was infected by a boot sector virus(FORM-A),
>thus rendering my boot sector completely unusable, As a result no other
For me, repairing the installation (just the boot sector) worked quite
fine in that case.
[...]
>
>Maybe it would be a nice function for NT to allow the creation of a set
>of repair disks that can actually save the entire boot sector to
>floppies, instead of just the files of the repair directory.
>
As told, the standard repair process (boot from install floppies &
choose reapir existing installation) seems to do the required.
OK, you need a repair disk.
Oh - I also did a MBR-repair (fdisk /mbr from DOS floppy) before using
the repair disk but don't think that this is necessary.

just my $.02


cu, Dietz
-- 

 Dietz Proepper, [Software|Web] Designer, S.E.P.P. MED
 AKA tik on IRC, bladerunner on netrek, 
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
On Wed, 13 Aug 1997 08:48:26 -0400, you wrote:

>Are there currently any dos attacks against an NT Server that would cause the target to 'fall-off' the network?
They should result in blue screens.

>
>We have an NT40 Server, on token ring, located across the WAN that does the following, leaving no evidence in Event Viewer:
>
>1. Will function properly for hours or days, even, then will fall-off.
>2. Will not respond to a ping. All other hosts on the same subnet respond.
>3. At the console, there is no sign of trouble. No BSOD. The sys admin has to reboot and then the machine is alive again.
Can admin ping 127.0.0.1? If so, I'd assume that the problem might be
related to the NIC. We too had a server that would go invisible from
time to time - and finally it turned out that it was the NIC that
sometimes went dead - leaving no traces anywhere.

just my $0.02

cu, Dietz

-- 

 Dietz Proepper, [Software|Web] Designer, S.E.P.P. MED
 AKA tik on IRC, bladerunner on netrek, 
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
What I find confusing about this is that su'ing isn't at all needed to
check passwords. What I think is the problem is that he's calling
LogonUser, which does require advanced rights to run. However, there are
other ways to check passwords that don't require that right.

I'm still puzzled how it was reported that this app helped anyone gain
admin status, but I do think that if you have the rights listed below that
you're most of the way there to begin with. The MS documentation (and
every NT security text I've ever seen) advises that no user be granted most
of the rights listed below.


At 08:33 8/13/97 -0500, you wrote:
> The "replace ...", "act as part of ..." and "increase quotas .." are
> the documented required privileges for the su program written by
> David Wihl and Steffen Krause.
>

>According to David LeBlanc:
> ... stuff deleted ...
 
>> OK - I just ran it as an administrator, and it granted me the following
>> rights:
>> 
>> Replace Process level token
>> Act as part of the operating system
>> Increase quotas
>> Log on as a service



-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |


This letter is to answer some questions about ScanNT Plus that appeared in
the list recently.

ScanNT Plus ® is a powerful password tester for MS Windows NT3.51 and 4.0.
ScanNTPlus is intended for use by system administrators to perform regular
password audits in order to enhance the security of NT system. ScanNT Plus
is an enterprise version of a popular ScanNT v1.1 program. The program uses
a plain text dictionary file as the file of assumed passwords to check if a
password 
is sufficiently complex or easily breakable. 

The program does NOT use any undocumented features or well known or unknown
exploits and does not grant administrator rights. The program does not do
anything with the registry. ScanNT makes logon attempts with passwords
taken from a dictionary file of assumed passwords. 

Other cracking utilities exploit the uncovered encryption algorithm. These
utilities don't work with an optional in SP3 strong encryption of SAM.
ScanNT uses "old fashion" approach that works with SP3 strong encryption of
SAM and will work in NT 5.0. ScanNT is slower than those utilities as it
makes logon attempts. However, ScanNT new features speed up tremendously
regular password audits.

You MUST HAVE ADMINISTRATOR rights AND the following additional rights to
successfully execute ScanNT:
 Act as part of the operating system
 Replace a process level token
 Increase quotas

ScanNT Plus automatically sets the additional rights to run the test. It
requires logon/logoff for the changes to take place. After the test is
completed go to User Manager and remove the above mentioned rights if you
don't want to have them.
Also ScanNT automatically disables account lockout policy and logon/logoff
auditing for the time ScanNT is running and RESTORES the policies on EXIT.
So you should not worry about these policies as they will be restored to
the original. Command line processing allows you automate and schedule
password tests. Sample dictionary file contains 32,000 words and you
can easily add words, edit or change it. 

ScanNT Plus DEMO tries every suggested password with 00, 01, ..., 99
concatenated to the suggested password that you provide in the dictionary
file as well as the suggested password itself. For example, if the
dictionary file has only one word “test”, DEMO version will try the
following passwords: test, 00test, 01test, …, 99test. Thus, the DEMO
version works 101 times slower than the regular version.

ScanNT Plus DEMO comes with two SMALL! sample dictionary files (354 and
3304 words):

1. ScanNT.dic contains 354 words, which is equivalent to a dictionary of
35,754 words. 
2. DEMOdic.dic contains 3304 words, which is equivalent to a dictionary of
333,704 words. 

ScanNT does not do magic and does not crack the password if it is not in a
dictionary, even if it is very simple but certainly would not miss it if it
is in a dictionary. 

For a complete list of new and enhanced features visit
http://www.ntsecurity.com

Sincerely,
---------------------------------------------------------------------------
 Ratmir Timashev
 MWC, Inc.
 http://www.NTsecurity.com/
 ratmir@box.omna.com
 Tel: (614) 336-9223 Fax: (614) 761-9620
I am having a problem getting a DDE session started. As Admin I have no
problems starting the session, but as a user I can not start it. On NT
what kind of permissions(security) should a user have to start a DDE
session? The user has file permissions to everything on the drive. Any
help is appreciated.

What's this user right do again?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

Ray Arachelian wrote:
> 
> What's this user right do again?
> 
> =====================================Kaos=Keraunos=Kybernetos==============
> .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
> ..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
> <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
> ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
> .+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
> ======================= http://www.sundernet.com ==========================
While we're on the subject, what is the source for understanding users
rights? The NT resource Kit's description is skimpy. Is there further
technical documentation or do we just pick through the SDK and/or
decompile NT?

Ryan Ferris
ryan25@hooked.net
On Wed, 13 Aug 1997, Ryan Matthew Ferris wrote:

> Ray Arachelian wrote:
> > 
> > What's this user right do again?

I'd love it if someone decompiled NT into it's equivalent C sources, but
better documentation would help more. :) (Still with sources you could
fix your own copy of NT, change its behavior, etc...)

Anyway, when I learned NT aeons ago, I thought that the Administrator's
group wasn't "special" nor the administrator account. I had thought that
they were given rights through the User Rights screen. In theory this is
probably correct, but in practice it doesn't work.

for instance if you attempt to built an alternative Admins group, say call
this "Gods" and give this group all the rights including the advanced user
rights from the policy list, it's still not equivalent to Administrators.

If you try to rename the Administrators group, you can't. (I tried this in
the days when it was fashionable to rename your administrator account
because hackers would try to brute force the password on it.)

IMHO, we should be able to get rid of the administrator account and the
Administrators group and build equivalents of them. (Like in Netware NDS
where you can set up some portions of the NDS tree to not be accessible to
Admin) OTOH, having a special account that lets you do everything you can
think of on a machine is useful. Perhaps having a ConsoleOnly version of
the Administrator would be enough with such a schema. 

It gets weird with Domains and trusts between such, but still, if you can
further secure the administrators group, it would be useful.

Another thing that I dislike - but found useful once is that if you're
logged on to a workstation that is a domain member, the domain
administrator can unlock your workstation. In some cases, you might want
your workstation to access the domain, but you might not want to give
admin privs to admins on the domain. That is you might want to limit
workstation administration to the workstation local accounts..

It does depend on the company and its policies still, being able to
separate out what an administrator can do is IMHO very useful.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

One doesn't need to modify the registry to look
at the password hashes if you have the
Act as part of the operating system right.
Might be nice if one is trying to be less obvious 
about grabbing them.

One can demonstrate this by allowing the scheduler
to interact with the desktop, and then scheduling
regedit to run in 1 minute. At least, this worked under
3.51.

 Ryan

----------------------------------------------------------
From: dleblanc @ iss.net (David LeBlanc) @ smtp


OK - I just ran it as an administrator, and it granted me the following
rights:

Replace Process level token
Act as part of the operating system
Increase quotas
Log on as a service

All of these rights are very excessive, and certainly not required to check
passwords - as Jeremy Allison's pwdump shows us, there isn't any need to do
anything but change permissions on that area of the registry.

On Wed, 13 Aug 1997, Paul Iglesia wrote:

> Forgive this lame-a__ question, but I recently found myself forced to
> submit a registration form which included my credit card info using MSIE
> 3.02. As a rule, I would shy away from this practice. 
> 
> I am interested in comments from this illustrious group on how big a
> "boner" this was without looking up MS's opinion in KB.

 Don't worry, it's not a lame question at all. I would caution about the
belief you have that consulting M$ on security matters is wise though...
;)

 But to the question at hand, unless you went to the pains of obtaining a
128-bit browser AND the server was running 128-bit encryption (not likely
if a commercial server outside of the US; IIS, Netscape etc), your
transaction was transmitted with 40-bit encryption. As the long running
thread on this list pointed out, that's quite easily crackable by anyone
who went to the pains of capturing your data in transit. Even 128-bit is
probably "easy" to anyone who went to these lengths.

 You've probably got more of a worry about the scruples of the people you
actually sent your details do. I would suggest what a lot of people I
know do when it comes to net credit card transactions; get yourself a
second card with a limit of $500 or $1000. No matter who gets your
details now, even discounting the fact you should still be able to catch
and refute any illegal transactions anyway, the *worst* anyone can rip you
off is $500. Just try and minimise any potential losses; which is one of
the main things you should look at in *any* security related matter.

 Regards,
 Lee.

*-----------------------------*----------------------------------------*
| Lee Hamilton | Democracy: Three wolves and a |
| Systems Administrator | sheep deciding what's for dinner. |
| Prentice Centre | |
| University of Queensland | Em: lee@prentice.uq.edu.au |
| Australia | Ph: +61-7-3365 4328 |
*-----------------------------*----------------------------------------*


A lot of documentation tells me that if I ever need to change the
CD-KEY for my installation of NT 4.0 Server, I will need to reinstall
the whole package. Are there any registry keys or undocumented way
to do this seemingly impossible task?

I need to do this because the sys adm from one of the sites i am
workin' on key in some eval CD-KEY instead of the full-pak and
I would need to correct several of his mistakes, hopefully with
the least painful method.

Pls help if you know. Thanks.

-------------------------------------------------------------------
Henry Lim
Systems Engineer, PTSC
National Computer Systems Pte Ltd
Tel: 65-486-5259
Fax: 65-482-3731
email: cwlim@ncs.com.sg http://www.ncs.com.sg
--------------------------------------------------------------------
I will not be in the office from 11/8/97 to 15/8/97. If you had any urgent matter, please contact BAEY (Email id : DSSDBCC or Tel 321 5720).



I am facing this funny problem. I am the admin for the primary 
domain controler. One of the main directory I set it with the 
administrators have full control on it together with all the 
subdirectory in it. But when I want to rename it, a window pop up 
saying that 

Cannot rename training. Access is denied.

Make sure the disk is not full or write-protected and that the file 
is not currently in use.

The training is the directory name that I wish to rename. I still 
have around 100 MB hard disk space available. Any idea on this?

regards,
gek po

 


 
 
 Hello,
 
 I would like to know if somebody can help me with the following :
 
 
 Is there a way (tool) you can see who is using (or locking) a file 
 without having admin privilleges ?
 
 
 
 
 Regards 
 Wouter_Marien@Paribas.com
 Hi
 
 You can use the old File Manager that comes with win3.11 or NT 3.51
 
 if you have NT4.0 or win95, file manager is still available by opening 
 a file called winfile.exe.
 
 Use it then highlight the file you want to find out who has it open 
 and from the file mgr title bar click on file\properties\open by.
 
 _____________________________________________________________________
 _------------------------------------------------------------------
 
 
 Hello,
 
 I would like to know if somebody can help me with the following :
 
 
 Is there a way (tool) you can see who is using (or locking) a file 
 without having admin privilleges ?
 
 
 
 
 Regards 
 Wouter_Marien@Paribas.comReceived: from gw.batterymarch.com (199.58.9.2) by nt_mail.batterymarch.com with
SMTP
 (IMA Internet Exchange 2.1 Workgroup) id 0000A732; Thu, 14 Aug 97 10:33:16
-0400
Received: by gw.batterymarch.com; id KAA15918; Thu, 14 Aug 1997 10:09:03 -0400
Received: from phoenix.iss.net(208.21.0.5) by gw.batterymarch.com via smap (3.2)
 id xma015915; Thu, 14 Aug 97 10:08:45 -0400
Received: (qmail 4603 invoked by alias); 14 Aug 1997 14:24:40 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 4598 invoked by alias); 14 Aug 1997 14:24:40 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 4593 invoked by uid 15); 14 Aug 1997 14:24:39 -0000
Received: (qmail 4586 invoked from network); 14 Aug 1997 14:24:38 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 14 Aug 1997 14:24:38 -0000
Received: from igwpc5.paribas.com (igwpc5.paribas.com [155.140.123.60]) by
arden.iss.net (8.8.6/8.7.3) with ESMTP id KAA04056 for ;
Thu, 14 Aug 1997 10:25:27 -0400
Received: from igwpc4.paribas.com (unverified [155.140.123.61]) by
igwpc5.paribas.com
 (Integralis SMTPRS 2.04) with SMTP id ;
 Thu, 14 Aug 1997 15:18:24 +0000
Received: from ccMail by igwpc4.paribas.com
 (IMA Internet Exchange 2.1 Enterprise) id 00044E69; Thu, 14 Aug 97 15:30:47
+0100
MIME-Version: 1.0
Date: Thu, 14 Aug 1997 15:53:23 +0100
Message-Id: <00044E69.3111@paribas.com>
From: Wouter_MARIEN@paribas.com (Wouter MARIEN)
Subject: [NTSEC] In use files
To: "'ntsecurity@iss.net.'" 
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Wouter_MARIEN@paribas.com (Wouter MARIEN)
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
Is there such a thing as an "mount/unmount" right? Our department
recently purchased a lab full of machines, each with an Iomega Zip Insider
drive. If loged in as administrator, there seems to be no problems. But
for normals users, any zip disk inserted into the machine will not come
back out. Users should be able to eject the disk by right clicking the
disk and hitting eject, but instead they get the following error:
 An error was encountered trying to unmount 'Removable
 Disk (D:)'.
 Check to make sure that there are no open files or
 windows from that volume.
This error does not occur logged in as administrator (unless, of course,
there IS a open file or window from the volume).
The strange thing is that the eject button doesn't function properly,
either. Logged in as a normal user, pressing the eject button has it's
intended effect immediately, in _ten_ minutes, or never.
What's going on? Users have no problems ejecting the CD-ROM...

 -Bart
 Pola@cns.uni.edu


sorry for being off topic.

does anyone know how to get off this list ???

i get annoyed having sent at least four email to
request-ntsecurity, human interfaces, majordomo and the lot.

regards,
patrick

subscrive ntsecurity

Nothing. This right has no effect in current versions of Windows NT.

 -----Original Message-----
 From: Ray Arachelian [SMTP:sunder@brainlink.com]
 Sent: Wednesday, August 13, 1997 2:31 PM
 To: ntsecurity@iss.net
 Subject: [NTSEC] Increase quotas user right?

 What's this user right do again?


=====================================Kaos=Keraunos=Kybernetos===========
===
 .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to
see |./|\.
 ..\|/..|sunder@sundernet.com|you once again. I thought you were
|/\|/\
 <--*-->| ------------------ |hiding, and you thought that I had
run |\/|\/
 ../|\..| "A toast to Odin, |away chasing the tail of dogma. I
opened|.\|/.
 .+.v.+.|God of screwdrivers"|my eye and there we were....
|.....
 ======================= http://www.sundernet.com
==========================
>Hello folks, 
>I am often building new servers and installing various components at the time
>of the system build. Given all the heated discussions on the NT Service
>Packs I am wondering in which order you are all "packing" your servers in a
>fresh build type of situation. I currently have an Enterprise Level Server
>on my "to-build" list and am curious as to your opinions of Installing the
>applications and then service packing it..
>
>The applications to be installed are: 
>MS Exchange Server 5.0, IMS for Exchange Server, Cheyenne ArcServe 6,
>Cheyenne Inoculan, Cheyenne AntiVirus agent for Exchange Server, Cheyenne
>Database agent for Exchange Server, Alcom LanFax for NT Server 5.0, APC
>PowerChute for NT.
>In addition configuration of the NT server will entail:
>RAS services, TCP/IP protocol config, Printing services (DLC).
>
>My usual approach to this is to install the base OS then immediately pack to
>SP1. Then install everything and re-pack SP1, then "safely" pack my way up
>to SP2 or SP3 (+hotfix) depending on how "available" this server will be to
>the world. My worry is, some of the aforementioned apps "require" and often
>prefer SP2 and even SP3. While Exchange Server supposedly "requires" SP2, it
>will install on an SP1 machine. I have seen some NASTY problems with a fresh
>packing of SP3 after OS install prior to app installation. Many fresh
>services will not start with the SP3 modified RPC calls. My gut feeling on
>this individual server is an immediate pack to SP2 after the OS install, then
>install all the apps and re-pack to SP2 and leave it. 
>
>I am wondering if anyone has any other opinions on this type of issue, some
>of my colleagues have suggested a re-pack after each application install
>previous to the next app install. This seems a tad overbearing to me.
>Comments appreciated!
>
>- Robert Buckmaster, MCP+2
I usually go straight to SP3 first, then I install all of the new software,
re-install SP3, and add all of the hotfixes. 

Some of the software problems you may be experiencing could be from the
"other" software installing over system DLLs or by suppling the original NT
CD when adding new software or drivers. I don't trust SP2, we've had alot
of weirdness happen after installing new software and re-installing SP2,
especially if the original NT CD was needed during the install. It's
almost as though the registry is slowly getting wacked or the SP2 install
is not modifying registry entries on the second run... I believe you need
to install SP1, then SP2, since SP2 does not contain all of the SP1 fixes
(I may be wrong on this one). SP3 seems to contain them all.

It would be nice if MonkeySoft would supply NT and 95 (not the OEM SP2)
with the Service Packs built in. This would eliminate alot of headaches,
especially after dumping all of your cash on multiple MSDN and BackOffice
subscriptions...


At 10:41 AM 8/14/97 -0700, Robert Buckmaster wrote:
>>Hello folks, 
>>I am often building new servers and installing various components at the
time
>>of the system build. Given all the heated discussions on the NT Service
>>Packs I am wondering in which order you are all "packing" your servers in a
>>fresh build type of situation. I currently have an Enterprise Level Server
>>on my "to-build" list and am curious as to your opinions of Installing the
>>applications and then service packing it..
>>
>>The applications to be installed are: 
>>MS Exchange Server 5.0, IMS for Exchange Server, Cheyenne ArcServe 6,
>>Cheyenne Inoculan, Cheyenne AntiVirus agent for Exchange Server, Cheyenne
>>Database agent for Exchange Server, Alcom LanFax for NT Server 5.0, APC
>>PowerChute for NT.
>>In addition configuration of the NT server will entail:
>>RAS services, TCP/IP protocol config, Printing services (DLC).
>>
>>My usual approach to this is to install the base OS then immediately pack to
>>SP1. Then install everything and re-pack SP1, then "safely" pack my way up
>>to SP2 or SP3 (+hotfix) depending on how "available" this server will be to
>>the world. My worry is, some of the aforementioned apps "require" and often
>>prefer SP2 and even SP3. While Exchange Server supposedly "requires"
SP2, it
>>will install on an SP1 machine. I have seen some NASTY problems with a
fresh
>>packing of SP3 after OS install prior to app installation. Many fresh
>>services will not start with the SP3 modified RPC calls. My gut feeling on
>>this individual server is an immediate pack to SP2 after the OS install,
then
>>install all the apps and re-pack to SP2 and leave it. 
>>
>>I am wondering if anyone has any other opinions on this type of issue, some
>>of my colleagues have suggested a re-pack after each application install
>>previous to the next app install. This seems a tad overbearing to me.
>>Comments appreciated!
>>
>>- Robert Buckmaster, MCP+2
>
>
Each Service Pack has all the fixes from previous service packs. SP2
has all SP1 fixes, and SP3 has both SP2 and SP1 fixes.

Jason Nash

> -----Original Message-----
> From: Jim Laverty [SMTP:laverty@adra.com]
> Sent: Thursday, August 14, 1997 2:43 PM
> To: Robert Buckmaster; agoora@adra.com
> Cc: 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] Service Packing Order
> 
> I usually go straight to SP3 first, then I install all of the new
> software,
> re-install SP3, and add all of the hotfixes. 
> 
> Some of the software problems you may be experiencing could be from
> the
> "other" software installing over system DLLs or by suppling the
> original NT
> CD when adding new software or drivers. I don't trust SP2, we've had
> alot
> of weirdness happen after installing new software and re-installing
> SP2,
> especially if the original NT CD was needed during the install. It's
> almost as though the registry is slowly getting wacked or the SP2
> install
> is not modifying registry entries on the second run... I believe you
> need
> to install SP1, then SP2, since SP2 does not contain all of the SP1
> fixes
> (I may be wrong on this one). SP3 seems to contain them all.
> 
> It would be nice if MonkeySoft would supply NT and 95 (not the OEM
> SP2)
> with the Service Packs built in. This would eliminate alot of
> headaches,
> especially after dumping all of your cash on multiple MSDN and
> BackOffice
> subscriptions...
> 
> 
> At 10:41 AM 8/14/97 -0700, Robert Buckmaster wrote:
> >>Hello folks, 
> >>I am often building new servers and installing various components at
> the
> time
> >>of the system build. Given all the heated discussions on the NT
> Service
> >>Packs I am wondering in which order you are all "packing" your
> servers in a
> >>fresh build type of situation. I currently have an Enterprise Level
> Server
> >>on my "to-build" list and am curious as to your opinions of
> Installing the
> >>applications and then service packing it..
> >>
> >>The applications to be installed are: 
> >>MS Exchange Server 5.0, IMS for Exchange Server, Cheyenne ArcServe
> 6,
> >>Cheyenne Inoculan, Cheyenne AntiVirus agent for Exchange Server,
> Cheyenne
> >>Database agent for Exchange Server, Alcom LanFax for NT Server 5.0,
> APC
> >>PowerChute for NT.
> >>In addition configuration of the NT server will entail:
> >>RAS services, TCP/IP protocol config, Printing services (DLC).
> >>
> >>My usual approach to this is to install the base OS then immediately
> pack to
> >>SP1. Then install everything and re-pack SP1, then "safely" pack my
> way up
> >>to SP2 or SP3 (+hotfix) depending on how "available" this server
> will be to
> >>the world. My worry is, some of the aforementioned apps "require"
> and often
> >>prefer SP2 and even SP3. While Exchange Server supposedly
> "requires"
> SP2, it
> >>will install on an SP1 machine. I have seen some NASTY problems
> with a
> fresh
> >>packing of SP3 after OS install prior to app installation. Many
> fresh
> >>services will not start with the SP3 modified RPC calls. My gut
> feeling on
> >>this individual server is an immediate pack to SP2 after the OS
> install,
> then
> >>install all the apps and re-pack to SP2 and leave it. 
> >>
> >>I am wondering if anyone has any other opinions on this type of
> issue, some
> >>of my colleagues have suggested a re-pack after each application
> install
> >>previous to the next app install. This seems a tad overbearing to
> me.
> >>Comments appreciated!
> >>
> >>- Robert Buckmaster, MCP+2
> >
> >


On Wed, 13 Aug 1997, Ray Arachelian wrote:

> On Wed, 13 Aug 1997, Ryan Matthew Ferris wrote:
> 
> > Ray Arachelian wrote:
> > > 
> > > What's this user right do again?
> 
> I'd love it if someone decompiled NT into it's equivalent C sources, but
> better documentation would help more. :) (Still with sources you could
> fix your own copy of NT, change its behavior, etc...)
I know that feeling.
> 
> Anyway, when I learned NT aeons ago, I thought that the Administrator's
> group wasn't "special" nor the administrator account. I had thought that
> they were given rights through the User Rights screen. In theory this is
> probably correct, but in practice it doesn't work.

This is exactly like UNIX, you can never recreate the root account,
because certain processes "belong" to root. You cant really recreate the
administrators group. You can make new groups, give them access to all
the files and user rights, but not everything. This seems to agree
with the rumor I heard about NT being designed with kernel like UNIX.
Just a thought.

> 
> for instance if you attempt to built an alternative Admins group, say call
> this "Gods" and give this group all the rights including the advanced user
> rights from the policy list, it's still not equivalent to Administrators.
> 
> If you try to rename the Administrators group, you can't. (I tried this in
> the days when it was fashionable to rename your administrator account
> because hackers would try to brute force the password on it.)
> 
> IMHO, we should be able to get rid of the administrator account and the
> Administrators group and build equivalents of them. (Like in Netware NDS
> where you can set up some portions of the NDS tree to not be accessible to
> Admin) OTOH, having a special account that lets you do everything you can
> think of on a machine is useful. Perhaps having a ConsoleOnly version of
> the Administrator would be enough with such a schema. 
> 
> It gets weird with Domains and trusts between such, but still, if you can
> further secure the administrators group, it would be useful.
> 
> Another thing that I dislike - but found useful once is that if you're
> logged on to a workstation that is a domain member, the domain
> administrator can unlock your workstation. In some cases, you might want
> your workstation to access the domain, but you might not want to give
> admin privs to admins on the domain. That is you might want to limit
> workstation administration to the workstation local accounts..

All you have to do to remove all administrative privs from the Domian
admins remove that group from your local admin group. This is also a way
of customize your admins rights. If you remove the administrator from the
administrators group, it essentially makes the admin a normal user.

You are right, there are things you just cant do, but if you change
groups, I have found some flexibility.

> 
> It does depend on the company and its policies still, being able to
> separate out what an administrator can do is IMHO very useful.
> 
> =====================================Kaos=Keraunos=Kybernetos==============
> .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
> ..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
> <--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
> ../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
> .+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
> ======================= http://www.sundernet.com ==========================
> 

However, if you are running Quota Advisor or some other Quota Management package, you will find that this right is used to modify the quotas you set on the system.

Jesse

-----Original Message-----
From: Chance Neale [SMTP:nealec@ms.com]
Sent: Thursday, August 14, 1997 1:35 PM
To: 'Ray Arachelian'; ntsecurity@iss.net
Subject: RE: [NTSEC] Increase quotas user right?

Nothing. This right has no effect in current versions of Windows NT.

 -----Original Message-----
 From: Ray Arachelian [SMTP:sunder@brainlink.com]
 Sent: Wednesday, August 13, 1997 2:31 PM
 To: ntsecurity@iss.net
 Subject: [NTSEC] Increase quotas user right?

 What's this user right do again?


=====================================Kaos=Keraunos=Kybernetos===========
===
 .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to
see |./|\.
 ..\|/..|sunder@sundernet.com|you once again. I thought you were
|/\|/\
 <--*-->| ------------------ |hiding, and you thought that I had
run |\/|\/
 ../|\..| "A toast to Odin, |away chasing the tail of dogma. I
opened|.\|/.
 .+.v.+.|God of screwdrivers"|my eye and there we were....
|.....
 ======================= http://www.sundernet.com
==========================

This discussion popped up on the NTBugTraq list and I thought it would
be more thoroughly discussed here. I've grabbed the first several
messages of the discussion to kick things off...

> ----------
> From: hackwort@dg-rtp.dg.com[SMTP:hackwort@dg-rtp.dg.com]
> Sent: Wednesday, August 13, 1997 7:37 AM
> To: ntdev@atria.com
> Subject: details about SID allocation
>
> Are there resources describing the nitty-gritty of how NT creates
> accounts and allocates SIDs? My search of KB and MSDN docs has
> not turned up anything.
>
> I create a bunch of user accounts with NetUserAdd(). then use those
> accounts to set ACLs on directories. It looks like NT crashed during
> one of these operations. When the system came back up, I created
> some more accounts, which seemed to get the same SID as accounts
> created before the crash.
>
> For example: create user ONE and a directory C:\ONE, setting
> the ACL on C:\ONE to "ONE Full control". NT crashes. Create
> user TWO, directory C:\TWO with ACL "TWO Full control". User ONE
> can no longer log in, User Manager doesn't show ONE, and the
> ACL on C:\ONE is "TWO Full control". This isn't good.
>
> I'd really like to find a way to ensure that SIDs are never reused,
> but I'd accept pointers to technical details that could enable me
> to code around this NT defect.
>
> Thanks.

Paul Leach responded:
> The SID creation routine forces the "next SID" info to the disk (in
the
> registry) before returning.
> 
> If, as part of crash recovery, you restored the registry, you could
get
> the behavior you described.
> 
> Any atomic update algorithm that uses a disk as its stable store will
> not be atomic if the disk is restored.

To which I replied:
> Actually that's really bad. Since I can restore the registry without
> doing a full restore of the disk, I can get access to files that are
> newer than the saved registry and assumed protected by ACL's.
>

And Russ much more elequently said:
> So the only way to prevent this from happening would be to ensure that
> the user component of a SID (i.e. the 1001, 1002, 1003 part) be unique
> and non-recurring, such that should a registry be restored and a new
> user added, that user would not get an identifier that had ever been
> used before. Please correct me if I'm wrong, but wouldn't this seem to
> be a requirement in the C2 "no object reuse" section?
> 
> Granted, if you delete a user its number will not be re-used, but
> restoring a system should do something with the objects left hanging
> with now (after restore) invalid account identifiers, no? Like assign
> them to the Administrator? They can never be assigned back to their
> original owners since its impossible to recreate an account that was
> previously removed (through normal delete procedures) so they are
> definitely destined to be assigned to the owners other than their
> original owners (unless of course the adds are put back into the
system
> in precisely the same order they were previously).
> 
> What happens in the following example with a PDC and 2 BDCs of the
same
> domain spread across WAN links;
> 
> 1. New user created, PDC updated, BDC #1 updated, BDC #2 not yet
updated
> 2. BDC #2 places new user ACLs on resources it holds, BDC #2 still not
> updated
> 3. PDC fails, dies hard, destroyed.
> 4. BDC #2 made PDC due to physical location of Administrator
> 5. BDC #2 forces BDC #1 to accept BDC #2's view of SAM, New user gone
> from BDC #1, doesn't exist any more
> 6. BDC #2, now PDC, creates New user (a different user), BDC #1 now
has
> ACLs for wrong user on its resources
> 
> Short of checking the resources for every user created in and around
the
> failure time, how would any Administrator in this multiple
administrator
> model domain know that their resources are correctly ACL'd?
> 
> These resources would simply be available to this user until someone
> scrutinized the access list for the resource and determined that the
> rights were incorrectly assigned.
> 
> I'm not suggesting the solution is easy, but doesn't the problem seem
> rather obvious and large?
> 

Paul Replied:
> > Actually that's really bad. Since I can restore the registry
without
> > doing a full restore of the disk, I can get access to files that are
> > newer than the saved registry and assumed protected by ACL's.
> >
> Even a full restore of the disk won't help. The SID could have been
> placed on an ACL on another machine.
> 
> This is an instance similar to when a database atomic transaction
(e.g.)
> writes a check for $100 to someone and then crashes. The transaction
> gets undone by database recovery, but external affects of a
transaction
> cannot be undone -- you have to do what's called a "compensating
> transaction".

And also:
> > So the only way to prevent this from happening would be to ensure
that
> > the user component of a SID (i.e. the 1001, 1002, 1003 part) be
unique
> > and non-recurring, such that should a registry be restored and a new
> > user added, that user would not get an identifier that had ever been
> > used before. Please correct me if I'm wrong, but wouldn't this seem
to
> > be a requirement in the C2 "no object reuse" section?
> >
> No. No object reuse means that (e.g.) disk sectors are zeroed before
> being reused, so that you can't get at the top secret info that was in
> those sectors from the file they were previously a part of.
> 
> Paul



=======================================================
Andy Webb awebb@swinc.com www.swinc.com
Simpler-Webb, Inc. Austin, TX 512-322-0071
 "Mauve has more RAM" - Dilbert
=======================================================

At 23:11 8/13/97 +1000, you wrote:
>>The problem was that my HDD was infected by a boot sector virus(FORM-A),
 
>I take standard virus removal stuff failed...
 
I think you ought to be able to use a DOS floppy and run fdisk /MBR a few
times and cure this. Worked for me.

>>Maybe it would be a nice function for NT to allow the creation of a set
>>of repair disks that can actually save the entire boot sector to
>>floppies, instead of just the files of the repair directory.

What I'd like to see would be a way to build an NT boot floppy that would
have just enough brains to run chkdsk, format, and fdisk.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 04:25 PM 8/14/97 -0400, David LeBlanc wrote:
>At 23:11 8/13/97 +1000, you wrote:
>>>The problem was that my HDD was infected by a boot sector virus(FORM-A),
> 
>>I take standard virus removal stuff failed...
> 
>I think you ought to be able to use a DOS floppy and run fdisk /MBR a few
>times and cure this. Worked for me.

Is your boot drive NTFS or FAT based?

>
>>>Maybe it would be a nice function for NT to allow the creation of a set
>>>of repair disks that can actually save the entire boot sector to
>>>floppies, instead of just the files of the repair directory.
>
>What I'd like to see would be a way to build an NT boot floppy that would
>have just enough brains to run chkdsk, format, and fdisk.

You mean like OS/2?

>
>
>-----------------------------------------------------------
>David LeBlanc | Voice: (770)395-0150 x138
>Internet Security Systems, Inc. | Fax: (404)395-1972
>41 Perimeter Center East | E-Mail: dleblanc@iss.net 
>Suite 660 | www: http://www.iss.net/
>Atlanta, GA 30328 |
>
>
>
Hi,

As of early this morning, several ISP's have informed me of CPU
utilisation hitting 95-100% on their servers running the time daemon
from the NT Resource Kit.

As yet we have not been able to confirm this is a DoS attack, but
everything is pointing that way.

Does anyone know anything about it??

The information gathered so far is being made public at:

http://andrewsmith.webcafe.net/timebug.htm

Both Andrew Smith and I are continuing to look into this problem, I
would appreciate information (even reports of further attacks).

Microsoft Security Team has been emailed, no reply as of this time. 

Ciao

Drew
At 08:45 PM 8/14/97 GMT, you wrote:
>Hi,
>
>As of early this morning, several ISP's have informed me of CPU
>utilisation hitting 95-100% on their servers running the time daemon
>from the NT Resource Kit.
>
>As yet we have not been able to confirm this is a DoS attack, but
>everything is pointing that way.
>
>Does anyone know anything about it??

The exact same thing happened to one of my servers. Stopping the service
brought the CPU back to normal. No idea why...



>The information gathered so far is being made public at:
>
>http://andrewsmith.webcafe.net/timebug.htm
>
>Both Andrew Smith and I are continuing to look into this problem, I
>would appreciate information (even reports of further attacks).
>
>Microsoft Security Team has been emailed, no reply as of this time. 
>
>Ciao
>
>Drew




randall g =%^)> Stockwatch webmaster
mailto:webmaster@canada-stockwatch.com
http://www.canada-stockwatch.com

At 16:35 8/14/97 -0400, you wrote:
>At 04:25 PM 8/14/97 -0400, David LeBlanc wrote:

>>I think you ought to be able to use a DOS floppy and run fdisk /MBR a few
>>times and cure this. Worked for me.
>
>Is your boot drive NTFS or FAT based?

NTFS. I've noticed that NT tends to blue screen if it gets a boot sector
virus, and that has bailed me out more than once.

>>What I'd like to see would be a way to build an NT boot floppy that would
>>have just enough brains to run chkdsk, format, and fdisk.
 
>You mean like OS/2?

I don't know - never used OS/2 much. Just a boot floppy that would allow
some recovery tools to run.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Does anyone know of a way to get a listing of user rights for a group 
and/or user on a specific machine? Need a command that can be run from 
command line.

Bob Kenyon
Systems Administrator
SAS Institute, Infrastructure Support Team
(919)677-8000 X3145 | Rokeny@wnt.sas.com

We are looking for a service which will allow us to manage NT 4.0
Workstations through Novell NDS. I have already tried out Novell
Workstation Management and Novell NT Administrator, and looked into the
Netvision Products.

Currently we run 25 or so NT boxes with NO services loaded with the
exception of the Novell Client Services (Novell's, not Microsoft's.) In
other words, we are not running an NT network.

The Novell products, and I believe the Netvision Synchronicity Products as
well, require you to run the normal NT network services, ie Workstation,
Server, Computer Browser, NetBIOS Interface, RPC. The product then
provides password and account synchronicity between this and Novell NDS.

Is anyone aware of a product which is a standalone service which does
password and account synchronization with Novell and DOES NOT require you
to use the NT services? 

Any help will be GREATLY appreciated. 

Don Baker
Computer Services Group dbaker@arri.uta.edu
Automation & Robotics Research Institute (817) 272-5906
University of Texas at Arlington (817) 272-5952 fax 


Is there anything like addusers.exe that can edit a batch of selected users via a batch file. We find as department names change we need to reset large groups of user descriptions periodically. Altering each one with user manager is too time consuming.

Thanks


Dennis C. Flagg
These views are my own and not necessarily the views of my employer. 


During a recent security purge, we decided the NT machine in the admin section was a bit of a headache, and since it was only used to create new accounts we simply installed usrmgr on a windows '95 machine to which the responsible person has exclusive access...

Works fine except now, this guy's on the phone to me every five minutes "please grant dial-in permission to so-and-so"... of course, the '95 version of user manager doesn't have the ability to grant or deny remote access...

Is there anything (a hack, even) that will allow me to allow dial-in access by default? I can't find anything in the policy editor, and nothing obvious in the registry...

While I'm on the subject of ras, does anyone know if there's a hack/patch yet for setting the equivalent of Novell's "max no. of concurrent logons = 1". God, I miss that... I once saw someone post a couple of registry entries they thought *might* work, but they didn't. Anyone tried "Steelhead" (or whatever the hell they've called it this week) - does it have this (essential, imho) feature? I found nothing on M$ site about it...

Regards

Bob

There is a utility in the Windows NT Resource Kit v4.0, Virtual Motion Remote Access Manager, (http://www.virtualmotion.com/ that allows you to have total control over a Remote Access session, unfourtantly, the version that comes with the ResKit is a 2 port demo copy.

-------------------
Jason Strobush
Administrator, Henderson Bay High School
http://www.peninsula.wednet.edu/
strobush@peninsula.wednet.edu

From: Bob Love [SMTP:bob!@raha.com]
To: NT Security List
Subject: [NTSEC] RAS and User Account creation defaults

While I'm on the subject of ras, does anyone know if there's a hack/patch yet for setting the equivalent of Novell's "max no. of concurrent logons = 1". 





Hi,

 How do I set the RAS server to answer the phone after 5 rings? I
tried setting it on the Zyxel modem but it seems
 that the RAS setting gets higher priority when it comes to settings!

Thanks,

=) eugene


At 06:56 8/15/97 +0800, you wrote:
 
> How do I set the RAS server to answer the phone after 5 rings? I
>tried setting it on the Zyxel modem but it seems
> that the RAS setting gets higher priority when it comes to settings!

Unless you're suffering security problems because of this, please take
these sort of questions to USENET.

This is a _security_ mailing list, not a general help desk for NT.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Dennis,

Changing user descriptions w/User Mangler is pretty easy. All you need
to do is select the first user of the bunch, hold the Ctrl or Shift
key(s) and select the others in normal Windows fashion. Then you can
either pull down User and select Properties or just hit Enter. The
screen that opens will allow you to change the following items:

-- Description
-- "User Must Change Password at Next Logon"
-- "Users Cannot Change Password"
-- "Passwords Never Expire"
-- "Accounts Disabled"
-- "Accounts Locked Out"
-- Groups
-- Profile (personally, I use this one all the time.)
-- Hours
-- Logon To
-- Account
-- Dialin (NT 4 only)

The only thing obviously missing is Password, but I think I remember
seeing a mass password-change utility somewhere. Can anyone else help
with this?

L8R!

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com



> -----Original Message-----
> From: D. Flagg [SMTP:clay@halcyon.com]
> Sent: Thursday, August 14, 1997 18:22
> To: ntsecurity@iss.net
> Subject: [NTSEC] editing user profile & description in batch
> 
> Is there anything like addusers.exe that can edit a batch of selected
> users via a batch file. We find as department names change we need to
> reset large groups of user descriptions periodically. Altering each
> one with user manager is too time consuming.
> 
> Thanks
> 
> 
> Dennis C. Flagg
> These views are my own and not necessarily the views of my employer. 
> 

Setting up an NT server for remote telnet sessions, which is the most
secure, bug-free product to get? I've had some personal experience with
SLnet, and the configuration seems fairly straitforward, however I was not
informed of any security pros or cons within the product. Any advice is
appreciated.


Franco Gasperino
Cutting Edge Communications
509-444-INET
awe@cet.com
Any known concerns with applications, printers or install scripts leaving
.tmp files laying around? (Yeah, I know, it depends...)

I mean known, documented security bugs, other than having to define 'set
tmp=:\temp' to prevent against a potential
D.O.S. attack from a full system disk.

BTW - I know what service could create a dhcp.tmp file ;^) , but what
besides a print queue would create a file called ~pst2297.tmp? Adobe
Acrobat? It would be nice if there were a 'creator' identification property
which identified the application creating it, and was differentiated from
'owner'.

Bill Stout

We just installed it for a client in Houston. They have a Novell network
and are
using an NT4.0 server as a communication server. They dial into it with 
a modem and they also wanted to use PPTP over the Internet for out of town
employees. They have a single (64kb) channel ISDN line into their office.

As the first test, we dialed into the Internet from outside the office with
a 
single (64kb) channel ISDN line and then connected to the Novell network 
using PPTP. The performance was slow. When we 
dialed into the Internet using a 28.8 modem and connected to the server
using PPTP, the performance was real bad (unuseable).
An employee in Calgary plans on getting an ADSL connection(for $50/month)
and we hope that with the increased speed, the PPTP will be useable.

I think the key is to run the applications on the server (like PCAnywhere
does) and
not try to transport the whole application process over the lines like PPTP
and
Dial-Up networking does.

Layne 


----------
> From: Jiva DeVoe 
> To: Matt Gillard ; "Det. Mike Stephan"

> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] NT 4.0 Point to Point Tunneling Protocol (PPTP)
> Date: Monday, August 11, 1997 9:29 PM
> 
> It's funny this topic should come up, as I am in the process right now of
> evaluating PPTP for our across the internet communications. My findings
> show that the transmission speed is actually surprisingly reasonable! I
> mean, I'd no more want to run a 30 MB access database scan over a 28.8k
> modem than anyone else, but preliminarily, it looks really good. Using
> outlook for instance was about equal to using it on the LAN, and I have
it
> installed to run off the server!!
> 
> At 10:00 AM 8/12/97 EST, Matt Gillard wrote:
> >> My questions to the group are:
> >> 1) Does anyone know secure this protocol really is?
> >
> >Well, I would only use it if cost was an issue. I would prefer to use 
> >something that is a little more suited for the job than an operating
system
> >add-in. For example Alta-Vista Tunnel is a good one. Digital made this
> >product and for anyone *serious* about doing this type of stuff they
> >would have much better piece of mind than using Microsofts stuff.
> >eg: I would not recommend a bank use PPTP as an example....:)
> >
> >> 2) Am I correctly reading the usage of PPTP?
> >
> >yep.
> >
> >> 3) Does anyone see an obvious glitch that I am overlooking? Seems too
> >> good to be true as advertised.
> >> 4) What does PPTP cost in terms of data transmission speed?
> >> 
> >
> >Not sure about that. AFAIK it is reasonable...anyone?
> 
> -------------------------------------------
> Jiva DeVoe, MCSE
> jiva@devware.com
> http://www.devware.com
I will not be in the office from 11/8/97 to 15/8/97. If you had any urgent matter, please contact BAEY (Email id : DSSDBCC or Tel 321 5720).



We found that the PPTP connection was liable to go down at any hint of
trouble

(28.8 k modem to ISP to 128k ISDN)
its slow too, but the fact that it died so often was the reason we got
rid of it..

Cheers
 
Sven Dowideit
>-----Original Message-----
>From: Layne Scholl [SMTP:lscholl@houstonweb.com]
>Sent: Friday, August 15, 1997 2:52 PM
>To: Jiva DeVoe; Matt Gillard; "Det. Mike Stephan"
>Cc: ntsecurity@iss.net
>Subject: Re: [NTSEC] NT 4.0 Point to Point Tunneling Protocol (PPTP)
>
>We just installed it for a client in Houston. They have a Novell network
>and are
>using an NT4.0 server as a communication server. They dial into it with 
>a modem and they also wanted to use PPTP over the Internet for out of town
>employees. They have a single (64kb) channel ISDN line into their office.
>
>As the first test, we dialed into the Internet from outside the office with
>a 
>single (64kb) channel ISDN line and then connected to the Novell network 
>using PPTP. The performance was slow. When we 
>dialed into the Internet using a 28.8 modem and connected to the server
>using PPTP, the performance was real bad (unuseable).
>An employee in Calgary plans on getting an ADSL connection(for $50/month)
>and we hope that with the increased speed, the PPTP will be useable.
>
>I think the key is to run the applications on the server (like PCAnywhere
>does) and
>not try to transport the whole application process over the lines like PPTP
>and
>Dial-Up networking does.
>
>Layne 
>
>
>----------
>> From: Jiva DeVoe 
>> To: Matt Gillard ; "Det. Mike Stephan"
>
>> Cc: ntsecurity@iss.net
>> Subject: Re: [NTSEC] NT 4.0 Point to Point Tunneling Protocol (PPTP)
>> Date: Monday, August 11, 1997 9:29 PM
>> 
>> It's funny this topic should come up, as I am in the process right now of
>> evaluating PPTP for our across the internet communications. My findings
>> show that the transmission speed is actually surprisingly reasonable! I
>> mean, I'd no more want to run a 30 MB access database scan over a 28.8k
>> modem than anyone else, but preliminarily, it looks really good. Using
>> outlook for instance was about equal to using it on the LAN, and I have
>it
>> installed to run off the server!!
>> 
>> At 10:00 AM 8/12/97 EST, Matt Gillard wrote:
>> >> My questions to the group are:
>> >> 1) Does anyone know secure this protocol really is?
>> >
>> >Well, I would only use it if cost was an issue. I would prefer to use 
>> >something that is a little more suited for the job than an operating
>system
>> >add-in. For example Alta-Vista Tunnel is a good one. Digital made this
>> >product and for anyone *serious* about doing this type of stuff they
>> >would have much better piece of mind than using Microsofts stuff.
>> >eg: I would not recommend a bank use PPTP as an example....:)
>> >
>> >> 2) Am I correctly reading the usage of PPTP?
>> >
>> >yep.
>> >
>> >> 3) Does anyone see an obvious glitch that I am overlooking? Seems too
>> >> good to be true as advertised.
>> >> 4) What does PPTP cost in terms of data transmission speed?
>> >> 
>> >
>> >Not sure about that. AFAIK it is reasonable...anyone?
>> 
>> -------------------------------------------
>> Jiva DeVoe, MCSE
>> jiva@devware.com
>> http://www.devware.com
Dear Friends.

There are two major types of firewalls deployed as Internet gateways at
present:"Filtering Gateways" and "Application Gateways". Both firewall 
designs aim to implement and enforce network security.

As I understand "Filtering Gateways" essentially make routing decisions
based on information contained at the packet level. If a packet content 
meets the security policy criteria (Port, Ip, Dest.) it is forwarded, or
routed 
to the other side of the gateway. Otherwise it is blocked out.

"Application Gateways", unlike "Filtering Gateways", operate at the
connection rather than packet level (user name, protocol specific 
operation: Get, Put)

"Application Gateways" are known to be more secure then "Filtering
Gateways" because they require the firewall provider to understand the
security implications of supporting an application. They provide proxies
for each service running behind the firewall.

A good "Firewall Application Gateway" will combine "Filtering Gateways"
features AND provide various proxies for services, running behind the 
proxy server, that will examine each packet internal 
content structure prior sending the packet to the specific service (e.g.
email message packet structure). 

"Microsoft Proxy Server was primarily designed to manage outbound
connections and provide performance enhancements for clients on an 
internal network accessing the Internet."

This Design concept makes it a good "Application Gateway".

In my opinion The MAIN Job of a firewall is to address the security
issues of
inbound connections coming from the Internet. 

At this point Microsoft Proxy Server uses a mechanism called Dynamic
packet 
filtering a method that resembles "Filtering Gateways"

Unfortunately I have found NO information on how Microsoft Proxy Server
deals with packet (What proxy services they provide for specific network
services)
coming from the Internet. I will try explaining my point 
using an example.

Suppose I have a network with two servers, one is a Microsoft Proxy
Server
connected to the Internet the other is a Microsoft Exchange Server
sitting 
behind the proxy server. The exchange server is "server proxied" to 
the proxy server.

Now using dynamic packet filter option on the proxy server, if I try to
initiate a session with the exchange server using a host on the internet 
(untrusted network)for the propose of checking my 
mailbox the proxy server will open for me a connection 
for the specific session. 

It provides 'direct' connectivity between Me (Untrusted) 
and the mail system (trusted). I know that the proxy server forwards the
packets to the exchange server not opening a real direct connection but
before it sends the packets

DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL INTEGRATIY 
AND THE STRUCTRE OF THE SMTP PACKET?

AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER) MICROSOFT PROXY
SERVER IS REGULER PACKET FILLTERING GATEWAY WHEN IT COMES OUT OF THE BOX
NAKED
(REGRADING INBOUND CONNECTIONS FROM THE INTERNET).

Microsoft Proxy Server functionality can be extended using ISAPI (e.g.
packet Virus checking etc.)
BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"? 

I posted this message at a couple of proxy server newsgroups on msnews
server
but didn't get any response.

I decided to post the message on ntsecurity@iss.net because the matter
affects anyone who consults about or deal with NT security.

I would appreciate any comment on the matter presented. 

Yours Truly,

Itai Dor-on
Check chapter 5 of the NT4.0 Resource kit. How to make a bootable
floppy is outlined there. I've done it, and it works... Also saves your
bacon when someone "cleans up" their hard disk...

David LeBlanc wrote:
> 
> At 23:11 8/13/97 +1000, you wrote:
> >>The problem was that my HDD was infected by a boot sector virus(FORM-A),
> 
> >I take standard virus removal stuff failed...
> 
> I think you ought to be able to use a DOS floppy and run fdisk /MBR a few
> times and cure this. Worked for me.
> 
> >>Maybe it would be a nice function for NT to allow the creation of a set
> >>of repair disks that can actually save the entire boot sector to
> >>floppies, instead of just the files of the repair directory.
> 
> What I'd like to see would be a way to build an NT boot floppy that would
> have just enough brains to run chkdsk, format, and fdisk.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |

-- 
Don Hickey (hickdon@statcan.ca)
Senior Systems Administrator
Statistics Canada
Voice (613) 951-0605 Fax (613)951-0607
For those of us without the Resource Kit, can you please explain what 
programs we need and how to do this?

On Fri, 15 Aug 1997 09:13:44 -0400,
hickdon@statcan.ca wrote...
>Check chapter 5 of the NT4.0 Resource kit. How to make a bootable
>floppy is outlined there. I've done it, and it works... Also saves your
>bacon when someone "cleans up" their hard disk...
>
>David LeBlanc wrote:
>> 
>> At 23:11 8/13/97 +1000, you wrote:
>> >>The problem was that my HDD was infected by a boot sector 
virus(FORM-A),
>> 
>> >I take standard virus removal stuff failed...
>> 
>> I think you ought to be able to use a DOS floppy and run fdisk /MBR a few
>> times and cure this. Worked for me.
>> 
>> >>Maybe it would be a nice function for NT to allow the creation of a set
>> >>of repair disks that can actually save the entire boot sector to
>> >>floppies, instead of just the files of the repair directory.
>> 
>> What I'd like to see would be a way to build an NT boot floppy that would
>> have just enough brains to run chkdsk, format, and fdisk.
>> 
>> -----------------------------------------------------------
>> David LeBlanc | Voice: (770)395-0150 x138
>> Internet Security Systems, Inc. | Fax: (404)395-1972
>> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
>> Suite 660 | www: http://www.iss.net/
>> Atlanta, GA 30328 |
>
>-- 
>Don Hickey (hickdon@statcan.ca)
>Senior Systems Administrator
>Statistics Canada
>Voice (613) 951-0605 Fax (613)951-0607
>
>
>

-----------------------------------------------------
RezPhreak Server Administrator

IRC Clients: minn.starchat.net Ports 6660-7000
IRC via the WWW: http://irc.minn.net:8080
Homepage: http://www1.minn.net/~sathia
-----------------------------------------------------


IMHO, Proxy server is not a true firewall solution. The intent is to provide faster, centralized access for internal clients to access Internet Services, with some logging and filtering abilities. In every case I have found, MS recommends against using the Proxy server to provide access to the Internal network from the Internet. In fact, according to the MS Proxy FAQ (www.microsoft.comSupport/products/backoffice/proxyserver/content/faq/misc/303.htm): 

"Proxy Server version 1.0 is not a true firewall. However, like a firewall, it is very secure. Proxy Server does not route TCP/IP packets; the network cards are actually disjointed. 

There are no advanced firewall features like packet filtering and alerting and inbound connection capability that most expensive firewalls contain. The Proxy Server can be used in addition to a firewall, or it can be used in place of a firewall on smaller networks. "

Specifically regarding external SMTP (or any Non CERN-Proxy compatiable application), the following quote is from the Proxy Server FAQ:
"Can I place my SMTP (or Internet Mail connector) server behind my Proxy server? 

Yes, you can but it will not be able to receive connections from the Internet. The Proxy server is a one way connection. Mail servers need to listen for connections from the Internet to exchange mail with other mail servers and these connections will be blocked by the proxy. There are two workarounds: 

*Install your mail server on another machine that is directly connected to the Internet. Your mail clients on the Intranet will be able to connect with POP or SMTP through the Proxy server. 

*Install your mail server on the proxy server. It will be exposed to all networks that the proxy server is connected to. 

NOTE: The first option is the preferred method because it is good practice to minimize the number of services running on the proxy server. Extra services on the proxy server provide more points of access for attack from potential hackers. "

I believe that the problem is that the only support that MS Proxy server provides for external access to the Internal network is though the CERN-Proxy (WEB Proxy) and not the WinSock Proxy. The CERN Proxy is limited to HTTP, FTP, Gopher, HTTPS and a few others -- and to enable these few protocols, you must enable Internet Publishing. The proxy server does not "listen" for connections on any other ports. In addition, MS generally does not recommend allowing even this limited access to external users.

There are several good filrewalls available for Windows NT, we commonly use the Raptor Eagle NT Product for our clients. The only time we deploy a proxy server is in two cases:
1. The client does not require ANY external access to their internal network (including HTTP or SMTP).
2. The client already has firewall in place and wants to increase the performance of their current Internet connection (Proxy server is placed behind the firewall).

Suzanne Harris
Microsoft Integration Team Leader
Sr. Systems Engineer
Computer Tech, Inc.
Houston, TX


>>> Itai Dor-on 08/15/97 06:33am >>>
>Dear Friends.

>There are two major types of firewalls deployed as Internet gateways
> at present:"Filtering Gateways" and "Application Gateways". Both
> firewall designs aim to implement and enforce network security.

>As I understand "Filtering Gateways" essentially make routing decisions
>based on information contained at the packet level. If a packet content 
>meets the security policy criteria (Port, Ip, Dest.) it is forwarded, or
>routed to the other side of the gateway. Otherwise it is blocked out.

>"Application Gateways", unlike "Filtering Gateways", operate at the
>connection rather than packet level (user name, protocol specific 
>operation: Get, Put)

>"Application Gateways" are known to be more secure then "Filtering
>Gateways" because they require the firewall provider to understand
>the security implications of supporting an application. They provide
>proxies for each service running behind the firewall.

>A good "Firewall Application Gateway" will combine "Filtering
> Gateways" features AND provide various proxies for services,
> running behind the proxy server, that will examine each packet
> internal content structure prior sending the packet to the specific
> service (e.g.email message packet structure). 

>"Microsoft Proxy Server was primarily designed to manage outbound
>connections and provide performance enhancements for clients on an 
>internal network accessing the Internet."

>This Design concept makes it a good "Application Gateway".

>In my opinion The MAIN Job of a firewall is to address the security
>issues of inbound connections coming from the Internet. 

>At this point Microsoft Proxy Server uses a mechanism called Dynamic
packet filtering a method that resembles "Filtering Gateways"

>Unfortunately I have found NO information on how Microsoft Proxy
>Server deals with packet (What proxy services they provide for
> specific network services) coming from the Internet. I will try
> explaining my point using an example.

>Suppose I have a network with two servers, one is a Microsoft Proxy
>Server connected to the Internet the other is a Microsoft Exchange
> Server sitting behind the proxy server. The exchange server is
> "server proxied" to the proxy server.

>Now using dynamic packet filter option on the proxy server, if I try to
>initiate a session with the exchange server using a host on the internet 
>(untrusted network)for the propose of checking my 
>mailbox the proxy server will open for me a connection 
>for the specific session. 

>It provides 'direct' connectivity between Me (Untrusted) 
>and the mail system (trusted). I know that the proxy server forwards
> thepackets to the exchange server not opening a real direct connection
> butbefore it sends the packets

>DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL
> INTEGRATIY AND THE STRUCTRE OF THE SMTP PACKET?

>AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER)
> MICROSOFT PROXYSERVER IS REGULER PACKET FILLTERING
> GATEWAY WHEN IT COMES OUT OF THE BOXNAKED
>(REGRADING INBOUND CONNECTIONS FROM THE INTERNET).

>Microsoft Proxy Server functionality can be extended using ISAPI (e.g.
>packet Virus checking etc.)
>BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"? 

>I posted this message at a couple of proxy server newsgroups on
> msnews server but didn't get any response.

>I decided to post the message on ntsecurity@iss.net because the
> matteraffects anyone who consults about or deal with NT security.


>I would appreciate any comment on the matter presented. 

>Yours Truly,

>Itai Dor-on

 That's true for Proxy server 1, but proxy server 2 is being touted as
a firewall solution. We've installed the beta and have started playing
with it Interestingly, it really mucks around with web browsers. It
pretty much killed IE4 on a coworkers machine. Uninstalling the proxy
client did NOT fix his problems. When I tried it, it added a slew of
(invalid) settings to my copy of IE 3, and pretty much disabled web
access from my machine. Uninstalling it seemed to fix everything. Of
course, it didn't ask before making changes, some of which are darn
inobvious.
 Anyway, Proxy server 2 supports PPTP, packet filtering, and "server
proxying."

Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com 
Home: swaim@phoenix.net or maybe swaim@c-com.net, I don't know.
Disclaimer: I Lie

> -----Original Message-----
> From: Suzanne Harris [SMTP:SHARRIS@COMT.COM]
> Sent: Friday, August 15, 1997 9:34 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Microsft Proxy server securitly issues? -Reply
> 
> IMHO, Proxy server is not a true firewall solution. The intent is to
> provide faster, centralized access for internal clients to access
> Internet Services, with some logging and filtering abilities. In
> every case I have found, MS recommends against using the Proxy server
> to provide access to the Internal network from the Internet. In
> fact, according to the MS Proxy FAQ
> (www.microsoft.comSupport/products/backoffice/proxyserver/content/faq/
> misc/303.htm): 
> 
> "Proxy Server version 1.0 is not a true firewall. However, like a
> firewall, it is very secure. Proxy Server does not route TCP/IP
> packets; the network cards are actually disjointed. 
> 
> 
I know that many sources recommend a warning message when users log on
saying that you are entering a private network and if you don't belong
leave (or words to that effect). When and why is this warning
necessary? In NT the message comes up after you have logged in, so you
have already entered an id and password. It seems that you are either
authorized or serious about breaking in. In either case the warning
seems to serve little good. Is some sort of legal requirement that I
have missed?

The warning you are referring to is something that can be set up on each
workstation and appears between your pressing CAD, and the Winlogon dialog
box. I can point you to the Registry entries to be made if you'd like.

I don't know if it is a C2 requirement ( I doubt it), but it can provide a
legally binding warning to someone that if they futz with your machines,
they can be held liable.

Erik

 *----------------------------*
 |Erik P. Sojka |
 |Network Administrator |
 |SCT Manufacturing Systems |
 |esojka@sctcorp.com |
 *----------------------------*






WarrenD@kmg.com on 08/15/97 11:31:33 AM

Please respond to WarrenD@kmg.com

To: ntsecurity@iss.net
cc: (bcc: Erik Sojka/MDS/SCT)
Subject: [NTSEC] warning messages




I know that many sources recommend a warning message when users log on
saying that you are entering a private network and if you don't belong
leave (or words to that effect). When and why is this warning
necessary? In NT the message comes up after you have logged in, so you
have already entered an id and password. It seems that you are either
authorized or serious about breaking in. In either case the warning
seems to serve little good. Is some sort of legal requirement that I
have missed?







>I know that many sources recommend a warning message when users log on
>saying that you are entering a private network and if you don't belong
>leave (or words to that effect). When and why is this warning
>necessary? In NT the message comes up after you have logged in, so you
>have already entered an id and password. It seems that you are either
>authorized or serious about breaking in. In either case the warning
>seems to serve little good. Is some sort of legal requirement that I
>have missed?

It's sort of a technicality, which *would* become a legal issue were you to try to prosecute, for instance, a hacker.

If you have "Welcome to xyz inc." as your opening remark, the courts would most likely throw you out on this technicality. If, however, you have "Do not proceed unless you have permission... blah blah legalese...." then you stand a chance of successfully prosecuting unauthorised access.

It's also part of the C2 requirements...




The only issues I've seen are that such files usually have the default
ACL of the directory into which they are installed, which may mean that
they are less well protected than the user file whose data they (the
temp file) contains. /TEMP can be given a sensible ACL that protects
files (butnot directories) created therein. If the temp file is created
in the same directory as the original file, it's important that users
not restrict the ACL on a file to be tighter than what a newly created
file (like the temp file) would receive when created in the directory.
This is the standard advice of relying on default ACLs as much as
possible.

Not sure if this was the kind of thing you're looking for, though. It's
pretty standard stuff.
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
 Correction

>It's also part of the C2 requirements...

It's also part of the C2 recommendations, not requirements

I am not positive of this... But at an NT class I attended a few weeks
ago, the instructor mentioned the need for a 'warning message' and said
that it was based on a court case where a hacker was found not guilty based
on the fact that he was not aware that the system was closed.. (ya,
right..)I guess the argument was that IF he was not allowed into the
computer system, they would have 'warned' him that it was not legal to enter. 

This is based on failing personal SIMMs, so don't hold me to it!!!



At 11:46 AM 8/15/97 -0400, Erik Sojka wrote:
>
>The warning you are referring to is something that can be set up on each
>workstation and appears between your pressing CAD, and the Winlogon dialog
>box. I can point you to the Registry entries to be made if you'd like.
>
>I don't know if it is a C2 requirement ( I doubt it), but it can provide a
>legally binding warning to someone that if they futz with your machines,
>they can be held liable.
>
>Erik
>
> *----------------------------*
> |Erik P. Sojka |
> |Network Administrator |
> |SCT Manufacturing Systems |
> |esojka@sctcorp.com |
> *----------------------------*
>
>
>
>
>
>
>WarrenD@kmg.com on 08/15/97 11:31:33 AM
>
>Please respond to WarrenD@kmg.com
>
>To: ntsecurity@iss.net
>cc: (bcc: Erik Sojka/MDS/SCT)
>Subject: [NTSEC] warning messages
>
>
>
>
>I know that many sources recommend a warning message when users log on
>saying that you are entering a private network and if you don't belong
>leave (or words to that effect). When and why is this warning
>necessary? In NT the message comes up after you have logged in, so you
>have already entered an id and password. It seems that you are either
>authorized or serious about breaking in. In either case the warning
>seems to serve little good. Is some sort of legal requirement that I
>have missed?
>
>
>
>
>
>
>
>
 Joel Oelfke
 Montana PSC
 Joelfke@mt.gov
> I believe that the problem is that the only support that MS Proxy server provides for
> external access to the Internal network is though the CERN-Proxy (WEB Proxy) and not the
> WinSock Proxy. 

MSP 1.0 allows "inbound" connections where internal listens are actually
posted to the external MSP network. This (so says the documentation)
allows external clients to connect to internal servers through the
proxy. Internal servers have to bind the MSP external network address to
their socket, which is the Proxy Client's signal to proxy the request.
Note that if the internal network is running only IPX, ALL WinSock
listen requests are proxied to the external network, which make is
pretty easy to accidentally install an internal service that
accidentally serves the external network. One controls this by tightly
configuring the MSP permissions.

All this is reasonably describe in App D of the MSP manual -- a tedious
but worthwhile read. (BTW, the appendices of this manual are its better
parts!)

Having said all this, I've only recently been looking into "inbound"
connections and haven't had much chance to try it out.
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
On Fri, 15 Aug 1997, Ron Schreiner wrote:

> For those of us without the Resource Kit, can you please explain what 
> programs we need and how to do this?

Format a disk under NT - sorry you need to do this on a live NT box so
that the NT boot sector makes its way to the floppy.

Copy the following files to the floppy:

 NTLDR
 NTDETECT.COM
 BOOT.INI
 BOOTSECT.DOS (if you care to boot dos.)
 NTBOOTDD.SYS (if boot off romless SCSI controllers)
 
Not sure for RISC off the top of my head, but probably very similar, but
you'll need to copy the \OS directory off the system drive if I recall
right (and I probably don't.)

Now back to our normal SECURITY related discussions. :)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================


So what ACL's do your reccomend for temp then?

 Dir: Creator/Owner: Full
 Everyone: what? Add?

On Sat, 16 Aug 1997, Steve Sutton wrote:

> The only issues I've seen are that such files usually have the default
> ACL of the directory into which they are installed, which may mean that
> they are less well protected than the user file whose data they (the
> temp file) contains. /TEMP can be given a sensible ACL that protects
> files (butnot directories) created therein. If the temp file is created
> in the same directory as the original file, it's important that users
> not restrict the ACL on a file to be tighter than what a newly created
> file (like the temp file) would receive when created in the directory.
> This is the standard advice of relying on default ACLs as much as
> possible.
> 
> Not sure if this was the kind of thing you're looking for, though. It's
> pretty standard stuff.
> -- 
> STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
> Phone: (217) 344-0996 1107 S. Orchard Street
> FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
> E-mail: SSutton@TrustedSystems.com 
> WWW: http://www.TrustedSystems.com/
> 

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

With NT you can enable a Logon Banner that pops up before the logon screen. 
The easiest way to do this is through the System Policy Editor. Select 
Default Computer Properties then Windows NT System then Logon for the Logon 
Banner property.

One of the reasons M$ implemented this is because there was a hacker who 
broke into some systems a few years back and was caught. At his trial he got 
off the charges because the logon banner said "Welcome to xxxxx system, 
please login."


--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Decker, Warren [SMTP:WarrenD@kmg.com]
Sent: Friday, August 15, 1997 11:32 AM
To: ntsecurity@iss.net
Subject: [NTSEC] warning messages

I know that many sources recommend a warning message when users log on
saying that you are entering a private network and if you don't belong
leave (or words to that effect). When and why is this warning
necessary? In NT the message comes up after you have logged in, so you
have already entered an id and password. It seems that you are either
authorized or serious about breaking in. In either case the warning
seems to serve little good. Is some sort of legal requirement that I
have missed?

I am doing intrusion test on a NT system. How can I get the SAM files from
the NT system using Linux system as the Hacker's Workbench?

Any information or pointers is greatly appreciated.

Thank you.

SubbaRao
-- 
-----------------------------------------------------------
Counseling for Internet Addicts
subb3@ibm.net ( Subba Rao )
-----------------------------------------------------------

I have the disclaimer set on my PC (via Policy Editor) to display a warning to
the same effect. It serves as a legal reminder. Without it, people are legally
permitted to "hack" and "play" with the PC, especially if it is in a less than
private area. 

In a workplace, people are allow to walk up to a PC and try whatever passwords
they like, but are only legally wrong if that warning is there, at least in the
US.

Chris Mulcahy
cmulcahy@omnisource.com

____________________Reply Separator____________________
Subject: [NTSEC] warning messages
Author: MIME:WarrenD@kmg.com
Date: 8/15/97 10:45 AM

I know that many sources recommend a warning message when users log on
saying that you are entering a private network and if you don't belong
leave (or words to that effect). When and why is this warning
necessary? In NT the message comes up after you have logged in, so you
have already entered an id and password. It seems that you are either
authorized or serious about breaking in. In either case the warning
seems to serve little good. Is some sort of legal requirement that I
have missed?

 

This is my first post to this list, so please bear with me.

I run an IRC Server made by Webmaster, Inc, (www.webmaster.com) called 
ConferenceRoom that is running as a Service under NT. I am wondering if 
there is a program out there that I can setup to run on the server itself, 
OR for me to run manually whenever I am online, to automatically check for 
and log to a text file, any ICMP floods, Nukes (Port 139, etc) or other DOS
(Denial Of Service) attacks. Ideally, the software should seet if user A 
does something to user B, even if they aren't on my server. I am just 
looking for some way to determine these abuses.

If any of this is possible, what program(s) do I use, and where and how do
I get it/them?

I realize there is NetXray for LANs and WebXray, however I can't justify 
paying $900 some dollars when we paid only $295.00 for the IRC Server 
software itself.(CR now costs $495.00) If anyone wants to download a 30 day 
working demo to test out an idea on, you can do so at the URL I listed in 
the beginning of this letter.

I realize this is a borderline NT Security question, but I am concerned over 
the NT Server, IRC Server, and the users. Please don't flame me because it 
isn't an NT LAN question. It's a genuine security issue.

Thanks,

Ron
 -------------------------------------------------
 ---------------------------------------------------
| RezPhreak Server Administrator |
|___________________________________________________|
|IRC Clients: minn.starchat.net |
|IRC via the WWW: http://irc.minn.net:8080 |
|Homepage: http://www1.minn.net/~sathia |
 ---------------------------------------------------
 -------------------------------------------------


Warren,

The benefit of the 'banner' statement is strictly from a prosecution
standpoint. Although a welcome mat at your door isn't necessarily an
invitation for anyone who walks up to your door to come through it, a
court of law decided that a welcome banner was an invitation. 

The defacto banner was created by Scott Charney, Dept. of Justice and is
as follows:
"This system is for the use of authorized users only. Individuals using
this computing system without authority, or in excess of their
authority, are subject to having all of their activities on this system
monitored and recorded by system personnel.

In the course of monitoring individuals improperly using this system, or
in the course of system maintenance, the activities of authorized users
may be monitored. 

Anyone using this system expressly consents to such monitoring and is
advised that if such monitoring reveals possible evidence of criminal
activity, system personnel may provide the evidence of such monitoring
to law enforcement officials."

Hope this helps.

Steve Trolan
Information Security
strolan@altera.com

> -----Original Message-----
> From: Decker, Warren [SMTP:WarrenD@kmg.com]
> Sent: Friday, August 15, 1997 8:32 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] warning messages
> 
> I know that many sources recommend a warning message when users log on
> saying that you are entering a private network and if you don't belong
> leave (or words to that effect). When and why is this warning
> necessary? In NT the message comes up after you have logged in, so
> you
> have already entered an id and password. It seems that you are either
> authorized or serious about breaking in. In either case the warning
> seems to serve little good. Is some sort of legal requirement that I
> have missed?
I have seen some postings here regarding the ScanNT pro. I have and use 
it, but what I really would like is a bigger and better dictionary. Has 
anyone created a large dictionary of words, and could send it to me.

Thanks in advance.

Bill Breen
System Administrator
Level One Communications

Attached is the snippet from the resource kit... No guarantees, at your
own risk etc etc etc....

Ron Schreiner wrote:
> 
> For those of us without the Resource Kit, can you please explain what
> programs we need and how to do this?
> 
> On Fri, 15 Aug 1997 09:13:44 -0400,
> hickdon@statcan.ca wrote...
> >Check chapter 5 of the NT4.0 Resource kit. How to make a bootable
> >floppy is outlined there. I've done it, and it works... Also saves your
> >bacon when someone "cleans up" their hard disk...
> >
> >David LeBlanc wrote:
> >>
> >> At 23:11 8/13/97 +1000, you wrote:
> >> >>The problem was that my HDD was infected by a boot sector
> virus(FORM-A),
> >>
> >> >I take standard virus removal stuff failed...
> >>
> >> I think you ought to be able to use a DOS floppy and run fdisk /MBR a few
> >> times and cure this. Worked for me.
> >>
> >> >>Maybe it would be a nice function for NT to allow the creation of a set
> >> >>of repair disks that can actually save the entire boot sector to
> >> >>floppies, instead of just the files of the repair directory.
> >>
> >> What I'd like to see would be a way to build an NT boot floppy that would
> >> have just enough brains to run chkdsk, format, and fdisk.
> >>
> >> -----------------------------------------------------------
> >> David LeBlanc | Voice: (770)395-0150 x138
> >> Internet Security Systems, Inc. | Fax: (404)395-1972
> >> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> >> Suite 660 | www: http://www.iss.net/
> >> Atlanta, GA 30328 |
> >
> >--
> >Don Hickey (hickdon@statcan.ca)
> >Senior Systems Administrator
> >Statistics Canada
> >Voice (613) 951-0605 Fax (613)951-0607
> >
> >
> >
> 
> -----------------------------------------------------
> RezPhreak Server Administrator
> 
> IRC Clients: minn.starchat.net Ports 6660-7000
> IRC via the WWW: http://irc.minn.net:8080
> Homepage: http://www1.minn.net/~sathia
> -----------------------------------------------------

-- 
Don Hickey (hickdon@statcan.ca)
Senior Systems Administrator
Statistics Canada
Voice (613) 951-0605 Fax (613)951-0607
1¾On Fri, 15 Aug 1997, Bob Love wrote:

> It's sort of a technicality, which *would* become a legal issue were you to try to prosecute, for instance, a hacker.
> 

*may*, not *would*.

> If you have "Welcome to xyz inc." as your opening remark, the courts would most likely throw you out on this technicality. If, however, you have "Do not proceed unless you have permission... blah blah legalese...." then you stand a chance of successfully prosecuting unauthorised access.

That's never been proven. Last time this came up in general
net conversation, nobody could find case law proving it, and it got
relegated to status of urban legend. I spent quite a while searching
around for a case where this was an issue, and never found one. I think
even a couple of lawgeeks on LACC did some searches, and couldn't retrieve
a single instance. 

This is of course a US-centric discussion.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Correction. I've just read the MS website and it says that Proxy 1.0
does not do the inbound processing its documentation claims it does. Is
this what you all have found? What's going on here?
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
The best you can do for /TEMP is to give Everyone (RWX)(NotSpecified)
access and CREATOR/OWNER Full Ctl. When a user creates a file, they have
full control, but the Everyone entry is not propagated, so the file is
essentially private to that user. Unfortunately, when a user creates a
subdirectory in /TEMP it gets the parent's ACL exactly. While that user
has full access, Everyone can create new entries in the new directory --
it's not really private. What you really need here is to make the
Everyone ACE in /TEMP an "asterisked" entry, meaning that it does not
propagate to subdirectories. Asterisked entries occur in NT but only as
a result of special CREATOR/OWNER creations -- file manager can't set
them. You can write your own programs to create such "asterisked"
directories, which is what I have taken to doing.

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
Hi.

I apologize to all the wonderful people taking the effort
to reply to my email message "Microsoft Proxy server security issues?"

I forgot to mention that I was referring to Microsoft Proxy Server
Version 2.0 (Beta) which is supposed to have firewall capabilities.
(Dynamic Packet Filter, Reverse Hosting & Etc.)


The majority of comments referred to Proxy server version 1.0 which
has no firewall capabilities, therefore they are irrelevant to my
statements.

If anybody would like to re-comment on the matter I am including in this 
email the original modified message.

Sincerely,
Itai Dor-on


"Dear Friends.

There are two major types of firewalls deployed as Internet gateways at
present:"Filtering Gateways" and "Application Gateways". Both firewall 
designs aim to implement and enforce network security.

As I understand "Filtering Gateways" essentially make routing decisions
based on information contained at the packet level. If a packet content 
meets the security policy criteria (Port, Ip, Dest.) it is forwarded, or
routed to the other side of the gateway. Otherwise it is blocked out.

"Application Gateways", unlike "Filtering Gateways", operate at the
connection rather than packet level (user name, protocol specific 
operation: Get, Put)

"Application Gateways" are known to be more secure then "Filtering
Gateways" because they require the firewall provider to understand the
security implications of supporting an application. They provide proxies
for each service running behind the firewall.

A good "Firewall Application Gateway" will combine "Filtering Gateways"
features AND provide various proxies for services, running behind the 
proxy server, that will examine each packet internal 
content structure prior sending the packet to the specific service (e.g.
email message packet structure). 

"Microsoft Proxy Server 2.0 (Beta) was primarily designed to manage
outbound
connections and provide performance enhancements for clients on an 
internal network accessing the Internet."

This Design concept makes it a good "Application Gateway".

In my opinion The MAIN Job of a firewall is to address the 
security issues of inbound connections coming from the Internet. 

At this point Microsoft Proxy Server 2.0 (Beta)uses a mechanism called
Dynamic
packet filtering a method that resembles "Filtering Gateways"

Unfortunately I have found NO information on how Proxy proxy server 2.0
(Beta)
deals with packet (What proxy services they provide for specific network
services) coming from the Internet. I will try explaining my point 
using an example.

Suppose I have a network with two servers, one is a Microsoft Proxy
Server connected to the Internet the other is a Microsoft Exchange
Server
sitting behind the proxy server. The exchange server is "server proxied"
to 
the proxy server.

Now using dynamic packet filter option on the proxy server, if I try to
initiate a session with the exchange server using a host on the internet 
(untrusted network)for the propose of checking my mailbox the proxy
server 
will open for me a connection for the specific session. 

It provides 'direct' connectivity between Me (Untrusted) and the mail
system 
(trusted). I know that the proxy server forwards the packets to the
exchange 
server not opening a real direct connection but before it sends the
packets

DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL INTEGRATIY 
AND THE STRUCTRE OF THE SMTP PACKET?

AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER) MICROSOFT PROXY
SERVER IS REGULER PACKET FILLTERING GATEWAY, THAT IS EQUIVELENT TO THE
"PORT RULES" FETURE IN THE TCPI/IP ADVANCED SETTINGS, WHEN IT COMES 
OUT OF THE BOX NAKED.(REGRADING INBOUND CONNECTIONS FROM THE INTERNET).

Microsoft Proxy Server 2.0 (Beta) functionality can be extended using
ISAPI (e.g.
packet Virus checking etc.)

BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"? 

I posted this message at a couple of proxy server newsgroups on msnews
server but didn't get any response.

I decided to post the message on ntsecurity@iss.net because the matter
affects anyone who consults about or deal with NT security.

I would appreciate any comment on the matter presented. 

Yours Truly,

Itai Dor-on"

 The Display of a legal notice on every computer attached to an 
 untrusted network such as the Internet warns intruders that access to 
 the system is limited only to employees and other authorized users and 
 that unauthorized attempts to access the system carry legal 
 liabilities. The legal notice is the equivalent of a "No Trespassing" 
 sign. Should an intruder decide to go beyond it, they cannot claim 
 later that they were unaware that they were engaging in unauthorized 
 activities.
 
 


Note that the "warning message" is limited to 256 bytes. I recently 
gave an NT security class where a student admin had a real problem: 
their legal department was demanding a warning message that had already
passed 2,000 bytes and was growing by the day. (I suggested a
compression algorithm. The message would of course be unreadable, but
that legal stuff is anyway.) 

Moral: A warning messages is fine, but don't let the lawyers write it!
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
>> So what ACL's do your reccomend for temp then?
>> So what ACL's do your reccomend for temp then?
>> >> 
>> Dir: Creator/Owner: Full
>> Everyone: what? Add?

I've been trying to tighten my permissions here and have found that
the lowest permission level that seemed to work was

 Administrators:F
 System:F
 "Creator Owner":F
 Everyone:C

which is, in fact, the default. This seems unreasonably lax but various
things broke with lower permissions for Everyone.
On Fri, 15 Aug 1997, Subba Rao wrote:

> I am doing intrusion test on a NT system. How can I get the SAM files from
> the NT system using Linux system as the Hacker's Workbench?

Try to get \\machinename\admin$\system32\config\sam and security, but you
won't get far since they're locked open exclusively by NT (even if you can
access the administrative sharepoint, which unless you authenticate as
admin, you can't.)

One thing you might want to try to attack is the RPC's that NT does. Try
to sniff an NT workstation running User Manager for Domains as it talks to
the PDC on the domain... There might be weaknesses there. Anyone know
the protocol NT uses for such remote admin stuff? RPC or IPC I assume?
Maybe using the IPC$ share?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

Disclaimer: despite my affiliation, I am not a MS Proxy Server expert.
And I do not dispute the MS Proxy 1.0 info in your post. However, I do
know that MS Proxy 2.0 is out in beta, and I believe that it claims more
firewallish functions, perhaps based upon the new MS "Steelhead" routing
infrastructure. 

> ----------
> From: Suzanne Harris[SMTP:SHARRIS@COMT.COM]
> Reply To: Suzanne Harris
> Sent: Friday, August 15, 1997 7:33 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Microsft Proxy server securitly issues? -Reply
> 
> IMHO, Proxy server is not a true firewall solution. The intent is to
> provide faster, centralized access for internal clients to access
> Internet Services, with some logging and filtering abilities. In
> every case I have found, MS recommends against using the Proxy server
> to provide access to the Internal network from the Internet. In
> fact, according to the MS Proxy FAQ
> (www.microsoft.comSupport/products/backoffice/proxyserver/content/faq/
> misc/303.htm): 
> 
 
On Fri, 15 Aug 1997, Steve Trolan wrote:

> Warren,
> 
> The benefit of the 'banner' statement is strictly from a prosecution
> standpoint. Although a welcome mat at your door isn't necessarily an
> invitation for anyone who walks up to your door to come through it, a
> court of law decided that a welcome banner was an invitation. 


Does this mean that to protect our homes we should replace our dormats
with the Tazmanian Devil one that says "Go Away?" :)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

Hi.

I apologize to all the wonderful people taking the effort
to reply to my email message "Microsoft Proxy server security issues?"

I forgot to mention that I was referring to Microsoft Proxy Server
Version 2.0 (Beta) which is supposed to have firewall capabilities.
(Dynamic Packet Filter, Reverse Hosting & Etc.)


The majority of comments referred to Proxy server version 1.0 which
has no firewall capabilities, therefore they are irrelevant to my
statements.

If anybody would like to re-comment on the matter I am including in this 
email the original modified message.

Sincerely,
Itai Dor-on


"Dear Friends.

There are two major types of firewalls deployed as Internet gateways at
present:"Filtering Gateways" and "Application Gateways". Both firewall 
designs aim to implement and enforce network security.

As I understand "Filtering Gateways" essentially make routing decisions
based on information contained at the packet level. If a packet content 
meets the security policy criteria (Port, Ip, Dest.) it is forwarded, or
routed to the other side of the gateway. Otherwise it is blocked out.

"Application Gateways", unlike "Filtering Gateways", operate at the
connection rather than packet level (user name, protocol specific 
operation: Get, Put)

"Application Gateways" are known to be more secure then "Filtering
Gateways" because they require the firewall provider to understand the
security implications of supporting an application. They provide proxies
for each service running behind the firewall.

A good "Firewall Application Gateway" will combine "Filtering Gateways"
features AND provide various proxies for services, running behind the 
proxy server, that will examine each packet internal 
content structure prior sending the packet to the specific service (e.g.
email message packet structure). 

"Microsoft Proxy Server 2.0 (Beta) was primarily designed to manage
outbound
connections and provide performance enhancements for clients on an 
internal network accessing the Internet."

This Design concept makes it a good "Application Gateway".

In my opinion The MAIN Job of a firewall is to address the 
security issues of inbound connections coming from the Internet. 

At this point Microsoft Proxy Server 2.0 (Beta)uses a mechanism called
Dynamic
packet filtering a method that resembles "Filtering Gateways"

Unfortunately I have found NO information on how Proxy proxy server 2.0
(Beta)
deals with packet (What proxy services they provide for specific network
services) coming from the Internet. I will try explaining my point 
using an example.

Suppose I have a network with two servers, one is a Microsoft Proxy
Server connected to the Internet the other is a Microsoft Exchange
Server
sitting behind the proxy server. The exchange server is "server proxied"
to 
the proxy server.

Now using dynamic packet filter option on the proxy server, if I try to
initiate a session with the exchange server using a host on the internet 
(untrusted network)for the propose of checking my mailbox the proxy
server 
will open for me a connection for the specific session. 

It provides 'direct' connectivity between Me (Untrusted) and the mail
system 
(trusted). I know that the proxy server forwards the packets to the
exchange 
server not opening a real direct connection but before it sends the
packets

DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL INTEGRATIY 
AND THE STRUCTRE OF THE SMTP PACKET?

AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER) MICROSOFT PROXY
SERVER IS REGULER PACKET FILLTERING GATEWAY, THAT IS EQUIVELENT TO THE
"PORT RULES" FETURE IN THE TCPI/IP ADVANCED SETTINGS, WHEN IT COMES 
OUT OF THE BOX NAKED.(REGRADING INBOUND CONNECTIONS FROM THE INTERNET).

Microsoft Proxy Server 2.0 (Beta) functionality can be extended using
ISAPI (e.g.
packet Virus checking etc.)

BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"? 

I posted this message at a couple of proxy server newsgroups on msnews
server but didn't get any response.

I decided to post the message on ntsecurity@iss.net because the matter
affects anyone who consults about or deal with NT security.

I would appreciate any comment on the matter presented. 

Yours Truly,

Itai Dor-on"
You wrote:
> On Fri, 15 Aug 1997, Bob Love wrote:
> 
> > It's sort of a technicality, which *would* become a legal issue
> > were you to try to prosecute, for instance, a hacker.
> > 
> 
> *may*, not *would*.
> 
> > If you have "Welcome to xyz inc." as your opening remark, the
> > courts would most likely throw you out on this technicality. If,
> > however, you have "Do not proceed unless you have permission...
> > blah blah legalese...." then you stand a chance of successfully
> > prosecuting unauthorised access.
> 
> That's never been proven. Last time this came up in general
> net conversation, nobody could find case law proving it, and it got
> relegated to status of urban legend. I spent quite a while
> searching around for a case where this was an issue, and never
> found one. I think even a couple of lawgeeks on LACC did some
> searches, and couldn't retrieve a single instance. 
> 
> This is of course a US-centric discussion.
> 
> Paul

 In two instances that I am aware of (one in Hawaii, the other in LA; both about ten years ago), the cases were never prosecuted as the sites displayed a "Welcome" banner. The cases were briefed at an ISSA conference 8 or 9 years ago. In general, the DA felt that because the screen displayed a "Welcome" notice, it was like an invite and refused to file charges. So, no, there is no existing case law.
 
 BTW, both instances involved DoD computers systems and soon after, mandated warning banners were required saying that unauthorized acces is prohibited and use of the DoD computer systems is subject to monitoring.
 
 The DoD now has a "standard" disclaimer that is required for all computer systems.
 
 John Stewart
 Information Systems Secuity
 SUPSHIP San DiegoOn Fri, 15 Aug 1997, John H. Stewart wrote:

> In two instances that I am aware of (one in Hawaii, the other in LA; both about ten years ago), the cases were never prosecuted as the sites displayed a "Welcome" banner. The cases were briefed at an ISSA conference 8 or 9 years ago. In general, the DA felt that because the screen displayed a "Welcome" notice, it was like an invite and refused to file charges. So, no, there is no existing case law.
> 
> BTW, both instances involved DoD computers systems and soon after, mandated warning banners were required saying that unauthorized acces is prohibited and use of the DoD computer systems is subject to monitoring.
> 
> The DoD now has a "standard" disclaimer that is required for all computer systems.

It's also a recommendation of the US DOJ that such a warning be displayed,
but again there is no precedent.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

At 12:29 8/15/97 -0400, you wrote:
>
>So what ACL's do your reccomend for temp then?
>
> Dir: Creator/Owner: Full
> Everyone: what? Add?

I would tend to go with:

Everyone: Add, (none)
Creator/Owner: RXWD, RWD

That should allow them to create files, but any files they do create will
be non-executable.

This is just off the top of my head, so...


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

The policy editor makes it a snap to add the "authorized use only" screen 
prior to displaying a logon dialog box.

I'd also like it displayed when attempts are made to unlock the 
server/workstation with CAD. Is there a separate registry key for adding 
this functionality? Can the actual logon dialog box be modified to 
display a company logo? Thanks for any pointers that the group can 
provide.

Greg Strabala
greg.strabala@icn.state.ia.us
One of the reasons not to use MS's release proxy server as a firewall is
that NT currently has no ability to drop source-routed packets. I am under
the impression that is being corrected in MS Proxy 2.0, and have hopes that
it will also be corrected in a service pack. I'm also in favor of more
"firewallish" functions for NT overall, as it will enhance our ability to
protect ourselves when we expose our machines to the internet without
benefit of firewalls. That's one of the things I really envy about the
Linux guys - they have a lot of nice functionality in that area that I just
can't do with NT out of the box.

At 11:39 8/15/97 -0700, you wrote:
>Disclaimer: despite my affiliation, I am not a MS Proxy Server expert.
>And I do not dispute the MS Proxy 1.0 info in your post. However, I do
>know that MS Proxy 2.0 is out in beta, and I believe that it claims more
>firewallish functions, perhaps based upon the new MS "Steelhead" routing
>infrastructure. 
>
>> ----------
>> From: Suzanne Harris[SMTP:SHARRIS@COMT.COM]
>> Reply To: Suzanne Harris
>> Sent: Friday, August 15, 1997 7:33 AM
>> To: ntsecurity@iss.net
>> Subject: [NTSEC] Microsft Proxy server securitly issues? -Reply
>> 
>> IMHO, Proxy server is not a true firewall solution. The intent is to
>> provide faster, centralized access for internal clients to access
>> Internet Services, with some logging and filtering abilities. In
>> every case I have found, MS recommends against using the Proxy server
>> to provide access to the Internal network from the Internet. In
>> fact, according to the MS Proxy FAQ
>> (www.microsoft.comSupport/products/backoffice/proxyserver/content/faq/
>> misc/303.htm): 
>> 
> 
>
>
-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 02:16 PM 8/15/97 -0400, Ray Arachelian wrote:
>On Fri, 15 Aug 1997, Subba Rao wrote:
>
>> I am doing intrusion test on a NT system. How can I get the SAM files from
>> the NT system using Linux system as the Hacker's Workbench?
>
>Try to get \\machinename\admin$\system32\config\sam and security, but you
>won't get far since they're locked open exclusively by NT (even if you can
>access the administrative sharepoint, which unless you authenticate as
>admin, you can't.)

With a Linux boot disk and a few add-ons it is possible to grab these if
one has physical access. Otherwise, one is better off going after the
%SystemRoot%\Repair copies.

>One thing you might want to try to attack is the RPC's that NT does. Try
>to sniff an NT workstation running User Manager for Domains as it talks to
>the PDC on the domain... There might be weaknesses there. Anyone know
>the protocol NT uses for such remote admin stuff? RPC or IPC I assume?
>Maybe using the IPC$ share?

It is RPC based ;) This is a good, but messy, place to look. The sessions
are encrypted, but that does not mean much - hint hint.


>=====================================Kaos=Keraunos=Kybernetos==============
>.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
You wrote:
> Note that the "warning message" is limited to 256 bytes. I recently
> gave an NT security class where a student admin had a real problem:
> their legal department was demanding a warning message that had
> already passed 2,000 bytes and was growing by the day. (I suggested
> a compression algorithm. The message would of course be unreadable,
> but that legal stuff is anyway.)
>
> Moral: A warning messages is fine, but don't let the lawyers write
> it! --
> STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
> Phone: (217) 344-0996 1107 S. Orchard Street
> FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
> E-mail: SSutton@TrustedSystems.com
> WWW: With a Linux boot disk and a few add-ons it is possible to grab these if
> one has physical access. Otherwise, one is better off going after the
> %SystemRoot%\Repair copies.

Only if the Administrator is runing RDISK /S or /S-, otherwise they'll get
only the administrator account from the day the machine was installed,
which would likely have an expired password. :)

RPC is likely the best way to go if you can find a hole...

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

At 03:54 PM 8/15/97 -0400, David LeBlanc wrote:
>I would tend to go with:
>
>Everyone: Add, (none)
>Creator/Owner: RXWD, RWD

Actually, can someone test out the following ACLs?

Everyone: Add, (not specified)
Creator/Owner: (not specified), Full Control
Optional -
Administrators: Full Control, Full Control

I believe this works, but I can't test it right now. What you want to avoid
is any user being able to view, execute, or delete another user's files in
the \temp directory, so there should be no overlapping directory
permissions. Steve Sutton's comments about non-inheritance for
subdirectories is a very good point if you have apps that blindly create
directories in \temp. Also, the fact that there is no read permission on
the directory itself could be an issue in some environments, in which case
Everyone could be changed to RWX, (not specified). 

>
>That should allow them to create files, but any files they do create will
>be non-executable.

I personally like being able to run certain things out of \temp, but in
general it is a good policy to not allow that activity. To do so with the
ACLs I proposed, change the Creator/Owner to (not specified), RWD.

>
>This is just off the top of my head, so...

Same here ;)

>-----------------------------------------------------------
>David LeBlanc | Voice: (770)395-0150 x138


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
The Simple TCP/IP service hotfix was discovered to have some problems
and was withdrawn. It has now been reposted at
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixe
s-postSP3/simptcp-fix

>From the KB article accompanying the fix:
 
Windows NT TCP/IP, Windows Sockets, and Simple TCP/IP services have been
modified to be more attack resistant. Windows Sockets now supports a new
socket option, SO_BROADCAST, that can be set to allow the recvfrom()
call
to pass broadcast datagrams to the application. The default for this
option
is OFF. Previous implementations passed broadcasts datagrams to any
Windows
Sockets application that issued a recvfrom() call. Additionally, the
chargen service and other Simple TCP/IP services have been modified to
drop
any datagrams that have the source port equal to the destination port to
prevent "looping" attacks.

Paul
------------------------------
Paul J. Leach
paulle@microsoft.com
A friend of mine (thanks Myles) tested NT's handling of source-routed
packets not too long ago, and found that NT will only forward source-routed
packets if IP forwarding is enabled. This is expected behaviour, but it
would be very nice to have a reg setting that would turn off source-route
forwarding even when IP forwarding is enabled (Solaris has this, and many
other comparable niffty settings). In any case, a proxy server should never
have IP forwarding enabled, unless the proxy is being used for a completely
different reason than security.

Dominique Brezinski

At 05:28 PM 8/15/97 -0400, David LeBlanc wrote:
>One of the reasons not to use MS's release proxy server as a firewall is
>that NT currently has no ability to drop source-routed packets. I am under
>the impression that is being corrected in MS Proxy 2.0, and have hopes that
>it will also be corrected in a service pack. I'm also in favor of more
>"firewallish" functions for NT overall, as it will enhance our ability to
>protect ourselves when we expose our machines to the internet without
>benefit of firewalls. That's one of the things I really envy about the
>Linux guys - they have a lot of nice functionality in that area that I just
>can't do with NT out of the box.
>
>At 11:39 8/15/97 -0700, Paul Leach wrote:
>>Disclaimer: despite my affiliation, I am not a MS Proxy Server expert.
>>And I do not dispute the MS Proxy 1.0 info in your post. However, I do
>>know that MS Proxy 2.0 is out in beta, and I believe that it claims more
>>firewallish functions, perhaps based upon the new MS "Steelhead" routing
>>infrastructure. 

Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
At 16:13 8/15/97 -0700, you wrote:
>A friend of mine (thanks Myles) tested NT's handling of source-routed
>packets not too long ago, and found that NT will only forward source-routed
>packets if IP forwarding is enabled. This is expected behaviour, but it
>would be very nice to have a reg setting that would turn off source-route
>forwarding even when IP forwarding is enabled (Solaris has this, and many
>other comparable niffty settings). In any case, a proxy server should never
>have IP forwarding enabled, unless the proxy is being used for a completely
>different reason than security.

That is _very_ nice to know. It is bad enough that it source-routes to
begin with, but it is good it won't use it to jump across interfaces.

However, we did test it here, and individual machines honor source-routing,
so I can certainly use it to bounce from one to the other. In fact, we
bounced off of a couple of NT machines on our way to the SunOS box one day...


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 07:56 PM 8/15/97 -0400, David LeBlanc wrote:
>At 16:13 8/15/97 -0700, you wrote:
>>A friend of mine (thanks Myles) tested NT's handling of source-routed
>>packets not too long ago, and found that NT will only forward source-routed
>>packets if IP forwarding is enabled. This is expected behaviour, but it
>>would be very nice to have a reg setting that would turn off source-route
>>forwarding even when IP forwarding is enabled (Solaris has this, and many
>>other comparable niffty settings). In any case, a proxy server should never
>>have IP forwarding enabled, unless the proxy is being used for a completely
>>different reason than security.
>
>That is _very_ nice to know. It is bad enough that it source-routes to
>begin with, but it is good it won't use it to jump across interfaces.
>
>However, we did test it here, and individual machines honor source-routing,
>so I can certainly use it to bounce from one to the other. In fact, we
>bounced off of a couple of NT machines on our way to the SunOS box one day...

Yes, that sounds correct. You can source-route in and out of the same
interface, but you can not source-route from one interface to another on
the same host unless IP forwarding is enabled.


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
Sorry for adding noise to the list. This is the second request that I
have seen in the past week for help with modems that generated flames
about how this is a security list and that the individual should take
their question somewhere else.

First, since this is an unmoderated list, if you don't like the topic or
you feel the erge to inflict your self rightousness of what *IS* valid
content, please do one of the following. Send a polite, non-condisending
Email to the individual and explain the common use of the list - OR - DO
NOTHING! (which the action most people should take on 99% of any mailing
list issues, and 100% of the time if the question raises the debate of NT
vs UNIX).

Second, if you don't understand the security risks of having a modem on
your network, then may I suggest you do some reading on security,
especially within the area of NT! How to set it up is just as important
security question as "I just got a $40K phone bill on the fax line, how
can this happen?"

If you must flame - please do so direct so it doesn't fill this list with
more noise.

Regards,
Bob

At 06:56 8/15/97 +0800, you wrote:
> How do I set the RAS server to answer the phone after 5 rings? I
>tried setting it on the Zyxel modem but it seems
> that the RAS setting gets higher priority when it comes to
settings!
Unless you're suffering security problems because of this, please take
these sort of questions to USENET.
This is a _security_ mailing list, not a general help desk for NT.
-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |
--------- End forwarded message ----------
Had a similar problem where I could not delete a directory.

Fixed it in the end with a chkdsk /f, this reported some problems with
the NTFS indexes and since the problem has gone away.

Regards
Clive Jenkins

Any view expressed is entirely my own and has no affiliation with my
employers.

>-----Original Message-----
>From: gpng@mol.com.my [SMTP:gpng@mol.com.my]
>Sent: 14 August 1997 16:29
>To: ntsecurity@iss.net; ntools-list@ntsoftdist.com;
>ntsysadmin@majordomo.pobox.com
>Subject: [NTSEC] can't rename directory
>
>I am facing this funny problem. I am the admin for the primary 
>domain controler. One of the main directory I set it with the 
>administrators have full control on it together with all the 
>subdirectory in it. But when I want to rename it, a window pop up 
>saying that 
>
>Cannot rename training. Access is denied.
>
>Make sure the disk is not full or write-protected and that the file 
>is not currently in use.
>
>The training is the directory name that I wish to rename. I still 
>have around 100 MB hard disk space available. Any idea on this?
>
>regards,
>gek po
>
At 03:34 PM 8/15/97 -0700, John H. Stewart wrote:
>You wrote:
>> Note that the "warning message" is limited to 256 bytes. I recently
>> gave an NT security class where a student admin had a real problem:
>> their legal department was demanding a warning message that had
>> already passed 2,000 bytes and was growing by the day. (I suggested
>> a compression algorithm. The message would of course be unreadable,
>> but that legal stuff is anyway.)
>>
Actually if you do a registry edit of the field it can be as big as you want.
Only if you use system policy is it a 256 byte limit. 

Hi everybody,
Who knows how to get the list of users from the user manager?
In MS Exchange, an export on a container is enough but here .....
Is there anybody who can help me?
Thanks.
Bye.
Sylvie.
Sylvie Prime
T&T 42 142 6121

>From the command line

NET USERS

At 02:40 PM 8/17/97 +0200, Prime Sylvie wrote:
>Hi everybody,
>Who knows how to get the list of users from the user manager?
>In MS Exchange, an export on a container is enough but here .....
>Is there anybody who can help me?
>Thanks.
>Bye.
>Sylvie.
>Sylvie Prime
>T&T 42 142 6121
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
Hello all,

I hope some one can help.

Background:
I check clients and install if needed virus protection software from an NT
server to all the clients on the network.
The network has Win 3.1, Win 95 and NT Clients / Servers.

Problem:
My problem is that as the virus software is installed as the user logging
in and not the Administrator the permission's of that user may not be
sufficient to be installed as a common program or edit all the registry
entries.

Question:
Is there any way of allowing this to be done?
Can login scripts have Admin access?
Can the client interpret login scripts as admin rights?
Does Kixstart allow me to do this and does it work on NT?


Thanks in advance

Regards Derek.

()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()
()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

Derek Grocke Phone: +61 8 8372-7414
 Fax : +61 8 8372-7414
 Mobile: +61 419843380 
 Inet : derek@grace.ssabsa.sa.gov.au 
 riffraf@ezinet.com.au

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBM+ZWloFxNHlBBHxkEQJOlACgj1AWgn3Z0fsznAoAMvBH78NUF5UAnRO6
+O4gKeDIYzpW50/PA1wZrnTf
=iitO
-----END PGP SIGNATURE-----

Ill confirm this, It happened to my NT server last week. I didnt even
think about the possiblity that it was caused by the outside, but now I
realize it probably was.

-jjs

>-----Original Message-----
>From: randall g [SMTP:randallg@telemark.net]
>Sent: Thursday, August 14, 1997 5:08 PM
>To: ntsecurity@iss.net
>Subject: Re: [NTSEC] Time Server supplied with Resource kit - possibleDoS
>
>At 08:45 PM 8/14/97 GMT, you wrote:
>>Hi,
>>
>>As of early this morning, several ISP's have informed me of CPU
>>utilisation hitting 95-100% on their servers running the time daemon
>>from the NT Resource Kit.
>>
>>As yet we have not been able to confirm this is a DoS attack, but
>>everything is pointing that way.
>>
>>Does anyone know anything about it??
>
>The exact same thing happened to one of my servers. Stopping the service
>brought the CPU back to normal. No idea why...
>
>
>
>>The information gathered so far is being made public at:
>>
>>http://andrewsmith.webcafe.net/timebug.htm
>>
>>Both Andrew Smith and I are continuing to look into this problem, I
>>would appreciate information (even reports of further attacks).
>>
>>Microsoft Security Team has been emailed, no reply as of this time. 
>>
>>Ciao
>>
>>Drew
>
>
>
>
>randall g =%^)> Stockwatch webmaster
>mailto:webmaster@canada-stockwatch.com
>http://www.canada-stockwatch.com
>
On 15 Aug 97 at 15:54, David LeBlanc wrote:

> That should allow them to create files, but any files they do create
> will be non-executable.

Would be nice, but isn't.
Joe is the owner of the file, so he has no problems giving this file 
X permissions.


Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/
Hi everybody,

I' m looking for 3rd party SSL certification server tools, for generation
SSL certificates in-house for our internal network.

Any reference, web address appreciated.

Sincerely,Tevfik.

IMHO, this true only about MS Proxy 1.0. The 2.0 version (currently beta), provides dynamic packet filtering at the external adapter and 'Server Proxying'. With Server Proxying, MSP 2.0 can be configured to listen for inbound requests destined for server computers in the internal network and to forward them as appropriate. This feature allows various server applications, such as mail-servers, to sit behind the Proxy server and thus be significantly more secure.

For all the services that use WinSock or SOCKS proxy and not Web proxy, you get a circuit level gateway and not an application gateway. This means that you must use other tools for content filtering either custom made or from some other vendor. Even the application level Web proxy does not offer any content filtering right out of the box.

So, for inbound connections MS Proxy 2.0 provides packet filtering (dynamic or static) and ,through the circuit level proxy, hiding of the internal addresses and logging/alerting. 

I don't know for sure if user authentication is possible for inbound connections, provided they have valid user accounts on the Proxy server (WinSock uses NT C-R authentication).

----------
From: Suzanne Harris[SMTP:SHARRIS@COMT.COM]
Sent: ÐáñáóêåõÞ, 15 Áõãïýóôïõ 1997 5:34 ìì
To: ntsecurity@iss.net
Subject: [NTSEC] Microsft Proxy server securitly issues? -Reply

IMHO, Proxy server is not a true firewall solution. The intent is to provide faster, centralized access for internal clients to access Internet Services, with some logging and filtering abilities. In every case I have found, MS recommends against using the Proxy server to provide access to the Internal network from the Internet. In fact, according to the MS Proxy FAQ (www.microsoft.comSupport/products/backoffice/proxyserver/content/faq/misc/303.htm): 

"Proxy Server version 1.0 is not a true firewall. However, like a firewall, it is very secure. Proxy Server does not route TCP/IP packets; the network cards are actually disjointed. 

There are no advanced firewall features like packet filtering and alerting and inbound connection capability that most expensive firewalls contain. The Proxy Server can be used in addition to a firewall, or it can be used in place of a firewall on smaller networks. "

Specifically regarding external SMTP (or any Non CERN-Proxy compatiable application), the following quote is from the Proxy Server FAQ:
"Can I place my SMTP (or Internet Mail connector) server behind my Proxy server? 

Yes, you can but it will not be able to receive connections from the Internet. The Proxy server is a one way connection. Mail servers need to listen for connections from the Internet to exchange mail with other mail servers and these connections will be blocked by the proxy. There are two workarounds: 

*Install your mail server on another machine that is directly connected to the Internet. Your mail clients on the Intranet will be able to connect with POP or SMTP through the Proxy server. 

*Install your mail server on the proxy server. It will be exposed to all networks that the proxy server is connected to. 

NOTE: The first option is the preferred method because it is good practice to minimize the number of services running on the proxy server. Extra services on the proxy server provide more points of access for attack from potential hackers. "

I believe that the problem is that the only support that MS Proxy server provides for external access to the Internal network is though the CERN-Proxy (WEB Proxy) and not the WinSock Proxy. The CERN Proxy is limited to HTTP, FTP, Gopher, HTTPS and a few others -- and to enable these few protocols, you must enable Internet Publishing. The proxy server does not "listen" for connections on any other ports. In addition, MS generally does not recommend allowing even this limited access to external users.

There are several good filrewalls available for Windows NT, we commonly use the Raptor Eagle NT Product for our clients. The only time we deploy a proxy server is in two cases:
1. The client does not require ANY external access to their internal network (including HTTP or SMTP).
2. The client already has firewall in place and wants to increase the performance of their current Internet connection (Proxy server is placed behind the firewall).

Suzanne Harris
Microsoft Integration Team Leader
Sr. Systems Engineer
Computer Tech, Inc.
Houston, TX


>>> Itai Dor-on 08/15/97 06:33am >>>
>Dear Friends.

>There are two major types of firewalls deployed as Internet gateways
> at present:"Filtering Gateways" and "Application Gateways". Both
> firewall designs aim to implement and enforce network security.

>As I understand "Filtering Gateways" essentially make routing decisions
>based on information contained at the packet level. If a packet content 
>meets the security policy criteria (Port, Ip, Dest.) it is forwarded, or
>routed to the other side of the gateway. Otherwise it is blocked out.

>"Application Gateways", unlike "Filtering Gateways", operate at the
>connection rather than packet level (user name, protocol specific 
>operation: Get, Put)

>"Application Gateways" are known to be more secure then "Filtering
>Gateways" because they require the firewall provider to understand
>the security implications of supporting an application. They provide
>proxies for each service running behind the firewall.

>A good "Firewall Application Gateway" will combine "Filtering
> Gateways" features AND provide various proxies for services,
> running behind the proxy server, that will examine each packet
> internal content structure prior sending the packet to the specific
> service (e.g.email message packet structure). 

>"Microsoft Proxy Server was primarily designed to manage outbound
>connections and provide performance enhancements for clients on an 
>internal network accessing the Internet."

>This Design concept makes it a good "Application Gateway".

>In my opinion The MAIN Job of a firewall is to address the security
>issues of inbound connections coming from the Internet. 

>At this point Microsoft Proxy Server uses a mechanism called Dynamic
packet filtering a method that resembles "Filtering Gateways"

>Unfortunately I have found NO information on how Microsoft Proxy
>Server deals with packet (What proxy services they provide for
> specific network services) coming from the Internet. I will try
> explaining my point using an example.

>Suppose I have a network with two servers, one is a Microsoft Proxy
>Server connected to the Internet the other is a Microsoft Exchange
> Server sitting behind the proxy server. The exchange server is
> "server proxied" to the proxy server.

>Now using dynamic packet filter option on the proxy server, if I try to
>initiate a session with the exchange server using a host on the internet 
>(untrusted network)for the propose of checking my 
>mailbox the proxy server will open for me a connection 
>for the specific session. 

>It provides 'direct' connectivity between Me (Untrusted) 
>and the mail system (trusted). I know that the proxy server forwards
> thepackets to the exchange server not opening a real direct connection
> butbefore it sends the packets

>DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL
> INTEGRATIY AND THE STRUCTRE OF THE SMTP PACKET?

>AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER)
> MICROSOFT PROXYSERVER IS REGULER PACKET FILLTERING
> GATEWAY WHEN IT COMES OUT OF THE BOXNAKED
>(REGRADING INBOUND CONNECTIONS FROM THE INTERNET).

>Microsoft Proxy Server functionality can be extended using ISAPI (e.g.
>packet Virus checking etc.)
>BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"? 

>I posted this message at a couple of proxy server newsgroups on
> msnews server but didn't get any response.

>I decided to post the message on ntsecurity@iss.net because the
> matteraffects anyone who consults about or deal with NT security.


>I would appreciate any comment on the matter presented. 

>Yours Truly,

>Itai Dor-on

Hi,all !

Why can't I copy files over a RAS connection to our main server ?

Maybe it is a little off-topic here, but I haven't got any
idea where my problem comes from. So maybe it is a permission
(security) problem ?

However- that's the situation:

\\rassrv : slow 486 with active ISDN card and modem
\\server1: fast pentium as main server (domain master etc).

Both machines running NT 4.0 server with Service Pack 3 installed.
Protocol is TCP/IP, adresses are distributed using DHCP. DNS and WINS
are running fine in our LAN.

When I dial in to \\rassrv, I can copy files of any size to \\rassrv,
I can copy files from \\rassrv and \\server1 but I can't put files (100
kB to 2 MB) to \\server1.

But- I can put small files (1-2 KBytes) to \\server1 in every directory
I have permissions for. I also can create files using the 'File, New'
dialog of Win95 explorer.

It doesn't matter if the clients connect via modem or ISDN. We use Win95
and NT 4.0 workstation as clients.

We installed MS Multiprotocol router and RAS, but it doesn't solve the
problem. When we insert the ISDN card into \\server1 or connect a modem,
everything works fine (means you can copy files to \\server1, AFAIK
nobody tried to copy to \\rassrv).

Any ideas ???

Thanks in advance- Georg Basse
hi all,

for non-US : proxy v.2 (beta), doesnt work at all in french version of NT4.

Frog-Guy

Hi everybody,

I'd like to know how the secure channel between NT machines is established:

* How internal trust accounts are authenticated (e.g. Workstation or Interdomain trust accounts). The authentication scheme is a Challenge-Response one ? 
* If this is the case what's the details of the scheme ?
* How the session key is computed (probably from info from the authentication) ?
* What messages are being exchanged ?

If you do not know the exact details, I would appreciate a general description

I hope someone can help

Thanks
Panos



Tevfik KOLABAS wrote:
> 
> Hi everybody,
> 
> I' m looking for 3rd party SSL certification server tools, for generation
> SSL certificates in-house for our internal network.
> 
> Any reference, web address appreciated.

Here are a few:

http://home.netscape.com/comprod/server_central/product/certificate/index.html
http://www.entrust.com/webca.htm
http://www.psy.uq.oz.au/~ftp/Crypto/
http://www.darmstadt.gmd.de/secude/

Microsoft also has a beta-release CA as part of the IIS 4.0 beta.

Best regards

Steen


--

Steen Larsen

SITA R&D Nice, France | @ Home
E-mail: steen.larsen@nce.sita.int | E-mail: steen@who.net
Phone : +33 4 92.96.63.67 | GSM Mobile: +33 6 09090568
Fax : +33 4 92.96.64.92 | or (Danish) +45 40512486

Disclaimer: This letter may reflect my personal opinion.
 
 "Liberty lies in the rights of that person whose views
 you find most odious" - John Stuart Mill
From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

On Tue, 12 Aug 1997, Nash, Jason X wrote:

> I just tried it and all it said I needed was the additional OutLook
> converters. It lets you choose what to add.... seems harmless.
> > 
> > Can you then comment on the Download Wizard available from
> > http://www.microsoft.com/kb/softlib/default.asp which supposedly
> > detects
> > which files/patches etc... you need and automates the installation of
> > these?

 [ snip ]

 I just got around to checking this out and am I the only one who is a
little concerned here? Umm... this is an ActiveX control and you just
downloaded and fired it up while logged in as an administrator? Forgive
me if I'm wrong, but I thought ActiveX is still considered a "Bad Thing"
(tm) when it comes to security? Anyone else?

 Regards,
 Lee.

*-----------------------------*----------------------------------------*
| Lee Hamilton | Democracy: Three wolves and a |
| Systems Administrator | sheep deciding what's for dinner. |
| Prentice Centre | |
| University of Queensland | Em: lee@prentice.uq.edu.au |
| Australia | Ph: +61-7-3365 4328 |
*-----------------------------*----------------------------------------*


Spam.

I think if we cannot control the spam access to this list we should
just kill the list off.

It is bad enough getting W95 questions about modem hookups without
also having to wade through a dozen spam messages.

-- 
barry

|======================================================================
|Barry A. Suskind |"If it weren't for change, your job would 
|GE Information Services |consist of making sure the corporate abacus
|Email: bsuskind@is.ge.com |rods were adequately greased" - John Cleese
|Phone: (301)-340-4667 |===========================================
|SnailMail: 401 N Washington St, Mail Stop: MC07D, Rockville MD, 20850
Received: from perf.is.ge.com by bsuskind.is.ge.com with ESMTP
 (1.37.109.16/16.2) id AA146426349; Mon, 18 Aug 1997 08:12:30 -0400
Return-Path: 
Received: from thomas.ge.com by perf.is.ge.com with ESMTP
 (1.37.109.20/16.2) id AA046416348; Mon, 18 Aug 1997 08:12:28 -0400
Received: from ns.ge.com (ns.ge.com [192.35.39.24]) by thomas.ge.com (8.8.4/8.7.5) with ESMTP id IAA11038 for ; Mon, 18 Aug 1997 08:12:26 -0400 (EDT)
Received: from iss.net (qmailr@phoenix.iss.net [208.21.0.5])
 by ns.ge.com (8.8.6/8.8.6) with SMTP id IAA12496
 for ; Mon, 18 Aug 1997 08:11:56 -0400 (EDT)
Received: (qmail 12781 invoked by alias); 18 Aug 1997 10:38:58 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 12765 invoked by alias); 18 Aug 1997 10:38:56 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 12733 invoked by uid 15); 18 Aug 1997 10:38:54 -0000
Received: (qmail 12658 invoked from network); 18 Aug 1997 10:38:47 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 18 Aug 1997 10:38:47 -0000
Received: from mongkok.hk.super.net (root@mongkok.hk.super.net [202.14.67.46]) by arden.iss.net (8.8.6/8.7.3) with ESMTP id GAA25899 for ; Mon, 18 Aug 1997 06:40:06 -0400
From: gamefact@hotmail.com
Received: from mail.hk.super.net (ip-54-69.dialup.hkstar.com [202.82.54.69])
 by mongkok.hk.super.net (8.8.5/8.8.5) with SMTP id SAA13130;
 Mon, 18 Aug 1997 18:37:57 +0800 (HKT)
Received: from default ([202.82.194.30]) by sirius.hkstar.com by ([202.82.194.30]) (8.8.5/8.6.5) with SMTP id GAA08164 for ; Mon, 18 Aug 1997 18:33:45 -0600 (EST)
Date: Mon, 18 Aug 97 18:33:45 EST
To: gamefact@hotmail.com
Subject: [NTSEC] Bootleg Cds For CHEEP!!!!!!!!!!~~~~~
Message-Id: <199708101209.UAA25983@sirius.hkstar.com>
X-Pmflags: Subscriber, Star Internet-Hong Kong
Comments: Authenticated sender is 
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: gamefact@hotmail.com
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------


Someone wrote that "There are two major types of firewalls deployed as
Internet gateways at

present:"Filtering Gateways" and "Application Gateways". "


There are actually three types of firewalls: Packet Filters, Application
Gateways and Stateful Inspection. Packet Filters are basically routers
doing what routers were never meant to do - namely, deny packets as
oppose to passing them. Application Gateways are a step above packets
filters because they examine more than just the IP header. It has
application awareness which is good and bad. The good is it is aware of
the application but bad in that the firewall doesn't inspect it
until it reaches the application layer of the OSI
model. Thus leaving your entire OS exposed until it reaches the
application layer to be inspected. Another downfall of application
gateways is that they break the client server model. Every connection
that goes through it has to have a proxy on the other side to connect. 
The third type of firewall is called Stateful Inspection. It's an
invention of Check Point. What is does is inspect the packets as they
come off of the interface before it reaches the OS. It also examines the
entire packet including the application. Check Point's product
FireWall-1 has also added new functionality so that alot of the issues
that I've heard discussed here lately can be addressed. Namely, SMTP
security and virus scanning. 


This is just my take on firewall security...



____________________________________________________________

Valerie Leveille (Instructor) Voice: 248-350-3190

Netrex Security Education Center Fax: 248-350-3071

3000 Town Center, Suite 202 Email: valeriel@netrex.com

Southfield, MI 48075 URL: http://nsec.netrex.com/

____________________________________________________________

"Providing Businesses and Organizations with Secure Internet Solutions"

I lost the address to mail to this group. I have gotten more than a dozen
of these messages as noted below that are shere SPAM. Where are these
comming from and can they be stopped? Because the NTSEC is in the subject
my procmail will contiue to accept them.

Thanks,
Liz Frey

---------- Forwarded message ----------
Date: Mon, 18 Aug 97 18:07:50 EST
From: gamefact@hotmail.com
To: gamefact@hotmail.com
Subject: [NTSEC] Copy Games For Sale

From: (Anthony)
Newsgroups: rec.games.trading-cards.marketplace,rec.games.trading-cards.marketplace.magic.auctions,rec.games.trading-cards.marketplace.magic.sales,rec.games.trading-cards.marketplace.magic.trades,rec.games.trading-cards.marketplace.misc,rec.games.trading-cards.misc,rec.games.trading-cards.startrek,rec.games.trivia,rec.games.vectrex,rec.games.video,rec.games.video.3do,rec.games.video.advocacy,rec.games.video.arcade,rec.games.video.arcade.collecting,rec.games.video.atari,rec.games.video.cd32,rec.games.video.cd-i,rec.games.video.classic,rec.games.video.colecovision,rec.games.video.intellivision,rec.games.video.marketplace,rec.games.video.misc,rec.games.video.nintendo,rec.games.video.sega,rec.games.video.sony,rec.games.xtank.play,rec.games.xtank.programmer,relcom.games
Subject: GAMES AVAILABLE AT LOW LOW PRICES!!!
Date: Sat, 16 Aug 1997 07:57:48 GMT
Message-ID: <34075d79.15678828@news.sexzilla.com>
X-Newsreader: Forte Agent 1.5/16.451
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
NNTP-Posting-Host: 203.116.126.234
Organization: SEXZILLA.COM http://www.sexzilla.com
Lines: 38
Path:!out2.nntp.cais.net!in1.nntp.cais.net!mr.net!netnews.com!howland.erols.net!newspump.sol.net!newsfeeds.sol.net!news.pagesat.net!nntp.mid-ga.com!feed2.newsfeed.com!news.ntl.net!news-feed.inet.com!gateway.cm.org!news.cm.org!bcarh189.bnr.ca!bcarh8ac.bnr.ca!news.alt.net!news1.alt.net!news.jam.com!news1.radix.net!news1.exit109.com!wilbur.ohww.norman.ok.us!rahul.net!news.iswest.net!iswest.com!news.karlia.ru!news.netzilla.net!203.116.126.234
Xref: rec.games.trading-cards.marketplace.magic.auctions:85942 rec.games.trading-cards.marketplace.magic.sales:187844 rec.games.trading-cards.marketplace.magic.trades:80193 rec.games.trading-cards.marketplace.misc:87610 rec.games.trading-cards.misc:111358 rec.games.trading-cards.startrek:8361 rec.games.trivia:43810 rec.games.vectrex:8073 rec.games.video.3do:95830 rec.games.video.advocacy:49303 rec.games.video.arcade:159214 rec.games.video.arcade.collecting:75431 rec.games.video.atari:106352 rec.games.video.cd32:4761 rec.games.video.cd-i:7437 rec.games.video.classic:86903 rec.games.video.marketplace:137911 rec.games.video.misc:52019 rec.games.video.nintendo:277909 rec.games.video.sega:261202 rec.games.video.sony:251766 rec.games.xtank.play:1498 rec.games.xtank.programmer:2209 relcom.games:46056

GAMES AVAILABLE AT LOW LOW PRICES!!!

ALL NEW ENGLISH, CHINESE AND JAPANESE GAMES ARE AVAILABLE FOR US $ 15.

SOME GAMES ON MY STOCK LIST ARE :

PC CDROM

XCOM3 : APOCALYPSE
DIABLO
F22I RAPTOR
CAPITALISM PLUS
MAGIC : THE GATHERING
QUAKE
SHADOW WARRIOR
BLOOD
LORDS OF THE REALM II
WARCRAFT II
NBA 97
WARWIND


SONY PLAYSTATION CD-ROMS AND SEGA SATURN CD-ROMS ARE ALSO AVAILABLE
FOR THE SAME PRICES.

ALL PRICES ARE NETTED AND INCLUSIVE OF SHIPPING CHARGES 
REGARDLESS OF THE CUSTOMER'S COUNTRY AND LIVING LOCATION.

OTHER GAMES ARE AVAILABLE TOO

DIRECT ALL ENQUIRIES TO GAMES FACTORY PRIVATE LIMITED

E-MAIL ADDRESS : gamefact@hotmail.com

 -------------==== Posted via Sexzilla News ====------------------
 http://www.sexzilla.com Search, Read, Post to Usenet
 -------------==== With A Whole Lot More ====------------------

Joshua,
 On Aug 13 at approximately 5 pm EDT USNO disabled non-NTP time
services. For systems using Timeserv with type=internet this caused
100% CPU utilization. The fix is to switch to type=NTP and
NTPServer=tick.usno.navy.mil. This is documented by the author at
http://home1.gte.net/dougho/TimeServ.html

Joshua Soliz wrote:
> 
> Ill confirm this, It happened to my NT server last week. I didnt even
> think about the possiblity that it was caused by the outside, but now
> I
> realize it probably was.
> 
> -jjs
> 
> >-----Original Message-----
> >From: randall g [SMTP:randallg@telemark.net]
> >Sent: Thursday, August 14, 1997 5:08 PM
> >To: ntsecurity@iss.net
> >Subject: Re: [NTSEC] Time Server supplied with Resource kit -
> possibleDoS
> >
> >At 08:45 PM 8/14/97 GMT, you wrote:
> >>Hi,
> >>
> >>As of early this morning, several ISP's have informed me of CPU
> >>utilisation hitting 95-100% on their servers running the time daemon
> >>from the NT Resource Kit.
> >>
> >>As yet we have not been able to confirm this is a DoS attack, but
> >>everything is pointing that way.
> >>
> >>Does anyone know anything about it??
> >
> >The exact same thing happened to one of my servers. Stopping the
> service
> >brought the CPU back to normal. No idea why...
> >
> >
> >
> >>The information gathered so far is being made public at:
> >>
> >>http://andrewsmith.webcafe.net/timebug.htm
> >>
> >>Both Andrew Smith and I are continuing to look into this problem, I
> >>would appreciate information (even reports of further attacks).
> >>
> >>Microsoft Security Team has been emailed, no reply as of this time.
> >>
> >>Ciao
> >>
> >>Drew
> >
> >
> >
> >
> >randall g =%^)> Stockwatch webmaster
> >mailto:webmaster@canada-stockwatch.com
> >http://www.canada-stockwatch.com
> >
A brief note on the Logon Banner....If you using Novell's IntraNetware 
Client for NT (as we do because of our "hybrid" environment) you will need 
to use their latest beta Client -- the "released" version will not display 
the logon banner.

Regards,

Chris Rietmann

these thoughts and words are my own, and do not in any way reflect the 
beliefs or policies of my employers.

-----Original Message-----
From: Joel W. Barrett [SMTP:jbarrett@rpm.com]
Sent: Friday, August 15, 1997 12:21 PM
To: 'Decker, Warren'; ntsecurity@iss.net
Subject: RE: [NTSEC] warning messages

With NT you can enable a Logon Banner that pops up before the logon screen. 
The easiest way to do this is through the System Policy Editor. Select
Default Computer Properties then Windows NT System then Logon for the Logon 
Banner property.

One of the reasons M$ implemented this is because there was a hacker who
broke into some systems a few years back and was caught. At his trial he 
got
off the charges because the logon banner said "Welcome to xxxxx system,
please login."


--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Decker, Warren [SMTP:WarrenD@kmg.com]
Sent: Friday, August 15, 1997 11:32 AM
To: ntsecurity@iss.net
Subject: [NTSEC] warning messages

I know that many sources recommend a warning message when users log on
saying that you are entering a private network and if you don't belong
leave (or words to that effect). When and why is this warning
necessary? In NT the message comes up after you have logged in, so you
have already entered an id and password. It seems that you are either
authorized or serious about breaking in. In either case the warning
seems to serve little good. Is some sort of legal requirement that I
have missed?





Greetings,

We're deploying approximately five hundred NT 4.0 Workstations in the next
month or so. The users of these workstations will have Domain User
accounts only. My question: Is there a way to REMOTELY disable/enable the
local Administrator accounts on these systems -- either by locking or
changing the password on the account? We don't want the users to be able
log on locally as administrators and have their way with the system.

Thanks!
Jack Jones
jjones@farm-credit.com
Network Analyst -- Security
Northwest Farm Credit Services


The control is signed by Microsoft, which can be validated by reference
to a certificate signed by Verisign.

Hence, you should feel reasonably certain that the bits are the ones
placed on the server by Microsoft and have not been tampered with in
transit, and trust them (at least) as much as you would a program from
Microsoft purchased over-the-counter at a local software store.

In any case, you get to choose whether to trust bits signed by Microsoft
-- it won't download the control automatically.

> ----------
> From: Lee Hamilton[SMTP:lee@prentice.uq.edu.au]
> Reply To: Lee Hamilton
> Sent: Monday, August 18, 1997 2:16 PM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Hotfixes 
> 
> On Tue, 12 Aug 1997, Nash, Jason X wrote:
> 
> > I just tried it and all it said I needed was the additional OutLook
> > converters. It lets you choose what to add.... seems harmless.
> > > 
> > > Can you then comment on the Download Wizard available from
> > > http://www.microsoft.com/kb/softlib/default.asp which supposedly
> > > detects
> > > which files/patches etc... you need and automates the installation
> of
> > > these?
> 
> [ snip ]
> 
> I just got around to checking this out and am I the only one who is
> a
> little concerned here? Umm... this is an ActiveX control and you just
> downloaded and fired it up while logged in as an administrator?
> Forgive
> me if I'm wrong, but I thought ActiveX is still considered a "Bad
> Thing"
> (tm) when it comes to security? Anyone else?
> 
> Regards,
> Lee.
> 
> *-----------------------------*---------------------------------------
> -*
> | Lee Hamilton | Democracy: Three wolves and a
> |
> | Systems Administrator | sheep deciding what's for dinner.
> |
> | Prentice Centre |
> |
> | University of Queensland | Em: lee@prentice.uq.edu.au
> |
> | Australia | Ph: +61-7-3365 4328
> |
> *-----------------------------*---------------------------------------
> -*
> 
> 

 We have a situation that I would appreciate some comments on. We
create home directories on NT file servers for all of our clients, most
of which are running Win95.

 We do not want the users to be able to modify the permissions lists
of the files or directories. Therefore the highest level of permissions
we give is Change (RWXD). The problem is that when the user creates a
subdirectory, they are the owner and thus have the authority to change
the permissions and thus they can remove the "Administrators" group or
any other group we deem should have access to their files/directories.
Now I understand that an Administrator can go and take ownership of the
files/directories and set these permissions back, but that is a big
headache. We would like to prevent them from setting permissions at
all. 

This is not a huge problem yet, as most of our clients are Win95, but
the more we roll out NT Workstation, this is going to become a bigger
and bigger problem for us.

Is there a way we can prevent users from changing permissions on
files/directories that they create on remote NT servers?

Thanks...


On Mon, 18 Aug 1997, Valerie Leveille wrote:

> Someone wrote that "There are two major types of firewalls deployed as
> Internet gateways at
> 
> present:"Filtering Gateways" and "Application Gateways". "
> 
> 
> There are actually three types of firewalls: Packet Filters, Application
> Gateways and Stateful Inspection. Packet Filters are basically routers

No, either packet filters, or application layer gateways can keep state,
so that's not true.

The third type is a hybrid, which does both.

> doing what routers were never meant to do - namely, deny packets as
> oppose to passing them. Application Gateways are a step above packets
> filters because they examine more than just the IP header. It has

Packet filters examine more than just the IP header, for example the 
'estabilished' keyword in Cisco access lists, which examines TCP flag
information. Even simpler is the login control for say, the Netscape
Proxy server, which allows access based on the state of authentication.

> application awareness which is good and bad. The good is it is aware of
> the application but bad in that the firewall doesn't inspect it
> until it reaches the application layer of the OSI
> model. Thus leaving your entire OS exposed until it reaches the
> application layer to be inspected. Another downfall of application
> gateways is that they break the client server model. Every connection
> that goes through it has to have a proxy on the other side to connect. 
> The third type of firewall is called Stateful Inspection. It's an
> invention of Check Point. What is does is inspect the packets as they
> come off of the interface before it reaches the OS. It also examines the
> entire packet including the application. Check Point's product
> FireWall-1 has also added new functionality so that alot of the issues
> that I've heard discussed here lately can be addressed. Namely, SMTP
> security and virus scanning. 

It also fails to keep state on ICMP packets as shipped, and there have
been reports of problems with the UDP state engine. Just keeping state
isn't any big deal, what matters is *what* you're keeping state of, and it
gets _very_ complex to keep state for numerous things at the transport,
internetwork, and application layer and still protect a machine. The
whole reason that NT's OOB attacks were successful against Firewall-1
protected hosts is that the bug in the NT stack was an exploit of a
legitimate packet, application gateways protected against that attack
because only the bastion's stack is exposed, not every client behind it,
which _clearly_ illustrates that FW-1 is a packet filtering firewall,
irregardless of the fact that it uses dynamic filters which may or may
not be based on either a little, or a great deal of state information
depending on the protocol and how much time you want to spend building
inspect rules.

The buzzword sounds good in marketing, but without any beef to back it
up, "Stateful inspection" is just a buzzword. State can be anything from
"yes I saw another packet go out" to "I saw a packet that was a request of
type x and the application expects a reply of type y from this address at
that port over protocol z within 15 seconds". There's a large gulf
between the two, and it still doesn't protect you from attacks at the
transport layer.

Application gateways remain easier to code correctly, and still provide
transport and internetwork layer protection to protected hosts that don't 
come by default in any type of packet filter, stateful, dynamic, or
static. 

I know it would be much easier to mathematically verify the correctness of
something like the FWTK's http-gw than it would to do the same to a
dynamically updated state table. 

Irregardless, there remain three types of firewalls, application gateways,
packet filters and hybrids. Stateful inspection can be implemented in 
any or all of the above. 

SMTP protection is done at application layer gateways, and virus
protection can be as well, though I'd argue the merits of having that code
on a firewall, where it's easily circumventable, and possibly bug-ridden.
 
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

In the resource kit there is a utility called addusers, and this utility 
dumps all the users of a given computer (along with group and login info) 
to a delimited text file that you specify. Below you will find the command 
line help of the utility. To dump the users from a domain called MASTER and 
a computer name of MASTER-PDC to a file call USERS.TXT that is semi-colon 
delimited, use the following command line:

ADDUSERS \\MASTER-PDC /D C:\USERS.TXT /S:;

The resulting text file will be a semi-colon delimited dB.

-> addusers /?
->
-> Adds, Writes, or Erases accounts as specified by a delimited file.
->
-> ADDUSERS [/?] [\\computername [[/c | /d | /e] filename]] [/s:?]
->
-> /? Display this help screen.
-> /c Create accounts specified in the file.
-> /d Write current accounts to the specified file.
-> /e Erase user accounts specified in the file.
-> /s:? Sets the separator character for the input/output file. Replace 
the
-> ? with the character to be used for separating fields. (eg /s:~)
-> Note: The separator character is a comma ',' by default.
->
-> For detailed information please refer to the Resource Kit Help file.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Shahin Pirooz
* spriooz@hitech.eds.com
* Systems Engineer/Windows NT Specialist
*
* Electronic Data Systems Corporation
* 815 Stewart Drive
* Sunnyvale, CA 94086
*
* Work: 408 524-2852
* Fax: 408 524-2896
* Pager: 800 401-2986
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----Original Message-----
From: Prime Sylvie [SMTP:sylvie_prime@clt-ufa.com]
Sent: Sunday, August 17, 1997 5:41 AM
To: ntsecurity@iss.net
Subject: [NTSEC] How to get the user manager for Domain's list of users

Hi everybody,
Who knows how to get the list of users from the user manager?
In MS Exchange, an export on a container is enough but here .....
Is there anybody who can help me?
Thanks.
Bye.
Sylvie.
Sylvie Prime
T&T 42 142 6121

Besides attempting to control .tmp file access via ACLs, other concerns I
have with .tmp files is that they occasionally contain information that may
be 'sensitive' in an environment where 'bypass traverse checking' is on,
such as locations and/or names. Also .tmp's may be exploited if some
program used a '.tmp' file in leu of using the registry. Note: Exe's
renamed to .tmp files can't be executed on my NT box...

Also, someone asked me what a (215MB) ~pst2297.tmp file was doing in their
computer (unable to read with notepad/wordpad/word) where the owner was
administrator. I could not answer them.

Bill Stout

With reference to your message with the subject:
 "Re: [NTSEC] warning messages"

One or more addresses in your message have failed with the following
responses from the mail transport system:

 
 Message could not be delivered for 72 hours - returned.

Error messages:
1. File creation error delivering to "uid":

Recipient "uid"'s new mailbox disk space is full.
The recipient will be unable to receive mail until he or she has 
deleted messages from the mailbox. 

2. User uid@site not known at this site: 

"uid" is not on this server. You may have entered an incorrect 
email address. If you are a user at Leeds University you
should use the X.500 directory service to search for the 
username. Use of this directory service from Microsoft Windows
is described in the document "Getting Started With PC-DUA" 
(BEG 27). Another interface can be obtained by telneting to
directory.leeds.ac.uk and login with the username "de".
Please note the the X.500 directory runs on a pilot computer 
system. If the X.500 directory is unavailable, please try again 
later. 

If the address obtained from the X.500 directory gives an error, you 
should report the error to the Help Desk (email helpdesk@leeds.ac.uk.)
Please make it clear in the message that you believe that the 
X.500 data is incorrect, fully describe the procedures you have 
followed and include this message.

3. User "uid" has mail disabled:

The User has disabled his/her mail. The user does not wish to 
be contacted by email. Please contact by other means.

4. User "uid" is not authorised to use mail.

User is in NOMAIL group. For those users whose user accounts have expired
and for inactive users during University vacation, their "uid"s will 
be placed in a NOMAIL group. Please do not send messages again once
you receive such a error message. 

postmaster@east-01.novell.leeds.ac.uk.

-------------------- Returned message follows ---------------------

Return-path: 
Received: from iss.net by east-01.novell.leeds.ac.uk (Mercury 1.31);
 15 Aug 97 17:57:43 GMT
Received: (qmail 29057 invoked by alias); 15 Aug 1997 16:04:15 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 29050 invoked by alias); 15 Aug 1997 16:04:14 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 29043 invoked by uid 15); 15 Aug 1997 16:04:14 -0000
Received: (qmail 29034 invoked from network); 15 Aug 1997 16:04:12 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 15 Aug 1997 16:04:12 -0000
Received: from psclist.mt.gov (psclist.mt.gov [161.7.166.41]) by arden.iss.net (8.8.6/8.7.3) with SMTP id MAA18407 for ; Fri, Received: from [161.7.166.38] by psclist.mt.gov (NTMail 3.02.13) with ESMTP id aa008476 for ; Fri, 15 Aug 1997 10:04:39 +0100
Message-Id: <3.0.2.32.19970815100629.006c9410@psclist.mt.gov>
X-Sender: joelfke@psclist.mt.gov
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.2 (32)
Date: Fri, 15 Aug 1997 10:06:29 -0600
To: "Erik Sojka" , WarrenD@kmg.com
From: Joel Oelfke 
Subject: Re: [NTSEC] warning messages
Cc: ntsecurity@iss.net
In-Reply-To: <852564F4.00564949.00@sctmnot8.sctcorp.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Joel Oelfke 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-Error-Diagnostic: 97/08/15 17:57, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 18:27, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 19:27, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 20:27, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 21:28, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 22:28, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 23:29, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 0:29, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 1:29, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 2:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 3:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 4:30, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 5:30, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 6:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 7:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 8:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 9:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 10:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 11:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 12:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 13:33, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 14:33, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 15:33, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 16:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 17:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 18:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 19:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 20:35, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 21:35, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 22:35, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 23:36, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 0:36, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 1:37, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 2:37, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 3:37, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 4:37, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 5:37, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 6:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 7:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 8:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 9:39, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 10:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 11:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 12:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 13:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 14:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 15:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 16:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 17:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 18:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 19:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 20:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 21:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 22:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 23:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 0:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 1:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 2:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 3:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 4:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 5:45, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 6:45, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 9:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 10:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 11:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 12:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 13:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 14:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 15:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 16:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 17:42, csc5pdm - mailbox error (mailbox full)
X-Retry: 72
X-Error-Diagnostic: 97/08/18 18:42, csc5pdm - mailbox error (mailbox full)

With reference to your message with the subject:
 "Re: [NTSEC] Microsft Proxy server securitly issues? -Reply"

One or more addresses in your message have failed with the following
responses from the mail transport system:

 
 Message could not be delivered for 72 hours - returned.

Error messages:
1. File creation error delivering to "uid":

Recipient "uid"'s new mailbox disk space is full.
The recipient will be unable to receive mail until he or she has 
deleted messages from the mailbox. 

2. User uid@site not known at this site: 

"uid" is not on this server. You may have entered an incorrect 
email address. If you are a user at Leeds University you
should use the X.500 directory service to search for the 
username. Use of this directory service from Microsoft Windows
is described in the document "Getting Started With PC-DUA" 
(BEG 27). Another interface can be obtained by telneting to
directory.leeds.ac.uk and login with the username "de".
Please note the the X.500 directory runs on a pilot computer 
system. If the X.500 directory is unavailable, please try again 
later. 

If the address obtained from the X.500 directory gives an error, you 
should report the error to the Help Desk (email helpdesk@leeds.ac.uk.)
Please make it clear in the message that you believe that the 
X.500 data is incorrect, fully describe the procedures you have 
followed and include this message.

3. User "uid" has mail disabled:

The User has disabled his/her mail. The user does not wish to 
be contacted by email. Please contact by other means.

4. User "uid" is not authorised to use mail.

User is in NOMAIL group. For those users whose user accounts have expired
and for inactive users during University vacation, their "uid"s will 
be placed in a NOMAIL group. Please do not send messages again once
you receive such a error message. 

postmaster@east-01.novell.leeds.ac.uk.

-------------------- Returned message follows ---------------------

Return-path: 
Received: from iss.net by east-01.novell.leeds.ac.uk (Mercury 1.31);
 15 Aug 97 18:12:10 GMT
Received: (qmail 31714 invoked by alias); 15 Aug 1997 16:09:55 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 31705 invoked by alias); 15 Aug 1997 16:09:55 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 31690 invoked by uid 15); 15 Aug 1997 16:09:54 -0000
Received: (qmail 31669 invoked from network); 15 Aug 1997 16:09:52 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 15 Aug 1997 16:09:52 -0000
Received: from duracef.shout.net (duracef.shout.net [204.253.184.12]) by arden.iss.net (8.8.6/8.7.3) with ESMTP id MAA18798 for 
Date: Sat, 16 Aug 1997 00:17:05 -0500
From: Steve Sutton 
Organization: Trusted Systems Services, Inc.
X-Mailer: Mozilla 3.01Gold (WinNT; I)
MIME-Version: 1.0
To: Suzanne Harris 
CC: ntsecurity@iss.net
Subject: Re: [NTSEC] Microsft Proxy server securitly issues? -Reply
References: 
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Steve Sutton 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-Error-Diagnostic: 97/08/15 18:12, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 18:27, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 19:28, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 20:28, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 21:28, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 22:29, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/15 23:29, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 0:29, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 1:30, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 2:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 3:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 4:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 5:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 6:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 7:31, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 8:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 9:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 10:32, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 11:33, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 12:33, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 13:33, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 14:33, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 15:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 16:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 17:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 18:34, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 19:35, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 20:35, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 21:35, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 22:36, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/16 23:36, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 0:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 1:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 2:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 3:37, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 4:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 5:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 6:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 7:38, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 8:39, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 9:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 10:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 11:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 12:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 13:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 14:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 15:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 16:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 17:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 18:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 19:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 20:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 21:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 22:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/17 23:43, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 0:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 1:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 2:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 3:44, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 4:45, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 5:45, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 6:45, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 9:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 10:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 11:40, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 12:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 13:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 14:41, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 15:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 16:42, csc5pdm - mailbox error (mailbox full)
X-Error-Diagnostic: 97/08/18 17:42, csc5pdm - mailbox error (mailbox full)
X-Retry: 72
X-Error-Diagnostic: 97/08/18 18:42, csc5pdm - mailbox error (mailbox full)

Anyone have any experience with SecuRemote with NT (obviously in conjunction with the CheckPoint FW-1)?


Larry Weber
Senior Member Engineering Technology Group, N2K Inc.
(610)293-4722
law@n2k.com

Or you want a list from the Domain that you are currently authenticated
to :

NET USER /DOMAIN
 
Steve Tharp
 
> ----------
> From: Eric Germann[SMTP:ekgermann@cctec.com]
> Sent: Sunday, August 17, 1997 8:19 AM
> To: Prime Sylvie
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] How to get the user manager for Domain's
> list of users
> 
> From the command line
> 
> NET USERS
> 
> At 02:40 PM 8/17/97 +0200, Prime Sylvie wrote:
> >Hi everybody,
> >Who knows how to get the list of users from the user manager?
> >In MS Exchange, an export on a container is enough but here .....
> >Is there anybody who can help me?
> >Thanks.
> >Bye.
> >Sylvie.
> >Sylvie Prime
> >T&T 42 142 6121
> >
> >
> >
> 
> 
> ======================================================================
> ======
> ====
> Eric Germann Computer and Communications
> Technologies
> ekgermann@cctec.com Van Wert, OH 45891
> Phone: 419 968 2640
> http://www.cctec.com Fax: 419 968 2641
> 
> Network Design, Connectivity & System Integration Services 
> A Microsoft Solution Provider 
> 
Valerie,

Routers:
Routers are impacted by rules processing simply because their hardware
design wasn't done to handle sophisticated rule sets. Denying a packet
is actually less intensive than permitting it, since it doesn't have to
figure out which interface it should send the denied packet to (it
simply drops it on the floor).

Application Gateways/Proxies:
Application Gateways do not, in and of themselves, inspect the IP header
in the same way a router does. Proxies, or Application Gateways, rely on
the underlying OS to do all of the IP stuff for it. They are designed to
understand what is being done within the session and to take action
based on application specific instructions (i.e. FTP gets or SMTP
helos). The OS is only exposed as much as the OS is not secured (or
securable), Proxies expect that the underlying OS has been sufficiently
configured to force application data up to the Proxy.

I wouldn't say that Proxies break the client/server model. If
implemented correctly, neither client nor server should be aware that a
proxy is in-between them. To the extent that proxies should affect
client/server communications, you could say that a router breaks that
model also. It picks up a packet on one side and relays it through to
another interface. Proxies only break the model if they don't work
efficiently or correctly.

Proxies incur additional overhead to other mechanism because they have
to wait until the traffic has reached the application layer before they
can process. Further, they have more to inspect and possibly more to
re-write. So typically their performance will be less than that of other
methods, although it can be argued they are providing additional
security for that cost.

Proxies work well with established applications that have a large
audience. Vendors cannot expend the amount of resources required to
support all applications, or all versions of those they do support. This
may translate into a delay before being able to support some new
technology (if it can be supported at all). Most vendors recommend the
use of generic OS relays (screend) as a means of supporting applications
for which proxies have not yet been developed (or cannot be developed
due to the nature of the application)

Stateful Inspection:
Stateful Inspection is the process of storing a state table of all
session traffic. As traffic flows to/from endpoints the state table is
adjusted to reflect each sessions current activity. Traffic that would
represent an invalid state change is treated as suspect (what it does
with it depends on the circumstances). This is typically application
independent although some Firewalls do combine this with application
state information to come up with a hybrid approach (Check Point is one
of them).

Its impossible for anything to inspect traffic before it reaches the OS
unless it is hardware-based. What Firewall-1 does do is replace the
drivers and in some OSs, the kernel, to afford it the greatest
opportunity to intercept traffic at the lowest possible level (but since
the kernel is what's executing the drivers, you can't do it outside the
OS). Firewall-1 does not rely on the underlying OS for anything which it
deems it needs to control, so they replace generic functionality with
customized processes.

To say that Stateful Inspection "examines the entire packet including
the application" is misleading. The vast majority of packets which pass
through an SPF implementation do not examine the data component of
packets at all (beyond looking for encapsulated traffic).

Features that are being added to Firewall-1 should not all be attributed
to Stateful Inspection. Virus scanning has little to do with it and SMTP
security is more an implementation of Proxy technology than anything
else.

Anyone interested in Firewalls and Firewalling technologies should
consider joining the Firewalls@Greatcircle.com mailing list. Last week
our Bill Stout asked this question there and received a number of
interesting responses. http://www.greatcircle.com/firewalls/ provides
information on how to subscribe as well as links to the archives (where
you can find Bill's thread under the subject Re: Prove to me
'state-based' is safe).

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list: http://www.ntbugtraq.com

To say 'state-based' firewalls are more secure than proxies is misleading.
A 'stateful' filter may actually be less secure than packet filters in some
situations.

Proxy firewalls are the most secure, packet filters are the least. The
whole 'stateful' issue is a topic of heated debate on the firewall-list,
since 'stateful' does not necessarily inspect all packets passing through.
Stateful filters also do not rewrite packets, allowing direct packet
communication to the target, and allows possible IP attacks.
Application-level proxies do rewrite packets. 

Facinating that anyone can claim you can have software that runs below the
O.S.. Drivers and stacks run in kernel mode, and therefore run 'in the
O.S.'. You can't run software 'below the O.S.' without being either
microcode (firmware) or hardware.

*Please* don't instruct your students that 'stateful' firewalls: 
 a. have been around long enough to trust
 b. have publically available source code to review for trust
 c. are more secure than proxies
 d. can run 'below the O.S.'
 e. have never been broken through 
(See http://www.geocities.com/ResearchTriangle/3372/cpsourceart.htm )

Bill Stout

Steve,

I was able to place a 670 byte warning message into the registry by 
cutting and pasting in 256 byte chunks. After typing the first part of 
the message, I cursored to the end of the registry value, pasted the 
additional text and repeated until I had the complete message. The point 
at which the text of the message wrapped varied, depending on the display 
resolution of the target system.

Don't tell the attorneys!

Greg Strabala
Iowa Communications Network
gstrabala@icn.state.ia.us

 ----------
From: Steve Sutton[SMTP:ssutton@trustedsystems.com]
Sent: Friday, August 15, 1997 3:15 PM
To: Joel Oelfke
Cc: Erik Sojka; WarrenD@kmg.com; ntsecurity@iss.net
Subject: Re: [NTSEC] warning messages

Note that the "warning message" is limited to 256 bytes. I recently
gave an NT security class where a student admin had a real problem:
their legal department was demanding a warning message that had already
passed 2,000 bytes and was growing by the day. (I suggested a
compression algorithm. The message would of course be unreadable, but
that legal stuff is anyway.)

Moral: A warning messages is fine, but don't let the lawyers write it!
 --
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com
 WWW: http://www.TrustedSystems.com/
If you have access to SMS(v1.2) then you can set PCM(Package Control 
Manager) as a service, and allow it to do your installs on you NT machines. 
This can be done with out the users even being logged on at the time of 
install (as long as the machine is on).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Shahin Pirooz
* spriooz@hitech.eds.com
* Network Systems Engineer/Windows NT Specialist
*
* Electronic Data Systems Corporation
* 815 Stewart Drive
* Sunnyvale, CA 94086
*
* Work: 408 524-2852
* Fax: 408 524-2896
* Pager: 800 401-2986
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----Original Message-----
From: Derek Grocke [SMTP:riffraf@ezinet.com.au]
Sent: Sunday, August 17, 1997 5:42 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Push Virus Protection and NT

Hello all,

I hope some one can help.

Background:
I check clients and install if needed virus protection software from an NT
server to all the clients on the network.
The network has Win 3.1, Win 95 and NT Clients / Servers.

Problem:
My problem is that as the virus software is installed as the user logging
in and not the Administrator the permission's of that user may not be
sufficient to be installed as a common program or edit all the registry
entries.

Question:
Is there any way of allowing this to be done?
Can login scripts have Admin access?
Can the client interpret login scripts as admin rights?
Does Kixstart allow me to do this and does it work on NT?


Thanks in advance

Regards Derek.

()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()() 
()()
()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

Derek Grocke Phone: +61 8 8372-7414
 Fax : +61 8 8372-7414
 Mobile: +61 419843380
 Inet : derek@grace.ssabsa.sa.gov.au
 riffraf@ezinet.com.au

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBM+ZWloFxNHlBBHxkEQJOlACgj1AWgn3Z0fsznAoAMvBH78NUF5UAnRO6
+O4gKeDIYzpW50/PA1wZrnTf
=iitO
-----END PGP SIGNATURE-----

Hello,

I was just wondering if there are any tcp wrapper tcpd like in NT that will allow
me to use something like %u and %h (as like in Unix/Linux) so that if I put "%u@%h" 
in some MOTD(greeting) files where they represents username and hostname respectively for the remote connection user to see and knows that he/she is logging from that user@host.
Or that I can use for other logging purposes. Thanks in advance.

S.
The permissions problem on the files have been fixed, so that one won't
get "access denied" when trying to access them.

Sorry about that.

> ----------
> From: Paul Leach
> Sent: Friday, August 15, 1997 4:08 PM
> To: 'ntsecurity@iss.net'; 'ntbugtraq@ntadvice.com';
> 'bugtraq@netspace.org'
> Subject: Simple TCP service hotfix reposted
> 
> The Simple TCP/IP service hotfix was discovered to have some problems
> and was withdrawn. It has now been reposted at
> ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfi
> xes-postSP3/simptcp-fix
> 
> 

quit

quit ntsecurity

At 11:37 AM 8/15/97 +0000, you wrote:

>I run an IRC Server made by Webmaster, Inc, (www.webmaster.com) called 
>ConferenceRoom that is running as a Service under NT. I am wondering if 
>there is a program out there that I can setup to run on the server itself, 
>OR for me to run manually whenever I am online, to automatically check for 
>and log to a text file, any ICMP floods, Nukes (Port 139, etc) or other DOS
>(Denial Of Service) attacks. Ideally, the software should seet if user A 


You could just filter out all packets to that server except for chat. ;)

Otherwise if you want to know these things are happening, you want to setup
a box on the same external subnet to watch for suspicious activity. I call
it 'network surveillance'. RealSecure from ISS does this, and I know two
other companies are about to announce hardware/software products to monitor,
trigger, and alarm on suspicious network events. 

Bill Stout

I tried the released version (NTENU41N.EXE 20FEB1997).

Open Network properties, select the Services tab, select Novell IntranetWare 
Client for Windows NT, click Properties, select the Advanced Login tab.

This tab allows you to configure roaming profiles for NetWare and edit the logon
"welcome screen" caption (Header Message) and bmp file (default is NWELCOME.BMP 
in \winnt). The reg setting is:

\HKEY_LOCAL_MACHINE\SOFTWARE\Novell\NWGINA

I took Scott Charney's (DoJ) message someone posted, typed it into pbrush and 
saved it as a small bmp. Worked great.

Davi

______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] warning messages
Author: Chris Rietmann at internet
Date: 8/18/97 10:40 AM

--------------------------------------------------------------------------------
A brief note on the Logon Banner....If you using Novell's IntraNetware
Client for NT (as we do because of our "hybrid" environment) you will need 
to use their latest beta Client -- the "released" version will not display 
the logon banner.
 
Regards,
 
Chris Rietmann
 
these thoughts and words are my own, and do not in any way reflect the 
beliefs or policies of my employers.
 

> While it may not work in all instances, when faced with
>that problem, I created some bmp and gif files with the appropriate
>volumes of words. The bmp displays on screen for anyone attempting
>to logon. The gif is used in conjunction with web pages to provide
>an initial waring banner prior to any other display.


The warning message works fine for Windows NT clients, but has anyone come up
with an elegant way for displaying a similar message on Windows 95 clients?

 Tim Thorpe

> While it may not work in all instances, when faced with
>that problem, I created some bmp and gif files with the appropriate
>volumes of words. The bmp displays on screen for anyone attempting
>to logon. The gif is used in conjunction with web pages to provide
>an initial waring banner prior to any other display.


The warning message works fine for Windows NT clients, but has anyone come up
with an elegant way for displaying a similar message on Windows 95 clients?

 Tim Thorpe
The easiest way is to keep the Local Administrators password from the normal users. Only give it to desktop support staff.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Shahin Pirooz mailto:spriooz@hitech.eds.com
*
* System Engineer Electronic Data Systems - HiTech SBU
* Work: 408.524.2852 Fax: 408.524.2896
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----Original Message-----
From: jjones@farm-credit.com [SMTP:jjones@farm-credit.com]
Sent: Monday, August 18, 1997 8:36 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Remote management of local administrator accounts...





Greetings,

We're deploying approximately five hundred NT 4.0 Workstations in the next
month or so. The users of these workstations will have Domain User
accounts only. My question: Is there a way to REMOTELY disable/enable the
local Administrator accounts on these systems -- either by locking or
changing the password on the account? We don't want the users to be able
log on locally as administrators and have their way with the system.

Thanks!
Jack Jones
jjones@farm-credit.com
Network Analyst -- Security
Northwest Farm Credit Services


As others have pointed out, there are ways around the 256 byte limit --
one easy one is to use the C2 configuration tool (C2config.exe) from the
resource kit. I pasted an 800K warning note into mine, and it works
fine. As always, YMMV.

Shapard Wolf
shap.wolf@asu.edu

At 02:04 PM 8/18/97 -0400, Paul D. Robertson wrote:
>On Mon, 18 Aug 1997, Valerie Leveille wrote:
>
>> Someone wrote that "There are two major types of firewalls deployed as
>> Internet gateways at
>> 
>> present:"Filtering Gateways" and "Application Gateways". "
>> 
>> 
>> There are actually three types of firewalls: Packet Filters, Application
>> Gateways and Stateful Inspection. Packet Filters are basically routers
>
>No, either packet filters, or application layer gateways can keep state,
>so that's not true.

Yes, and even further, packet filters and application proxies are just two
mechanisms that can be used in a firewall together or separately. A
firewall is a system, not a particular thing.

>
>The third type is a hybrid, which does both.

Of course, why not use the benefits of both (when applicable).

>
>> doing what routers were never meant to do - namely, deny packets as
>> oppose to passing them. Application Gateways are a step above packets
>> filters because they examine more than just the IP header. It has
>
>Packet filters examine more than just the IP header, for example the 
>'estabilished' keyword in Cisco access lists, which examines TCP flag
>information. Even simpler is the login control for say, the Netscape
>Proxy server, which allows access based on the state of authentication.

Another point is that some routers are actually designed to do filtering
(NSG Borderguard as an example). These routers can look at much more than
just network and transport headers, but they don't necessarily do much
state analysis. This is where a product like NetRanger (from Wheelgroup)
comes in - it gathers information from the NSG router using the router's
strong ability to peek at information and trigger events, and then it does
the stateful analysis. It is not a firewall per se, but it sure can make
quite an interesting piece of one.

>
>> application awareness which is good and bad. The good is it is aware of
>> the application but bad in that the firewall doesn't inspect it
>> until it reaches the application layer of the OSI
>> model. Thus leaving your entire OS exposed until it reaches the
[snip - following refers to Firewall-1] 
>
>It also fails to keep state on ICMP packets as shipped, and there have
>been reports of problems with the UDP state engine. Just keeping state
>isn't any big deal, what matters is *what* you're keeping state of, and it
>gets _very_ complex to keep state for numerous things at the transport,
>internetwork, and application layer and still protect a machine. The
>whole reason that NT's OOB attacks were successful against Firewall-1
>protected hosts is that the bug in the NT stack was an exploit of a
>legitimate packet, application gateways protected against that attack
>because only the bastion's stack is exposed, not every client behind it,
>which _clearly_ illustrates that FW-1 is a packet filtering firewall,
>irregardless of the fact that it uses dynamic filters which may or may
>not be based on either a little, or a great deal of state information
>depending on the protocol and how much time you want to spend building
>inspect rules.

Firewall-1 has had several implementation based problems, because as Paul
mentioned, the God is in the details when it comes to stateful analysis.
There are better examples of hybrid filtering/application stateful
firewalls, but I refuse to plug products here (personal statement ;).

>
>The buzzword sounds good in marketing, but without any beef to back it
>up, "Stateful inspection" is just a buzzword. State can be anything from
>"yes I saw another packet go out" to "I saw a packet that was a request of
>type x and the application expects a reply of type y from this address at
>that port over protocol z within 15 seconds". There's a large gulf
>between the two, and it still doesn't protect you from attacks at the
>transport layer.

Absolutely. Very well said.

>
>Application gateways remain easier to code correctly, and still provide
>transport and internetwork layer protection to protected hosts that don't 
>come by default in any type of packet filter, stateful, dynamic, or
>static. 
>
>I know it would be much easier to mathematically verify the correctness of
>something like the FWTK's http-gw than it would to do the same to a
>dynamically updated state table.

A good security perimeter will have many layers of protection, and all
these techniques can (and probably should) be used. Use filtering and
stateful analysis to protect the application proxies. Proxies are almost
infinitely less complex than state engines, and therefore are far easier to
verify for correctness. For networks containing confidential information, I
generally recommend removing end to end IP connectivity (use proxies).
 
>
>Irregardless, there remain three types of firewalls, application gateways,
>packet filters and hybrids. Stateful inspection can be implemented in 
>any or all of the above. 
>
>SMTP protection is done at application layer gateways, and virus
>protection can be as well, though I'd argue the merits of having that code
>on a firewall, where it's easily circumventable, and possibly bug-ridden.

Again, I think Paul's comments here are prudent.

> 
>Paul
>-----------------------------------------------------------------------------
>Paul D. Robertson "My statements in this message are personal opinions
>proberts@clark.net which may have no basis whatsoever in fact."


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
At 11:14 8/18/97 -0500, you wrote:

>Is there a way we can prevent users from changing permissions on
>files/directories that they create on remote NT servers?

AFAIK, there isn't any way to stop this. The problem is that creator-owner
has an implicit right to set permissions. IMHO, this should be an
assignable user right, since only admins truly need it.

What _may_ work, but I have not tried, is to set an explicit access denied
ACL that prohibits permission changing. I know that NT checks access
denied ACLs before it checks for allowed. Whether or not this will work
depends on whether the implicit right to set permissions is checked before
or after the rest of the ACL.

If that doesn't work, I'd recommend writing a script to take care of it.
Otherwise, the user could have 10GB of GIF files, and you wouldn't know it.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Hi Everybody,
 Could someone please help me with some good Window's 95 or NT security sites. I am aware of http://www.ntsecurity.com.

Regards,

Ace
I asked for assistance recently regarding limiting a users' concurrent RAS connections...

Some people suggested a couple of links, one of which was NTP software's RAS manager

At least one person asked me to keep him informed if I found anything, but I forgot to save his address... so, I'm replying to the list.

RAS manager from NTP Software does the trick - a little over the top for this simple feature, but it also has something else I've been looking for, for some time - who got what IP address from RAS, and when.

So, it may be useful to others also - I've also seen that IP/RAS question pop up on this forum.

Regards

Bob


bobt@pcdocs.com wrote:

>Would duplicates really help? As the log is being changed by the native
>application, it also changes the duplicate.
>
>Why not instead audit any access to the log files though NT auditing?

I turned on auditing on the entire filesystem and tailored it to the
specific directories but my poor machine thrashes like crazy. Generating
hundreds of audit messages about object access. None of which had anything
to do with the filesystem. Is there ANY way to separate Object auditing
from filesystem auditing? It was impossible to do anything at this point
so I was forced to turn auditing off. This is nuts for a system supposedly
designed for the security concious.

Windows95: noun. 32-bit extensions and a graphical shell for a 16-bit
 patch to an 8-bit operating system originally coded for a 4-bit
 microprocessor, written by a 2-bit company that can't stand 1 bit of
 competition.


GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!
GET ME OFF THIS LIST!!!!!!!!!!!!!!!!!!!!!!!!!!


 Greetings:
 
 I would be careful about configuring SMTP connectivity on/through the 
 Proxy Server. If you check, Proxy Server uses Port 25, which is also
 the port reserved for SMTP. So, if Proxy Server is using Port 25, and 
 you have, say, the Exchange Internet Mail Connector/Service (IMC in 
 V4.0 /IMS in V5.0) running on the same box, what are the chances of 
 NOT having a problem on transactions over Port 25.
 
 In fact, during a conversation with Microsoft Tech Support for Proxy 
 Server, they advised us not to try it. Odd, marketing literature said 
 it could be done --- HOW BIZARRE.
 
 Regards!!!
 
 Dallas N. Bishoff
 MCPS --- NT, Exchange, IIS, Proxy Server
 MCT
 Certified Checkpoint Security Engineer (CCSE)


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Microsoft Proxy server securitly issues?
Author: silicom@netvision.net.il at Internet
Date: 8/15/97 7:38 AM


Dear Friends.
 
There are two major types of firewalls deployed as Internet gateways at 
present:"Filtering Gateways" and "Application Gateways". Both firewall 
designs aim to implement and enforce network security.
 
As I understand "Filtering Gateways" essentially make routing decisions 
based on information contained at the packet level. If a packet content 
meets the security policy criteria (Port, Ip, Dest.) it is forwarded, or 
routed
to the other side of the gateway. Otherwise it is blocked out.
 
"Application Gateways", unlike "Filtering Gateways", operate at the 
connection rather than packet level (user name, protocol specific 
operation: Get, Put)
 
"Application Gateways" are known to be more secure then "Filtering 
Gateways" because they require the firewall provider to understand the 
security implications of supporting an application. They provide proxies 
for each service running behind the firewall.
 
A good "Firewall Application Gateway" will combine "Filtering Gateways" 
features AND provide various proxies for services, running behind the 
proxy server, that will examine each packet internal
content structure prior sending the packet to the specific service (e.g. 
email message packet structure).
 
"Microsoft Proxy Server was primarily designed to manage outbound 
connections and provide performance enhancements for clients on an 
internal network accessing the Internet."
 
This Design concept makes it a good "Application Gateway".
 
In my opinion The MAIN Job of a firewall is to address the security 
issues of
inbound connections coming from the Internet.
 
At this point Microsoft Proxy Server uses a mechanism called Dynamic 
packet
filtering a method that resembles "Filtering Gateways"
 
Unfortunately I have found NO information on how Microsoft Proxy Server 
deals with packet (What proxy services they provide for specific network 
services)
coming from the Internet. I will try explaining my point 
using an example.
 
Suppose I have a network with two servers, one is a Microsoft Proxy 
Server
connected to the Internet the other is a Microsoft Exchange Server 
sitting
behind the proxy server. The exchange server is "server proxied" to 
the proxy server.
 
Now using dynamic packet filter option on the proxy server, if I try to 
initiate a session with the exchange server using a host on the internet 
(untrusted network)for the propose of checking my
mailbox the proxy server will open for me a connection 
for the specific session.
 
It provides 'direct' connectivity between Me (Untrusted)
and the mail system (trusted). I know that the proxy server forwards the 
packets to the exchange server not opening a real direct connection but 
before it sends the packets
 
DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL INTEGRATIY 
AND THE STRUCTRE OF THE SMTP PACKET?
 
AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER) MICROSOFT PROXY 
SERVER IS REGULER PACKET FILLTERING GATEWAY WHEN IT COMES OUT OF THE BOX 
NAKED
(REGRADING INBOUND CONNECTIONS FROM THE INTERNET).
 
Microsoft Proxy Server functionality can be extended using ISAPI (e.g. 
packet Virus checking etc.)
BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"?
 
I posted this message at a couple of proxy server newsgroups on msnews 
server
but didn't get any response.
 
I decided to post the message on ntsecurity@iss.net because the matter 
affects anyone who consults about or deal with NT security.
 
I would appreciate any comment on the matter presented.
 
Yours Truly,
 
Itai Dor-on
Never! You will remain on this list for the rest of your natural life!!!
Your immortal soul is forever logged into the NT Server and it's mailing
list. hehehe suffer.

On Mon, 18 Aug 1997, osiris@pacificnet.net wrote:

> Never! You will remain on this list for the rest of your natural life!!!
> 

jjones@farm-credit.com wrote:
> 
> Greetings,
> 
> We're deploying approximately five hundred NT 4.0 Workstations in the next
> month or so. The users of these workstations will have Domain User
> accounts only. My question: Is there a way to REMOTELY disable/enable the
> local Administrator accounts on these systems -- either by locking or
> changing the password on the account? We don't want the users to be able
> log on locally as administrators and have their way with the system.
> 
> Thanks!
> Jack Jones
> jjones@farm-credit.com
> Network Analyst -- Security
> Northwest Farm Credit Services

You can use User Manager for Domains to connect remote workstation by
selecting 'Users'->'Select Domain' and typing workstation name with back
slashes. For example: \\WKST256. If You have all permissions needeed, of
course.

Then just do what ever you think is necessary.

Heikki Heikkila
---------------------------------------------------------------------
Heikki Heikkila (Heikki.Heikkila@vyh.fi)
West Finland Regional Environment Centre 
VAASA
FINLAND


--
That myth (about the Checkpoint source) has been
covered many times. What was posted was some
inspect code that comes with every copy of FW1.

 Ryan

---------------------------------------------------------------------
From: stoutb @ pios.com (Bill Stout) @ smtp
(See http://www.geocities.com/ResearchTriangle/3372/cpsourceart.htm )

Bill Stout




Don't let them have floppy disks and L0phtcrack.

 Ryan

---------- Previous Message ----------
To: jjones, ntsecurity
cc: 
From: spirooz @ hitech.eds.com (Shahin Pirooz) @ smtp
Date: 08/18/97 02:41:48 PM
Subject: RE: [NTSEC] Remote management of local administrator accounts...

The easiest way is to keep the Local Administrators password from the normal 
users. Only give it to desktop support staff.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Shahin Pirooz mailto:spriooz@hitech.eds.com
*
* System Engineer Electronic Data Systems - HiTech SBU
* Work: 408.524.2852 Fax: 408.524.2896
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----Original Message-----
From: jjones@farm-credit.com [SMTP:jjones@farm-credit.com]
Sent: Monday, August 18, 1997 8:36 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Remote management of local administrator accounts...





Greetings,

We're deploying approximately five hundred NT 4.0 Workstations in the next
month or so. The users of these workstations will have Domain User
accounts only. My question: Is there a way to REMOTELY disable/enable the
local Administrator accounts on these systems -- either by locking or
changing the password on the account? We don't want the users to be able
log on locally as administrators and have their way with the system.

Thanks!
Jack Jones
jjones@farm-credit.com
Network Analyst -- Security
Northwest Farm Credit Services





osiris@pacificnet.net wrote:
> 
> Never! You will remain on this list for the rest of your natural life!!!

Well, if you ask me, I am braindead already....Can't even figure out how
to leave this list ;)))
(I do now, some 50 people replied)

Thanks all!
this file is a .tmp created by photoshop... and when photoshop hangs for any reason it doesn't clean its previous .tmp's files...

Rodrigo

----- Mensagem original -----
De: Bill Stout [SMTP:stoutb@pios.com]
Enviada em: Monday, August 18, 1997 2:25 PM
Para: ntsecurity@iss.net
Assunto: Re: [NTSEC] .tmp files

 

 <>.... 


Also, someone asked me what a (215MB) ~pst2297.tmp file was doing in their
computer (unable to read with notepad/wordpad/word) where the owner was
administrator. I could not answer them.

Bill Stout


Tim_Thorpe.W-CD.B-WATCHTOWER@NOTES.compuserve.com wrote:
> 
> > While it may not work in all instances, when faced with
> >that problem, I created some bmp and gif files with the appropriate
> >volumes of words. The bmp displays on screen for anyone attempting
> >to logon. The gif is used in conjunction with web pages to provide
> >an initial waring banner prior to any other display.
> 
> The warning message works fine for Windows NT clients, but has anyone come up
> with an elegant way for displaying a similar message on Windows 95 clients?

Yes, add string keys LegalNoticeText and LegalNoticeCaption (if desired)
to:

HKEY_Local_Machine/Software/Microsoft/Windows/CurrentVersion/Winlogon

Note: you must add new string variables, they do not appear by default.

Also, I found that I could create a long banner message in Notepad
(remove all carriage returns), copy the string to the clipboard, and use
ctrl-v to dump it into the string value field for LegalNoticeText. Word
wrapping depends on window width.

Joe
-- 
In theory, theory and practice are the same; 
In practice, they're not even close!

Concerning:

> Date: Mon, 18 Aug 97 18:07:50 EST
> From: gamefact@hotmail.com
> To: gamefact@hotmail.com
> Subject: [NTSEC] Copy Games For Sale

I suggest that everyone in this list send a complaint to
abuse@hotmail.com. Be sure to attach an original copy of the message
(only one, please). Visit http://www.hotmail.com/nospam.html for more
information. Please do not reply to this message unless you want to
talk about NT security .

David Pinch
Webmaster, Network Support Specialist
Osseo Area Schools
http://www.osseo.k12.mn.us

> > accounts only. My question: Is there a way to REMOTELY disable/enable the
> > local Administrator accounts on these systems -- either by locking or
> > changing the password on the account? We don't want the users to be able
> > log on locally as administrators and have their way with the system.

The easiest way is to give the Administrator account a long, complex
password that you write down and lock away somewhere. Give it only to
people you trust who have to log on as administrator to an individual
workstation to do "maintenence of last resort" -- when no other way
exists. (Usually after the computer breaks its networking rather badly.)
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
To all you wiseguys.......
>From Majordomo-Owner@iss.net Tue Aug 19 02:43:05 1997
Received: from True.Net (true.net [200.11.130.10]) by reporters.net (8.8.5) id CAA04271; Tue, 19 Aug 1997 02:43:04 -0600 (MDT)
Received: from fwa-1.true.net (fwa-2.true.net [200.11.130.1]) by True.Net (8.8.5/8.6.12) with ESMTP id EAA07370 for ; Tue, 19 Aug 1997 04:42:49 -0400 (AST)
Received: (daemon@localhost) by fwa-1.true.net (8.8.6/8.6.12) id EAA17152 for ; Tue, 19 Aug 1997 04:42:49 -0400 (VET)
Received: from phoenix.iss.net(208.21.0.5) by fwa-1.true.net via smap (V1.3)
 id sma017148; Tue Aug 19 04:42:20 1997
Received: (qmail 16243 invoked by uid 15); 19 Aug 1997 08:42:08 -0000
Date: 19 Aug 1997 08:42:08 -0000
Message-ID: <19970819084208.16242.qmail@iss.net>
To: Patrick.Donker@VHeadline.com.ve
From: Majordomo@iss.net
Subject: Majordomo results: (no subject)
Reply-To: Majordomo@iss.net

--

>>>> unsubscribe ntsecurity
**** unsubscribe: 'Patrick.Donker@VHeadline.com.ve' is not a member of list 'ntsecurity'.
**** contact "ntsecurity-approval@iss.net" if you need help.

At 08:55 18/08/97 -0700, Paul Leach wrote:

>The control is signed by Microsoft, which can be validated by reference
>to a certificate signed by Verisign.
>
>Hence, you should feel reasonably certain that the bits are the ones
>placed on the server by Microsoft and have not been tampered with in
>transit, and trust them (at least) as much as you would a program from
>Microsoft purchased over-the-counter at a local software store.
>
>In any case, you get to choose whether to trust bits signed by Microsoft
>-- it won't download the control automatically.

 I would like to ask one question. 

 A different coded ActiveX control will be able to install the patches with no user assistance (Without asking any kind of control)?

 Yes, I know this control doesn't do it, but is it possible to install them?, is possible to turn off my machine, or to destroy data from my hard disk? 

 On the other hand, how can I know Microsoft is just applying patches? Getting marketing data from my machine with an ActiveX control is pretty easy. (And possibly is not illegal)

 I mean, hacking troubles with an ActiveX from Microsoft? No.
 Programming incompetency from Microsoft Developers? 

 Regards,
rogersm.

 
Hello,

I was just wondering if there are any tcp wrapper tcpd like in NT that will allow
me to use something like %u and %h (as like in Unix/Linux) so that if I put "%u@%h"
in some MOTD(greeting) files where they represents username and hostname 
respectively for the remote connection user to see and knows that he/she 
is logging from that user@host. Or that I can use for other logging purposes. Thanks in advance.

S.

How about this:
Create a Domain Workstation Admin group and assign it to the local Admin
group during install. Then assign a long 'unguessable' password to the
local admin account. You will never need to use this account as you can
simply use the Domain Workstation Admin group to administer the
workstation. As an added advantage you can provide a user with admin
access (add him/her to the Domain Workstation group) for his workstation
and take it away as needed.


>-----Original Message-----
>From: Shahin Pirooz [SMTP:spirooz@hitech.eds.com]
>Sent: Monday, August 18, 1997 3:42 PM
>To: 'jjones@farm-credit.com'; ntsecurity@iss.net
>Subject: RE: [NTSEC] Remote management of local administrator accounts...
>
>The easiest way is to keep the Local Administrators password from the normal
>users. Only give it to desktop support staff.
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>* Shahin Pirooz mailto:spriooz@hitech.eds.com
>*
>* System Engineer Electronic Data Systems - HiTech SBU
>* Work: 408.524.2852 Fax: 408.524.2896
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>-----Original Message-----
>From: jjones@farm-credit.com [SMTP:jjones@farm-credit.com]
>Sent: Monday, August 18, 1997 8:36 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Remote management of local administrator accounts...
>
>
>
>
>
>Greetings,
>
>We're deploying approximately five hundred NT 4.0 Workstations in the next
>month or so. The users of these workstations will have Domain User
>accounts only. My question: Is there a way to REMOTELY disable/enable the
>local Administrator accounts on these systems -- either by locking or
>changing the password on the account? We don't want the users to be able
>log on locally as administrators and have their way with the system.
>
>Thanks!
>Jack Jones
>jjones@farm-credit.com
>Network Analyst -- Security
>Northwest Farm Credit Services
>
>
If you hook up your NT box to a modem and/or a network, does this mean it is 
no longer C2 compliant - even if you meet ALL other C2 requirements and/or 
recommendations?
 -------------------------------------------------
 ---------------------------------------------------
| RezPhreak Server Administrator |
|___________________________________________________|
|IRC Clients: minn.starchat.net |
|IRC via the WWW: http://irc.minn.net:8080 |
|Homepage: http://www1.minn.net/~sathia |
 ---------------------------------------------------
 -------------------------------------------------


You can use NetUserChangePassword to change the admin account password
on a local system.

If you change it to a completely random 14 character value, using all
107 possible characters (see http://www.ntadvice.com/samfaq.htm) then it
will take a sinngle PPRO 200 mhz an average of 58 years to crack the
password (based on the claim in the L0phtcrack 1.5 readme that it takes
26 hours to search the entire keyspace for 7 lower case characters.)

However, it's probably better to just use NetUserSetInfo, info level 1,
to disable the account. (I'm assuming that the local Administrators
group akready has (e.g.) Domain\Administrators as a member.)
> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Reply To: Ryan Russell/SYBASE
> Sent: Monday, August 18, 1997 8:43 PM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Remote management of local administrator
> accounts...
> 
> Don't let them have floppy disks and L0phtcrack.
> 
> Ryan
> 
> ---------- Previous Message ----------
> To: jjones, ntsecurity
> cc: 
> From: spirooz @ hitech.eds.com (Shahin Pirooz) @ smtp
> Date: 08/18/97 02:41:48 PM
> Subject: RE: [NTSEC] Remote management of local administrator
> accounts...
> 
> The easiest way is to keep the Local Administrators password from the
> normal 
> users. Only give it to desktop support staff.
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> * Shahin Pirooz mailto:spriooz@hitech.eds.com
> *
> * System Engineer Electronic Data Systems - HiTech SBU
> * Work: 408.524.2852 Fax: 408.524.2896
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> -----Original Message-----
> From: jjones@farm-credit.com [SMTP:jjones@farm-credit.com]
> Sent: Monday, August 18, 1997 8:36 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Remote management of local administrator accounts...
> 
> 
> 
> 
> 
> Greetings,
> 
> We're deploying approximately five hundred NT 4.0 Workstations in the
> next
> month or so. The users of these workstations will have Domain User
> accounts only. My question: Is there a way to REMOTELY
> disable/enable the
> local Administrator accounts on these systems -- either by locking or
> changing the password on the account? We don't want the users to be
> able
> log on locally as administrators and have their way with the system.
> 
> Thanks!
> Jack Jones
> jjones@farm-credit.com
> Network Analyst -- Security
> Northwest Farm Credit Services
> 
> 
> 
> 
> 
On Tue, 19 Aug 1997, Ron Schreiner wrote:

->If you hook up your NT box to a modem and/or a network, does this mean it is 
->no longer C2 compliant - even if you meet ALL other C2 requirements and/or 
->recommendations?
 
 Yes. You would no longer be C2 compliant.

jamie jamie@comet.net
***************************************************************************
 For PGP public key, mail me with Subject:GET KEY
 For random Ambrose Bierce quote, Mail me with Subject: ambrose 
 Support the anti-Spam amendment - Join at http://www.cauce.org/
 "We have no intention of shipping another bloated OS and shoving it down 
 the throats of our users." -Paul Maritz, Microsoft group vice president

Hi all,

On Tue, 19 Aug 1997, Warren Beaudry wrote:

> How about this:
> Create a Domain Workstation Admin group and assign it to the local Admin
> group during install. Then assign a long 'unguessable' password to the
> local admin account. You will never need to use this account as you can
> simply use the Domain Workstation Admin group to administer the
> workstation. As an added advantage you can provide a user with admin
> access (add him/her to the Domain Workstation group) for his workstation
> and take it away as needed.

Please excuse me if it turns out to be a no-brainer....

Why do we need to create the "Domain Workstation Admin" group? I mean,
if a user need local admin access, surely we can simply put him in the
local Admininstrators group when needed. Am I missing anything?

Thanks!

 Ko


As far as i know, C2 does't apply to networks, so if your box is
networked, it's not C2 compliant.

Panayiotes Psihoyios
e-mail : ppsihoyios@techno.hol.gr
 psihoyios@hol.gr
Technognosis S.A.
7, Agias Glikerias Street
Galatsi
Athens 111-47
Greece
Tel: ++301 - 2220549
Fax: ++301 - 2131303


>----------
>From: Ron Schreiner[SMTP:tech@minn.net]
>Sent: Ôñßôç, 19 Áõãïýóôïõ 1997 1:58 ìì
>To: ntsecurity@iss.net
>Subject: [NTSEC] C2
>
>If you hook up your NT box to a modem and/or a network, does this mean it is 
>no longer C2 compliant - even if you meet ALL other C2 requirements and/or 
>recommendations?
> -------------------------------------------------
> ---------------------------------------------------
>| RezPhreak Server Administrator |
>|___________________________________________________|
>|IRC Clients: minn.starchat.net |
>|IRC via the WWW: http://irc.minn.net:8080 |
>|Homepage: http://www1.minn.net/~sathia |
> ---------------------------------------------------
> -------------------------------------------------
>
>
>
On Tue, 19 Aug 1997, Ron Schreiner wrote:

> If you hook up your NT box to a modem and/or a network, does this mean it is 
> no longer C2 compliant - even if you meet ALL other C2 requirements and/or 
> recommendations?

Yes, just as if you have a floppy drive on the machine it doesn't meet the
evaluated configuration, or if it isn't one of the two exact models of PC
which were evaluated. If you have a C2 requirement, then you must either
get your own eval, or meet the exact criteria in the prior eval. If
you're looking for real security, C2 isn't it.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Help !

Is there someone who knows something about this fact:

If I use the Win32 function "GetSecurityDescriptorDacl" I can get the
information "is a DACL present". What does it mean if this flag is not
set. Is there no security available, is implicitly set "no aceess", or
will this object get an inheritance, but from where or from who?

Christian Buerger
christian.buerger@istech.de



> ----------
> From: Roger Sen Montero[SMTP:rogersm@lix.intercom.es]
> Reply To: Roger Sen Montero
> Sent: Tuesday, August 19, 1997 7:34 AM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Hotfixes 
> 
> At 08:55 18/08/97 -0700, Paul Leach wrote:
> 
> >The control is signed by Microsoft, which can be validated by
> reference
> >to a certificate signed by Verisign.
> >
> >Hence, you should feel reasonably certain that the bits are the ones
> >placed on the server by Microsoft and have not been tampered with in
> >transit, and trust them (at least) as much as you would a program
> from
> >Microsoft purchased over-the-counter at a local software store.
> >
> >In any case, you get to choose whether to trust bits signed by
> Microsoft
> >-- it won't download the control automatically.
> 
> I would like to ask one question. 
> 
> A different coded ActiveX control will be able to install the patches
> with no user assistance (Without asking any kind of control)?
> 
Not unless you have previously said that you trust ANY ActiveX control
written by Microsoft and don't want to be prompted. Otherwise, you will
be always be prompted before the control is executed.

> Yes, I know this control doesn't do it, but is it possible to install
> them?, is possible to turn off my machine, or to destroy data from my
> hard disk?
> 
Yes. Just as it is possible for MS Word or MS Excel or MS Windows to
destroy data and turn off your machine. 

> On the other hand, how can I know Microsoft is just applying patches?
> Getting marketing data from my machine with an ActiveX control is
> pretty easy. (And possibly is not illegal)
> 
How do you know what MS Word or Windows is doing while you are connected
to the net?

> I mean, hacking troubles with an ActiveX from Microsoft? No.
> Programming incompetency from Microsoft Developers?
> 
I was very careful in my wording -- all I said was that you should trust
an ActiveX control from Microsoft at least as much as you trust code
from Microsoft that you buy over-the-counter. For some people (and you
seem to be leaning that direction), that's not very much.

Paul
> 
> 
> 
To add onto this: Make the password into 3 parts and give each part to 3 
seperate and trusted people. Make sure the password(s) do not relate to each 
other in any way. In other words, don't use phrases, acronyms, etc.

I would suggestion something like this:


Person A: $~c8
Person B: a57~
Person C: 1g.s

Ever part of the 3 parts has a letter, number, and symbol.
The entire password is: $~c8a57~1g.s

Granted, not as easy as mary's little lamb - but it's alot more secure.

On Tue, 19 Aug 1997 09:24:44 -0500,
ssutton@trustedsystems.com wrote...
>> > accounts only. My question: Is there a way to REMOTELY disable/enable 
>the
>> > local Administrator accounts on these systems -- either by locking or
>> > changing the password on the account? We don't want the users to be 
>able
>> > log on locally as administrators and have their way with the system.
>
>The easiest way is to give the Administrator account a long, complex
>password that you write down and lock away somewhere. Give it only to
>people you trust who have to log on as administrator to an individual
>workstation to do "maintenence of last resort" -- when no other way
>exists. (Usually after the computer breaks its networking rather badly.)
>-- 
>STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
> Phone: (217) 344-0996 1107 S. Orchard Street
> FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
> E-mail: SSutton@TrustedSystems.com 
> WWW: http://www.TrustedSystems.com/
>
>
>

 -------------------------------------------------
 ---------------------------------------------------
| RezPhreak Server Administrator |
|___________________________________________________|
|IRC Clients: minn.starchat.net |
|IRC via the WWW: http://irc.minn.net:8080 |
|Homepage: http://www1.minn.net/~sathia |
 ---------------------------------------------------
 -------------------------------------------------


Nice idea. However, this would give all the users in that Domain Workstation group access to *all* the workstations and not just their own, would it not? 
I believe just disabling the local Admin user would serve the original requestor's purpose as the Domain Admins can do any local administration that is needed.

Barry
=================================================
Barry D. Lewis
Cerberus ISC Inc.

lewisb@cerberus.com
www.cerberus.com
Co-author: Teach Yourself NT Server in 14 Days, 1997
Co-author: Computer Security for Dummies, 1996
Carpe Diem!
=================================================


-----Original Message-----
From: Warren Beaudry [SMTP:BeaudryW@CompCanada.ab.ca]
Sent: Tuesday, August 19, 1997 11:53 AM
To: 'Shahin Pirooz'; 'jjones@farm-credit.com'; 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Remote management of local administrator accounts...

How about this:
Create a Domain Workstation Admin group and assign it to the local Admin
group during install. Then assign a long 'unguessable' password to the
local admin account. You will never need to use this account as you can
simply use the Domain Workstation Admin group to administer the
workstation. As an added advantage you can provide a user with admin
access (add him/her to the Domain Workstation group) for his workstation
and take it away as needed.


>-----Original Message-----
>From: Shahin Pirooz [SMTP:spirooz@hitech.eds.com]
>Sent: Monday, August 18, 1997 3:42 PM
>To: 'jjones@farm-credit.com'; ntsecurity@iss.net
>Subject: RE: [NTSEC] Remote management of local administrator accounts...
>
>The easiest way is to keep the Local Administrators password from the normal
>users. Only give it to desktop support staff.
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>* Shahin Pirooz mailto:spriooz@hitech.eds.com
>*
>* System Engineer Electronic Data Systems - HiTech SBU
>* Work: 408.524.2852 Fax: 408.524.2896
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>-----Original Message-----
>From: jjones@farm-credit.com [SMTP:jjones@farm-credit.com]
>Sent: Monday, August 18, 1997 8:36 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Remote management of local administrator accounts...
>
>
>
>
>
>Greetings,
>
>We're deploying approximately five hundred NT 4.0 Workstations in the next
>month or so. The users of these workstations will have Domain User
>accounts only. My question: Is there a way to REMOTELY disable/enable the
>local Administrator accounts on these systems -- either by locking or
>changing the password on the account? We don't want the users to be able
>log on locally as administrators and have their way with the system.
>
>Thanks!
>Jack Jones
>jjones@farm-credit.com
>Network Analyst -- Security
>Northwest Farm Credit Services
>
>

At 09:19 19/08/97 -0700, you wrote:

>> Yes, I know this control doesn't do it, but is it possible to install
>> them?, is possible to turn off my machine, or to destroy data from my
>> hard disk?
>Yes. Just as it is possible for MS Word or MS Excel or MS Windows to
>destroy data and turn off your machine. 

 Yes, I alredy noticed. But it does not annoy me. After all, they run on
my desktop, not in the server.

>How do you know what MS Word or Windows is doing while you are connected
>to the net?

 I don't know it, and it bothers me, but it bothers me as a user, not as a system administrator. 

>> I mean, hacking troubles with an ActiveX from Microsoft? No.
>> Programming incompetency from Microsoft Developers?
>I was very careful in my wording -- all I said was that you should trust
>an ActiveX control from Microsoft at least as much as you trust code
>from Microsoft that you buy over-the-counter. For some people (and you
>seem to be leaning that direction), that's not very much.

 I noticed the careful wording, it was funny to read. 

 Ah!! I did not want to imply distrust to Microsoft code. I think I mistyped
my thoughts, I usually do not trust any developers. I used to be one 

Regards,
rogersm.
Null DACL means all access. Empty DACL means NO access (except implicit
owner access). 

Inheritance will not affect this object, inheritance only has an effect
during object creation, when the object inherits certain ACEs from the
parent.

Phil

> -----Original Message-----
> From: Burger, Fa. I&S [SMTP:buerger@ms.postag.de]
> Sent: Tuesday, August 19, 1997 7:40 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] SECURITY_DESCRIPTOR_CONTROL / SE_DACL_PRESENT
> 
> Help !
> 
> Is there someone who knows something about this fact:
> 
> If I use the Win32 function "GetSecurityDescriptorDacl" I can get the
> information "is a DACL present". What does it mean if this flag is not
> set. Is there no security available, is implicitly set "no aceess", or
> will this object get an inheritance, but from where or from who?
> 
> Christian Buerger
> christian.buerger@istech.de
True, this Domain Workstation Admin thing could be useful for a Help
Desk scenario where you don't want Domain Admin level access provided to
the support people, just local Admin for all workstations.

>-----Original Message-----
>From: Barry Lewis [SMTP:lewisb@cerberus.com]
>Sent: Tuesday, August 19, 1997 12:00 PM
>To: Warren Beaudry; 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Remote management of local administrator accounts...
>
>Nice idea. However, this would give all the users in that Domain Workstation
>group access to *all* the workstations and not just their own, would it not? 
>I believe just disabling the local Admin user would serve the original
>requestor's purpose as the Domain Admins can do any local administration that
>is needed.
>
>Barry
>=================================================
>Barry D. Lewis
>Cerberus ISC Inc.
>
>lewisb@cerberus.com
>www.cerberus.com
>Co-author: Teach Yourself NT Server in 14 Days, 1997
>Co-author: Computer Security for Dummies, 1996
>Carpe Diem!
>=================================================
>
>
>-----Original Message-----
>From: Warren Beaudry [SMTP:BeaudryW@CompCanada.ab.ca]
>Sent: Tuesday, August 19, 1997 11:53 AM
>To: 'Shahin Pirooz'; 'jjones@farm-credit.com'; 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Remote management of local administrator accounts...
>
>How about this:
>Create a Domain Workstation Admin group and assign it to the local Admin
>group during install. Then assign a long 'unguessable' password to the
>local admin account. You will never need to use this account as you can
>simply use the Domain Workstation Admin group to administer the
>workstation. As an added advantage you can provide a user with admin
>access (add him/her to the Domain Workstation group) for his workstation
>and take it away as needed.
>
>
>>-----Original Message-----
>>From: Shahin Pirooz [SMTP:spirooz@hitech.eds.com]
>>Sent: Monday, August 18, 1997 3:42 PM
>>To: 'jjones@farm-credit.com'; ntsecurity@iss.net
>>Subject: RE: [NTSEC] Remote management of local administrator accounts...
>>
>>The easiest way is to keep the Local Administrators password from the normal
>>users. Only give it to desktop support staff.
>>
>>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>* Shahin Pirooz mailto:spriooz@hitech.eds.com
>>*
>>* System Engineer Electronic Data Systems - HiTech SBU
>>* Work: 408.524.2852 Fax: 408.524.2896
>>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>
>>-----Original Message-----
>>From: jjones@farm-credit.com [SMTP:jjones@farm-credit.com]
>>Sent: Monday, August 18, 1997 8:36 AM
>>To: ntsecurity@iss.net
>>Subject: [NTSEC] Remote management of local administrator accounts...
>>
>>
>>
>>
>>
>>Greetings,
>>
>>We're deploying approximately five hundred NT 4.0 Workstations in the next
>>month or so. The users of these workstations will have Domain User
>>accounts only. My question: Is there a way to REMOTELY disable/enable the
>>local Administrator accounts on these systems -- either by locking or
>>changing the password on the account? We don't want the users to be able
>>log on locally as administrators and have their way with the system.
>>
>>Thanks!
>>Jack Jones
>>jjones@farm-credit.com
>>Network Analyst -- Security
>>Northwest Farm Credit Services
>>
>>
>
 Hello,
 
 I have been testing MS Proxy Server (version 2.0 beta) for the last 
 couple of weeks. I'm trying to use the "reverse proxy" and "reverse 
 hosting" features to allow mobile and home users to access the company 
 intranet. The initial test configuration was as follows:
 
 1) The Intranet Server is running NT 4.0 Service Pack 3 and IIS 3.0. 
 IIS was set up to use NT Challenge/Response only. If you are a member 
 of the company domain users, you can access the intranet server.
 
 2) The Proxy Server is 2.0 beta on NT 4.0 Service Pack 3 and IIS 3.0. 
 IIS was set up to use NT Challenge/Response only. Since proxy server 
 runs as a sub-service to IIS, it uses the security features of IIS. 
 The Proxy is setup as:
 
 Permissions - enable access control for company domain users.
 Caching - enabled
 Publishing - Enable Web Publishing and directed to Intranet Server.
 
 3) The clients were running Win95 and using MS Internet Explorer 3.02. 
 IE was configured to use the Proxy Server for only HTTP connections. 
 The primary logon was MS Client for Networks, and you were requested 
 to logon to the company domain.
 
 We were using a service provided by Sprint called Dial IP. The 
 service provides local phone numbers throughout the US to access their 
 network. The Sprint network is strictly TCP/IP with no naming service. 
 You map a Sprint IP Address to your proxy server IP address.
 
 The test was as follows:
 
 Attempt #1: Logged on to Sprint Network. Receive error message that a 
 domain controller can't be found. Whoops! Since our domain controller 
 is on our network, not Sprints, we can't use MS Client for Networks to 
 log on to the Sprint Network.
 
 Attempt #2: Logged on using Windows Logon. No error message. We are 
 asked to authenticate at the Proxy Server. Try entering DOMAIN\UserID 
 and password. Seem to be authenticated. Tried accessing the intranet 
 server and received the Proxy Error Message : Access is denied. (I 
 learned to hate this message.) It seemed like the authentication 
 between the Proxy Server and Intranet Server wasn't working.
 
 After several other attempts (3,4,5,6,?), I finally broke down and 
 called Microsoft. The first tech support person suggested going back 
 to version 1.0. I didn't have the heart to tell him that reverse 
 proxying wasn't supported in the earlier version, and that if he had 
 read his own wonderful documentation, he would have known the 
 difference. So, I called again and asked for a different tech support 
 person. After explaining my set up, he informed me that Windows NT 
 Challenge/Response doesn't work in IE 3.02 and still doesn't in 4.0. 
 Ergggggggg!!!!!!!!! He suggested trying Basic Authentication or 
 Anonymous.
 
 Using Basic Authentication worked, but users on our internal network 
 would be required to log onto the intranet server. Currently, once 
 they are authenticated on the company domain, they don't have to log 
 onto the intranet server.
 
 Lastly, from reading the MS Proxy Server 2.0 documentation, the Proxy 
 Server should only direct external HTTP requests to one server. 
 However, we have a second server using anonymous security which I was 
 able to access. Why was I able to get to the second server? Did I have 
 proxy configured incorrectly or did I not understand the documentation 
 correctly?
 
 Has anyone been able to get NT Authentication working using MS Proxy 
 Server 2.0? I don't know whether to believe MS or not. There was no 
 reference to the problem in their KB (Surprise!). Oh by the way, I was 
 able to use RAS and authenticate using NT Challenge/Response, but with 
 no Proxy Server. Could the problem be with the Proxy Server? Any 
 feedback would be appreciated.
 
 Thanks in advance,
 
 John Robbins


______________________________ Reply Separator _________________________________
Subject: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
Author: Itai Dor-on at Internet
Date: 8/19/97 10:11 AM


Hi.
 
I apologize to all the wonderful people taking the effort
to reply to my email message "Microsoft Proxy server security issues?"
 
I forgot to mention that I was referring to Microsoft Proxy Server 
Version 2.0 (Beta) which is supposed to have firewall capabilities. 
(Dynamic Packet Filter, Reverse Hosting & Etc.)
 
 
The majority of comments referred to Proxy server version 1.0 which 
has no firewall capabilities, therefore they are irrelevant to my 
statements.
 
If anybody would like to re-comment on the matter I am including in this 
email the original modified message.
 
Sincerely,
Itai Dor-on
 
 
"Dear Friends.
 
There are two major types of firewalls deployed as Internet gateways at 
present:"Filtering Gateways" and "Application Gateways". Both firewall 
designs aim to implement and enforce network security.
 
As I understand "Filtering Gateways" essentially make routing decisions 
based on information contained at the packet level. If a packet content 
meets the security policy criteria (Port, Ip, Dest.) it is forwarded, or 
routed to the other side of the gateway. Otherwise it is blocked out.
 
"Application Gateways", unlike "Filtering Gateways", operate at the 
connection rather than packet level (user name, protocol specific 
operation: Get, Put)
 
"Application Gateways" are known to be more secure then "Filtering 
Gateways" because they require the firewall provider to understand the 
security implications of supporting an application. They provide proxies 
for each service running behind the firewall.
 
A good "Firewall Application Gateway" will combine "Filtering Gateways" 
features AND provide various proxies for services, running behind the 
proxy server, that will examine each packet internal 
content structure prior sending the packet to the specific service (e.g. 
email message packet structure). 
 
"Microsoft Proxy Server 2.0 (Beta) was primarily designed to manage 
outbound
connections and provide performance enhancements for clients on an 
internal network accessing the Internet."
 
This Design concept makes it a good "Application Gateway".
 
In my opinion The MAIN Job of a firewall is to address the 
security issues of inbound connections coming from the Internet. 
 
At this point Microsoft Proxy Server 2.0 (Beta)uses a mechanism called 
Dynamic
packet filtering a method that resembles "Filtering Gateways"
 
Unfortunately I have found NO information on how Proxy proxy server 2.0 
(Beta)
deals with packet (What proxy services they provide for specific network 
services) coming from the Internet. I will try explaining my point 
using an example.
 
Suppose I have a network with two servers, one is a Microsoft Proxy 
Server connected to the Internet the other is a Microsoft Exchange 
Server
sitting behind the proxy server. The exchange server is "server proxied" 
to 
the proxy server.
 
Now using dynamic packet filter option on the proxy server, if I try to 
initiate a session with the exchange server using a host on the internet 
(untrusted network)for the propose of checking my mailbox the proxy 
server 
will open for me a connection for the specific session. 
 
It provides 'direct' connectivity between Me (Untrusted) and the mail 
system 
(trusted). I know that the proxy server forwards the packets to the 
exchange 
server not opening a real direct connection but before it sends the 
packets
 
DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL INTEGRATIY 
AND THE STRUCTRE OF THE SMTP PACKET?
 
AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER) MICROSOFT PROXY 
SERVER IS REGULER PACKET FILLTERING GATEWAY, THAT IS EQUIVELENT TO THE 
"PORT RULES" FETURE IN THE TCPI/IP ADVANCED SETTINGS, WHEN IT COMES 
OUT OF THE BOX NAKED.(REGRADING INBOUND CONNECTIONS FROM THE INTERNET).
 
Microsoft Proxy Server 2.0 (Beta) functionality can be extended using 
ISAPI (e.g.
packet Virus checking etc.)
 
BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"? 
 
I posted this message at a couple of proxy server newsgroups on msnews 
server but didn't get any response.
 
I decided to post the message on ntsecurity@iss.net because the matter 
affects anyone who consults about or deal with NT security.
 
I would appreciate any comment on the matter presented. 
 
Yours Truly,
 
Itai Dor-on"
----- Forwarded Message Starts Here -----

From: star@powr.net
Date: Tue, 19 Aug 1997 11:05:16 -0500
To: 
Subject: Fw: DALnet-Ops: CIAC Bulletin H-96: Vulnerability in Bind

[ For Public Release ] 
 __________________________________________________________

 The U.S. Department of Energy
 Computer Incident Advisory Capability
 ___ __ __ _ ___
 / | /_\ /
 \___ __|__ / \ \___
 __________________________________________________________

 INFORMATION BULLETIN

 Vulnerability in Bind
 (Update to Bulletin G-14, Domain Name Service Vulnerabilities)

August 14, 1997 21:00 GMT Number
H-96
____________________________________________________________________________
__
PROBLEM: Domain Name Service (DNS) servers being exploited, using
BIND
 and sendmail weaknesses.
PLATFORM: Systems running any version of BIND before release 8.1.1.
DAMAGE: Data becomes corrupted ("cache poisoning").
SOLUTION: Patches or workarounds are available for several platforms.
See
 below.
____________________________________________________________________________
__
VULNERABILITY Intruders have been able to exploit this vulnerability on
DNS
ASSESSMENT: servers. This vulnerability may potentially extend to other
 network services.
____________________________________________________________________________
__

[Start CERT Advisory]

============================================================================
=
CERT* Advisory CA-97.22
Original issue date: August 13, 1997
Last revised: --

Topic: BIND - the Berkeley Internet Name Daemon
-
----------------------------------------------------------------------------
-

 *** This advisory supersedes CA-96.02. ***

Several vulnerabilities in the Berkeley Internet Name Daemon (BIND) have
been
fixed in the current version of BIND. One of those vulnerabilities is now
being exploited, a vulnerability that results in cache poisoning (malicious
or misleading data from a remote name server is saved [cached] by another
name server). All versions of BIND before release 8.1.1 are vulnerable.

The CERT/CC team recommends installing a patch from your vendor (See
Appendix
A). Until you can install a vendor patch, we recommend the workaround
described in Section III.B. We also urge you to take the additional
precautions described in Section III.C.

We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.

-
----------------------------------------------------------------------------
-

I. Description

 The Berkeley Internet Name Daemon (BIND) is an implementation of the
 Domain Name Service (DNS) written primarily for UNIX Systems. BIND
 consists of three parts:

 * The client part. This part contains subroutine libraries used by
 programs that require DNS services. Example clients of these
libraries
 are telnet, the X Windows System, and ssh (the secure shell). The
 client part consists of subroutine libraries, header files, and
manual
 pages.

 * The server part. This part contains the name server daemon (named)
and
 its support program (named-xfer). These programs provide one source
of
 the data used for mapping between host names and IP addresses. When
 appropriately configured, these name server daemons can interoperate
 across a network (the Internet for example) to provide the mapping
 services for that network. The server part consists of the daemon,
its
 support programs and scripts, and manual pages.

 * The tools part. This part contains various tools for interrogating
 name servers in a network. They use the client part to extract
 information from those servers. The tools part consists of these
 interrogation tools and manual pages.

 As BIND has matured, several vulnerabilities in the client, server,
 and tools parts have been fixed. Among these is server cache
poisoning.
 Cache poisoning occurs when malicious or misleading data received from
 a remote name server is saved (cached) by another name server. This
 "bad" data is then made available to programs that request the cached
 data through the client interface.

 Analysis of recent incidents reported to the CERT Coordination Center
 has shown that the cache poisoning technique is being used to
adversely
 affect the mapping between host names and IP addresses. Once this
 mapping has been changed, any information sent between hosts on a
 network may be subjected to inspection, capture, or corruption.

 Although the new BIND distributions do address important security
 problems, not all known problems are fixed. In particular, several
 problems can be fixed only with the use of cryptographic
authentication
 techniques. Implementing and deploying this solution is non-trivial;
 work on this task is currently underway within the Internet community.

II. Impact

 The mapping between host names and IP addresses may be changed. As
 a result, attackers can inspect, capture, or corrupt the information
 exchanged between hosts on a network.

III. Solution

 A. Obtain and install a patch for this problem.

 Information from vendors can be found in Appendix A of this
advisory;
 we will update the appendix as we receive more information.


 B. Until you are able to install the appropriate patch, we recommend
 the following workaround.

 The "best practice" for operating the publicly available BIND
 system can be either:

 * a heterogeneous solution that involves first installing BIND
 release 4.9.6 and then release 8.1.1, or

 * a homogeneous solution that involves installing only BIND
release
 8.1.1.

 In the paragraphs below, we describe how to determine which
solution
 you should use.

 1. Shared Object Client Subroutine Library

 If your system and its programs rely on the shared object
client
 subroutine library that comes with some releases of BIND,
probably
 named libresolv.so, then you need the shared object subroutine
 library and other client software from release 4.9.6. (As of
 this writing, BIND version 8 does not yet support the client
 part as a shared object library.) This client software is
 available at

 ftp://ftp.isc.org/isc/bind/src/4.9.6/bind-4.9.6-REL.tar.gz
 MD5 (bind-4.9.6-REL.tar.gz) =
76dd66e920ad0638c8a37545a6531594

 Follow the instructions in the file named INSTALL in the
top-level
 directory.

 After installing this client part, install the server and tool
 parts from release 8.1.1. This software is available at

 ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz
 MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0

 Follow the instructions in the src/INSTALL file. Note that
 this version will install the client libraries and header files
 in a non-standard place, /usr/local/lib and /usr/local/include.
 The src/INSTALL file describes what is being installed and
 where.

 When you install release 4.9.6 first, its client, server, and
 tools parts will be installed in the production locations. When
 you then install release 8.1.1, the server and tools parts will
be
 overwritten by that release's versions, but the 4.9.6 client
part
 will not.

 2. No Shared Object Client Subroutine Library

 If you do not need the shared object client subroutine library,
 then you need only upgrade to release 8.1.1. This software is
 available at

 ftp://ftp.isc.org/isc/bind/src/8.1.1/bind-src.tar.gz
 MD5 (bind-src.tar.gz) = 7487b8d647edba2053edc1cda0c6afd0

 Follow the instructions in src/INSTALL. Note that the client
 subroutine library and header files are installed in
 /usr/local/lib and /usr/local/include respectively. To use
 these when building other systems, you will need to refer to
 their installed locations.


 Note: ftp://ftp.isc.org/isc/bind/src/ is mirrored in
 Germany at ftp://ftp.cert.dfn.de/pub/tools/net/bind/src/

 As new versions of BIND are released in the future, you will be
able
 to find them at these sites, as well as other mirrors. You can also
 check ftp://info.cert.org/pub/latest_sw_versions/ for version
 information.


 C. Take additional precautions. 

 As good security practice in general, filter at a router all
 name-based authentication services so that you do not rely on DNS
 information for authentication. This includes the services rlogin,
rsh
 (rcp), xhost, NFS, and any other locally installed services that
 provide trust based on domain name information.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Appendix A - Vendor Information

Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional
information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.


Cray Research - A Silicon Graphics Company
===========================================
 Cray Research has determined that the version of BIND shipped with all
 current releases of Unicos and Unicos/mk are susceptible to the problem
 described in this advisory. We are currently working on upgrading our
 version of BIND to the 4.9.6 release.


Digital Equipment Corporation
=============================
xref CASE ID: SSRT0494U

 At the time of writing this document, patches(binary kits) are in
 progress and final patch testing is expected to begin soon.
 Digital will provide notice of the completion/availability of the
 patches through AES services (DIA, DSNlink FLASH) and be
 available from your normal Digital Support channel.

 DIGITAL EQUIPMENT CORPORATION AUG/97
 ----------------------------- ------

Hewlett-Packard Company
=======================
 HP is vulnerable. Patches in process.


IBM Corporation
===============
 IBM is currently working on the following APARs which will be
 available soon:

 AIX 4.1: IX70236
 AIX 4.2: IX70237

 To Order
 --------
 APARs may be ordered using Electronic Fix Distribution (via FixDist)
 or from the IBM Support Center. For more information on FixDist,
 reference URL:

 http://service.software.ibm.com/aixsupport/

 or send e-mail to aixserv@austin.ibm.com with a subject of "FixDist".

 IBM and AIX are registered trademarks of International Business Machines
 Corporation.


NEC Corporation
===============
 NEC is vulnerable. The systems affected by this problem
 are as follows:

 UX/4800
 UX/4800(64)
 EWS-UX/V(Rel4.2MP)
 EWS-UX/V(Rel4.2)
 UP-UX/V(Rel4.2MP)

 Patches are in progress and will be made available from
 ftp://ftp.meshnet.or.jp/pub/48pub/security.


Siemens-Nixdorf Informationssysteme AG
======================================
 We are investigating this problem and will provide updated information
 for this advisory when it becomes available.


The Santa Cruz Operation
========================
 The following SCO operating systems are vulnerable: 

 - SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
 - SCO OpenServer 5.0
 - SCO UnixWare 2.1

 SCO CMW+ 3.0 is not vulnerable as bind is not supported on CMW+
platforms.

 SCO has made an interim fix available for anonymous ftp:

 ftp://ftp.sco.com/SSE/sse008.ltr.Z - cover letter
 ftp://ftp.sco.com/SSE/sse008.tar.Z - replacement binaries

 The fix includes binaries for the following SCO operating systems:

 - SCO Open Desktop/Open Server 3.0, SCO UNIX 3.2v4
 - SCO OpenServer 5.0
 - SCO UnixWare 2.1


Sun Microsystems, Inc.
======================
 We are producing patches.

-
----------------------------------------------------------------------------
-

The CERT Coordination Center staff thanks Paul Vixie and Wolfgang Ley for
their contributions to this advisory.

-
----------------------------------------------------------------------------
-

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident
Response
and Security Teams (see http://www.first.org/team-info/).


CERT/CC Contact Information
- -----------------------------
Email cert@cert.org

Phone +1 412-268-7090 (24-hour hotline)
 CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) /
EDT(GMT-4)
 and are on call for emergencies during other hours.

Fax +1 412-268-6989

Postal address
 CERT Coordination Center
 Software Engineering Institute
 Carnegie Mellon University
 Pittsburgh PA 15213-3890
 USA

Using encryption
 We strongly urge you to encrypt sensitive information sent by email. We
can
 support a shared DES key or PGP. Contact the CERT/CC for more
information.
 Location of CERT PGP key
 ftp://info.cert.org/pub/CERT_PGP.key

Getting security information
 CERT publications and other security information are available from
 http://www.cert.org/
 ftp://info.cert.org/pub/

 CERT advisories and bulletins are also posted on the USENET newsgroup
 comp.security.announce

 To be added to our mailing list for advisories and bulletins, send
 email to
 cert-advisory-request@cert.org
 In the subject line, type
 SUBSCRIBE your-email-address

-
----------------------------------------------------------------------------


Copyright 1997 Carnegie Mellon University. Conditions apply; they can be
found
in http://www.cert.org/legal_stuff.html and
ftp://info.cert.org/pub/legal_stuff. If you do not have FTP or web access,
send mail to cert@cert.org with "copyright" in the subject line.

*CERT is registered in the U.S. Patent and Trademark Office.

-
---------------------------------------------------------------------------

This file: ftp://info.cert.org/pub/cert_advisories/CA-97.22.bind
 http://www.cert.org
 click on "CERT Advisories"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history


[End CERT Advisory]


____________________________________________________________________________
__

CIAC wishes to acknowledge the contributions of CERT for the
information contained in this bulletin.
____________________________________________________________________________
__


CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
 Voice: +1 510-422-8193
 FAX: +1 510-423-8002
 STU-III: +1 510-423-2604
 E-mail: ciac@llnl.gov

For emergencies and off-hour assistance, DOE, DOE contractor sites,
and the NIH may contact CIAC 24-hours a day. During off hours (5PM -
8AM PST), call the CIAC voice number 510-422-8193 and leave a message,
or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two
Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC
duty person, and the secondary PIN number, 8550074 is for the CIAC
Project Leader.

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

 World Wide Web: http://ciac.llnl.gov/
 Anonymous FTP: ciac.llnl.gov (198.128.39.53)
 Modem access: +1 (510) 423-4753 (28.8K baud)
 +1 (510) 423-3331 (28.8K baud)

CIAC has several self-subscribing mailing lists for electronic
publications:
1. CIAC-BULLETIN for Advisories, highest priority - time critical
 information and Bulletins, important computer security information;
2. CIAC-NOTES for Notes, a collection of computer security articles;
3. SPI-ANNOUNCE for official news about Security Profile Inspector
 (SPI) software updates, new features, distribution and
 availability;
4. SPI-NOTES, for discussion of problems and solutions regarding the
 use of SPI products.

Our mailing lists are managed by a public domain software package
called Majordomo, which ignores E-mail header subject lines. To
subscribe (add yourself) to one of our mailing lists, send the
following request as the E-mail message body, substituting
ciac-bulletin, ciac-notes, spi-announce OR spi-notes for list-name:

E-mail to ciac-listproc@llnl.gov or majordomo@tholia.llnl.gov:
 subscribe list-name
 e.g., subscribe ciac-notes

You will receive an acknowledgment email immediately with a confirmation
that you will need to mail back to the addresses above, as per the
instructions in the email. This is a partial protection to make sure
you are really the one who asked to be signed up for the list in question.

If you include the word 'help' in the body of an email to the above
address,
it will also send back an information file on how to subscribe/unsubscribe,
get past issues of CIAC bulletins via email, etc.

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

H-86: ld.so Vulnerability
H-87: HP-UX rlogin Vulnerability
H-88: SGI IRIX talkd Vulnerability
H-89: SunSO talkd Buffer Overrun Vulnerability
H-90: SunOS, Solaris NIS+ Vulnerability
H-91: HP-UX Large UID's and GID's Vulnerability
H-92: HP-UX X11/Motif Lib & Novell Netware Vulerabilities
H-93: SGI IRIX ordist Buffer Overrun Vulnerability
H-94: SunOS Vulnerability in ps
H-95: SunOS Vulnerability in x-lock


-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition

iQCVAwUBM/SEh7nzJzdsy3QZAQGg0AP+Nq1twg0ExWg/s0FuJ30Q3aA5f1rZ6H0/
hkWkIh6WMOlbkLhGstboRKpr+nn3Lm06mNlbKCGDrEEpL3gxWSldNRTapXHW2bJM
TlajsNj7idUhAtFZPtUQIJE1GzZpUEsoZG91k8oU4FgWO+FNNjEJxJW3WtGwGkW/
a3VHqySP93c=
=GZ5b
-----END PGP SIGNATURE-----


----- Forwarded Message Ends Here -----
 -------------------------------------------------
 ---------------------------------------------------
| RezPhreak Server Administrator |
|___________________________________________________|
|IRC Clients: minn.starchat.net |
|IRC via the WWW: http://irc.minn.net:8080 |
|Homepage: http://www1.minn.net/~sathia |
 ---------------------------------------------------
 -------------------------------------------------


OK. Here's the arithmetic.

1. All lower case 7 char password space took L0phtcrack 26 hours to
search.
2. With 107 possible characters, the password space will be (107/26)^7
times bigger.
3. (107/26)^7 = 19992.77175744
4. 19992.77175744 * 26 / 24 / 365 = 59 years.
5. On average, that's 29.5 years.
6. With a 14 character password, you have to crack each 7 character half
to get the whole password.
7. That's 59 years.

So, I do know better.


> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Tuesday, August 19, 1997 8:33 AM
> To: Paul Leach
> Cc: ntsecurity
> Subject: RE: [NTSEC] Remote management of local administrator
> accounts...
> 
> Oh, come on!
> 
> You of all people should know better than that. Each of the 
> two halves of the 14 characters are encrypted seperatly.
> You only have to crack 7 characters, even if the password is
> 14 characters long. Or has something been released from
> MS that removes the LM hash from the SAM entirely, that
> I'm not aware of?
> 
> Ryan
> 
> ---------- Previous Message ----------
> To: ntsecurity, Ryan.Russell
> cc: 
> From: paulle@microsoft.com (Paul Leach) @ smtp
> Date: 08/19/97 09:08:18 AM
> Subject: RE: [NTSEC] Remote management of local administrator
> accounts...
> 
> You can use NetUserChangePassword to change the admin account password
> on a local system.
> 
> If you change it to a completely random 14 character value, using all
> 107 possible characters (see http://www.ntadvice.com/samfaq.htm) then
> it
> will take a sinngle PPRO 200 mhz an average of 58 years to crack the
> password (based on the claim in the L0phtcrack 1.5 readme that it
> takes
> 26 hours to search the entire keyspace for 7 lower case characters.)
> 
> However, it's probably better to just use NetUserSetInfo, info level
> 1,
> to disable the account. (I'm assuming that the local Administrators
> group akready has (e.g.) Domain\Administrators as a member.)
> 


On Tue, 19 Aug 1997, Burger, Fa. I&S wrote:

> Help !
> 
> Is there someone who knows something about this fact:
> 
> If I use the Win32 function "GetSecurityDescriptorDacl" I can get the
> information "is a DACL present". What does it mean if this flag is not
> set. Is there no security available, is implicitly set "no aceess", or
> will this object get an inheritance, but from where or from who?
> 

As far as file object is concerned, "no DACL present" means "no access
control", in another word anyone can have full access of the file. One
example is a file on a FAT file system.

> Christian Buerger
> christian.buerger@istech.de
> 
> 

Cheers,
 Ko

> > Date: Mon, 18 Aug 97 18:07:50 EST
> > From: gamefact@hotmail.com
> > To: gamefact@hotmail.com
> > Subject: [NTSEC] Copy Games For Sale
>
> I suggest that everyone in this list send a complaint to
> abuse@hotmail.com.

I wouldn't do that myself. You see the message was NOTHING TO DO WITH
HOTMAIL except that the poster forged a Hotmail address.

It actually originated from ip-54-69.dialup.hkstar.com [202.82.54.69].

My advice would be to complain to the technical contact for hkstar.com
namely Rimen Wong , being sure to include the FULL
headers from the messages received.

Best wishes,
Matthew
Send this to "proxybug@microsoft.com". It'll get right to the dev team.

It's always a good idea to look for the "bug report" email address on
all beta software (at least from MS).

> ----------
> From: jrobbins@scitor.com[SMTP:jrobbins@scitor.com]
> Reply To: jrobbins@scitor.com
> Sent: Tuesday, August 19, 1997 11:32 AM
> To: ntsecurity@iss.net; Itai Dor-on
> Subject: Re: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
> 
> Hello,
> 
> I have been testing MS Proxy Server (version 2.0 beta) for the
> last 
> couple of weeks. I'm trying to use the "reverse proxy" and
> "reverse 
> hosting" features to allow mobile and home users to access the
> company 
> intranet. The initial test configuration was as follows:
> 
> 1) The Intranet Server is running NT 4.0 Service Pack 3 and IIS
> 3.0. 
> IIS was set up to use NT Challenge/Response only. If you are a
> member 
> of the company domain users, you can access the intranet server.
> 
> 2) The Proxy Server is 2.0 beta on NT 4.0 Service Pack 3 and IIS
> 3.0. 
> IIS was set up to use NT Challenge/Response only. Since proxy
> server 
> runs as a sub-service to IIS, it uses the security features of
> IIS. 
> The Proxy is setup as:
> 
> Permissions - enable access control for company domain users.
> Caching - enabled
> Publishing - Enable Web Publishing and directed to Intranet
> Server.
> 
> 3) The clients were running Win95 and using MS Internet Explorer
> 3.02. 
> IE was configured to use the Proxy Server for only HTTP
> connections. 
> The primary logon was MS Client for Networks, and you were
> requested 
> to logon to the company domain.
> 
> We were using a service provided by Sprint called Dial IP. The 
> service provides local phone numbers throughout the US to access
> their 
> network. The Sprint network is strictly TCP/IP with no naming
> service. 
> You map a Sprint IP Address to your proxy server IP address.
> 
> The test was as follows:
> 
> Attempt #1: Logged on to Sprint Network. Receive error message
> that a 
> domain controller can't be found. Whoops! Since our domain
> controller 
> is on our network, not Sprints, we can't use MS Client for
> Networks to 
> log on to the Sprint Network.
> 
> Attempt #2: Logged on using Windows Logon. No error message. We
> are 
> asked to authenticate at the Proxy Server. Try entering
> DOMAIN\UserID 
> and password. Seem to be authenticated. Tried accessing the
> intranet 
> server and received the Proxy Error Message : Access is denied.
> (I 
> learned to hate this message.) It seemed like the authentication
> 
> between the Proxy Server and Intranet Server wasn't working.
> 
> After several other attempts (3,4,5,6,?), I finally broke down
> and 
> called Microsoft. The first tech support person suggested going
> back 
> to version 1.0. I didn't have the heart to tell him that reverse
> 
> proxying wasn't supported in the earlier version, and that if he
> had 
> read his own wonderful documentation, he would have known the 
> difference. So, I called again and asked for a different tech
> support 
> person. After explaining my set up, he informed me that Windows
> NT 
> Challenge/Response doesn't work in IE 3.02 and still doesn't in
> 4.0. 
> Ergggggggg!!!!!!!!! He suggested trying Basic Authentication or 
> Anonymous.
> 
> Using Basic Authentication worked, but users on our internal
> network 
> would be required to log onto the intranet server. Currently,
> once 
> they are authenticated on the company domain, they don't have to
> log 
> onto the intranet server.
> 
> Lastly, from reading the MS Proxy Server 2.0 documentation, the
> Proxy 
> Server should only direct external HTTP requests to one server. 
> However, we have a second server using anonymous security which I
> was 
> able to access. Why was I able to get to the second server? Did I
> have 
> proxy configured incorrectly or did I not understand the
> documentation 
> correctly?
> 
> Has anyone been able to get NT Authentication working using MS
> Proxy 
> Server 2.0? I don't know whether to believe MS or not. There was
> no 
> reference to the problem in their KB (Surprise!). Oh by the way,
> I was 
> able to use RAS and authenticate using NT Challenge/Response, but
> with 
> no Proxy Server. Could the problem be with the Proxy Server? Any 
> feedback would be appreciated.
> 
> Thanks in advance,
> 
> John Robbins
> 
> 
> ______________________________ Reply Separator
> _________________________________
> Subject: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
> Author: Itai Dor-on at Internet
> Date: 8/19/97 10:11 AM
> 
> 
> Hi.
> 
> I apologize to all the wonderful people taking the effort
> to reply to my email message "Microsoft Proxy server security issues?"
> 
> I forgot to mention that I was referring to Microsoft Proxy Server 
> Version 2.0 (Beta) which is supposed to have firewall capabilities. 
> (Dynamic Packet Filter, Reverse Hosting & Etc.)
> 
> 
> The majority of comments referred to Proxy server version 1.0 which 
> has no firewall capabilities, therefore they are irrelevant to my 
> statements.
> 
> If anybody would like to re-comment on the matter I am including in
> this 
> email the original modified message.
> 
> Sincerely,
> Itai Dor-on
> 
> 
> "Dear Friends.
> 
> There are two major types of firewalls deployed as Internet gateways
> at 
> present:"Filtering Gateways" and "Application Gateways". Both firewall
> 
> designs aim to implement and enforce network security.
> 
> As I understand "Filtering Gateways" essentially make routing
> decisions 
> based on information contained at the packet level. If a packet
> content 
> meets the security policy criteria (Port, Ip, Dest.) it is forwarded,
> or 
> routed to the other side of the gateway. Otherwise it is blocked out.
> 
> "Application Gateways", unlike "Filtering Gateways", operate at the 
> connection rather than packet level (user name, protocol specific 
> operation: Get, Put)
> 
> "Application Gateways" are known to be more secure then "Filtering 
> Gateways" because they require the firewall provider to understand the
> 
> security implications of supporting an application. They provide
> proxies 
> for each service running behind the firewall.
> 
> A good "Firewall Application Gateway" will combine "Filtering
> Gateways" 
> features AND provide various proxies for services, running behind the 
> proxy server, that will examine each packet internal 
> content structure prior sending the packet to the specific service
> (e.g. 
> email message packet structure). 
> 
> "Microsoft Proxy Server 2.0 (Beta) was primarily designed to manage 
> outbound
> connections and provide performance enhancements for clients on an 
> internal network accessing the Internet."
> 
> This Design concept makes it a good "Application Gateway".
> 
> In my opinion The MAIN Job of a firewall is to address the 
> security issues of inbound connections coming from the Internet. 
> 
> At this point Microsoft Proxy Server 2.0 (Beta)uses a mechanism called
> 
> Dynamic
> packet filtering a method that resembles "Filtering Gateways"
> 
> Unfortunately I have found NO information on how Proxy proxy server
> 2.0 
> (Beta)
> deals with packet (What proxy services they provide for specific
> network 
> services) coming from the Internet. I will try explaining my point 
> using an example.
> 
> Suppose I have a network with two servers, one is a Microsoft Proxy 
> Server connected to the Internet the other is a Microsoft Exchange 
> Server
> sitting behind the proxy server. The exchange server is "server
> proxied" 
> to 
> the proxy server.
> 
> Now using dynamic packet filter option on the proxy server, if I try
> to 
> initiate a session with the exchange server using a host on the
> internet 
> (untrusted network)for the propose of checking my mailbox the proxy 
> server 
> will open for me a connection for the specific session. 
> 
> It provides 'direct' connectivity between Me (Untrusted) and the mail 
> system 
> (trusted). I know that the proxy server forwards the packets to the 
> exchange 
> server not opening a real direct connection but before it sends the 
> packets
> 
> DOES IT HAVE ANY CHECKING MECHANISIM OF THE INTERNAL INTEGRATIY 
> AND THE STRUCTRE OF THE SMTP PACKET?
> 
> AS I SEE IT (UNTIL I GET FURTHER INSIGHT ON THE MATTER) MICROSOFT
> PROXY 
> SERVER IS REGULER PACKET FILLTERING GATEWAY, THAT IS EQUIVELENT TO THE
> 
> "PORT RULES" FETURE IN THE TCPI/IP ADVANCED SETTINGS, WHEN IT COMES 
> OUT OF THE BOX NAKED.(REGRADING INBOUND CONNECTIONS FROM THE
> INTERNET).
> 
> Microsoft Proxy Server 2.0 (Beta) functionality can be extended using 
> ISAPI (e.g.
> packet Virus checking etc.)
> 
> BUT WHAT DO WE GET "RIGHT OUT OF THE BOX"? 
> 
> I posted this message at a couple of proxy server newsgroups on msnews
> 
> server but didn't get any response.
> 
> I decided to post the message on ntsecurity@iss.net because the matter
> 
> affects anyone who consults about or deal with NT security.
> 
> I would appreciate any comment on the matter presented. 
> 
> Yours Truly,
> 
> Itai Dor-on"
> 
I beg to differ.

First off, assume you are correct about the keyspace.

If you do a seach of the 107^7 keyspace,and that takes 29.5 
years (on average), you've found both halves,
not one. There is no reason to double that number.
Yes, L0phtcrack searches for both halves simultaneously,
and is included in the original 26 hour number.
Granted, the average will be higher since you need go until
you find two hashes instead of just one. So, what's a good
ratio? 3/4? Shall we say 44.25 years?

Still, that's not much of an improvement. Let's try this:

What's the keyspace for a Lanman password? It's 
all upper case, isn't it? And, depending on which spec
you look at, aren't only letters, numbers, and a few
special characters allowed? Something like 60 possible
characters?

3. (60/26)^7 = 348.524
4. 348.524 * 26 / 24 / 365 = 1 year.
5. On average, that's .5 years.

Shall we call it 9 months for the 2 halves?

How about this... On your NT box, create an account
with a 14-character password, using an appropriate
range of input characters. Run pwdump, and send me the line
for the account you've created. I'll tell you how long it takes
to crack.

 Ryan


---------- Previous Message ----------
To: paulle, Ryan.Russell
cc: ntsecurity
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 08/19/97 11:42:20 AM
Subject: RE: [NTSEC] Remote management of local administrator accounts...

OK. Here's the arithmetic.

1. All lower case 7 char password space took L0phtcrack 26 hours to
search.
2. With 107 possible characters, the password space will be (107/26)^7
times bigger.
3. (107/26)^7 = 19992.77175744
4. 19992.77175744 * 26 / 24 / 365 = 59 years.
5. On average, that's 29.5 years.
6. With a 14 character password, you have to crack each 7 character half
to get the whole password.
7. That's 59 years.

So, I do know better.


> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Tuesday, August 19, 1997 8:33 AM
> To: Paul Leach
> Cc: ntsecurity
> Subject: RE: [NTSEC] Remote management of local administrator
> accounts...
> 
> Oh, come on!
> 
> You of all people should know better than that. Each of the 
> two halves of the 14 characters are encrypted seperatly.
> You only have to crack 7 characters, even if the password is
> 14 characters long. Or has something been released from
> MS that removes the LM hash from the SAM entirely, that
> I'm not aware of?
> 
> Ryan
> 
> ---------- Previous Message ----------
> To: ntsecurity, Ryan.Russell
> cc: 
> From: paulle@microsoft.com (Paul Leach) @ smtp
> Date: 08/19/97 09:08:18 AM
> Subject: RE: [NTSEC] Remote management of local administrator
> accounts...
> 
> You can use NetUserChangePassword to change the admin account password
> on a local system.
> 
> If you change it to a completely random 14 character value, using all
> 107 possible characters (see http://www.ntadvice.com/samfaq.htm) then
> it
> will take a sinngle PPRO 200 mhz an average of 58 years to crack the
> password (based on the claim in the L0phtcrack 1.5 readme that it
> takes
> 26 hours to search the entire keyspace for 7 lower case characters.)
> 
> However, it's probably better to just use NetUserSetInfo, info level
> 1,
> to disable the account. (I'm assuming that the local Administrators
> group akready has (e.g.) Domain\Administrators as a member.)
> 



You could try using the share level permissions. If the user does not have full control at the share level they will not be able to exercise full control i.e. change access permissions, at the ntfs level. This may mean you will need to rethink your share strategy.

Dennis

-----Original Message-----
From: David LeBlanc [SMTP:dleblanc@iss.net]
Sent: Monday, August 18, 1997 3:50 PM
To: BRADLEY, GREGORY S
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] NTFS file security questions

At 11:14 8/18/97 -0500, you wrote:

>Is there a way we can prevent users from changing permissions on
>files/directories that they create on remote NT servers?

AFAIK, there isn't any way to stop this. The problem is that creator-owner
has an implicit right to set permissions. IMHO, this should be an
assignable user right, since only admins truly need it.

What _may_ work, but I have not tried, is to set an explicit access denied
ACL that prohibits permission changing. I know that NT checks access
denied ACLs before it checks for allowed. Whether or not this will work
depends on whether the implicit right to set permissions is checked before
or after the rest of the ACL.

If that doesn't work, I'd recommend writing a script to take care of it.
Otherwise, the user could have 10GB of GIF files, and you wouldn't know it.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Please read the FAQ (see http://www.ntadvice.com/samfaq.htm) . The
actual number of combinations for LANMAN passwords is 107 per character.
That's LANMAN, not NT -- for NT its upper and lower case, and so 133
possible combinations per character. And those are the facts, regardless
of what LMI says some specs say -- if L0phtcrack only tests the "spec'd"
legal chars, then an easy defense is to pick one of the "unspec'd" ones,
right?



> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Tuesday, August 19, 1997 10:15 AM
> To: Paul Leach
> Cc: ntsecurity
> Subject: RE: [NTSEC] Remote management of local administrator
> accounts...
> 
> I beg to differ.
> 
> First off, assume you are correct about the keyspace.
> 
> If you do a seach of the 107^7 keyspace,and that takes 29.5 
> years (on average), you've found both halves,
> not one. There is no reason to double that number.
> Yes, L0phtcrack searches for both halves simultaneously,
> and is included in the original 26 hour number.
> 
You're right. I forgot.

> Granted, the average will be higher since you need go until
> you find two hashes instead of just one. So, what's a good
> ratio? 3/4? Shall we say 44.25 years?
> 
Yes.

> Still, that's not much of an improvement. Let's try this:
> 
> What's the keyspace for a Lanman password? It's 
> all upper case, isn't it? And, depending on which spec
> you look at, aren't only letters, numbers, and a few
> special characters allowed? Something like 60 possible
> characters?
> 
It's 107, just like I said. Monocase alpha, numbers, all punctuation (33
chars, including space) and 38 chars with values above 128 that don't
get mapped to the above. That's 26 + 10 + 33 + 38 = 107. Read the FAQ.

> 3. (60/26)^7 = 348.524
> 4. 348.524 * 26 / 24 / 365 = 1 year.
> 5. On average, that's .5 years.
> 
> Shall we call it 9 months for the 2 halves?
> 
No. 44.25 years. Probably enough to stop a random employee who wants to
install games on his own workstation.

Paul


At 08:35 AM 8/18/97 -0700, jjones@farm-credit.com wrote:
>
>Greetings,
>
>We're deploying approximately five hundred NT 4.0 Workstations in the next
>month or so. The users of these workstations will have Domain User
>accounts only. My question: Is there a way to REMOTELY disable/enable the
>local Administrator accounts on these systems -- either by locking or
>changing the password on the account? We don't want the users to be able
>log on locally as administrators and have their way with the system.

Probably the easiest thing to do is to change the administrator's account
name, and create a fake one with event logging on and forwarded to the
domain. That would also defeat most programs that specifically target the
account 'administrator'. Use a camoflaugable name that sounds either like a
program, or another user. Not bulletproof, but logging would catch even
knowledgable hackers (try once, get logged).

Maybe the fake administrator account automatically shuts down the system, or
has some other annoyance factor. ;)

Bill Stout

Oh god, not the crypto crack time thing again....

Ever watch that show "I can guess that song in two notes."?

Rename administrator. Event log to the domain. Make fake admin account
that does annoying things.

When brute-forcing passwords, nine women can make a baby in one month.

Bill Stout
______________________________________________________________________
Look at my pen. Watch for flash. You will forget all about discussing 
theoretical time to brute force passwords. | 
 >*<
______________________________________________|______________________

>OK. Here's the arithmetic.
>
>1. All lower case 7 char password space took L0phtcrack 26 hours to
>search.
>2. With 107 possible characters, the password space will be (107/26)^7
>times bigger.
>3. (107/26)^7 = 19992.77175744
>4. 19992.77175744 * 26 / 24 / 365 = 59 years.
>5. On average, that's 29.5 years.
>6. With a 14 character password, you have to crack each 7 character half
>to get the whole password.
>7. That's 59 years.



>> You of all people should know better than that. Each of the 
>> two halves of the 14 characters are encrypted seperatly.
>> You only have to crack 7 characters, even if the password is
>> 14 characters long. Or has something been released from
>> MS that removes the LM hash from the SAM entirely, that
>> I'm not aware of?



>> If you change it to a completely random 14 character value, using all
>> 107 possible characters (see http://www.ntadvice.com/samfaq.htm) then
>> it
>> will take a sinngle PPRO 200 mhz an average of 58 years to crack the
>> password (based on the claim in the L0phtcrack 1.5 readme that it
>> takes
>> 26 hours to search the entire keyspace for 7 lower case characters.)

Matthew Richardson wrote:
> 
> > > Date: Mon, 18 Aug 97 18:07:50 EST
> > > From: gamefact@hotmail.com
> > > To: gamefact@hotmail.com
> > > Subject: [NTSEC] Copy Games For Sale
> >
> > I suggest that everyone in this list send a complaint to
> > abuse@hotmail.com.
> 
> I wouldn't do that myself. You see the message was NOTHING TO DO WITH
> HOTMAIL except that the poster forged a Hotmail address.
> 
> It actually originated from ip-54-69.dialup.hkstar.com [202.82.54.69].

I deleted the massage a while ago without bothering to look at the
headers, but I would assume that it was actually sent from this 
ip-54-69.dialup.hkstar.com to hotmail.com to iss.net to all of us.
Meaning that hotmail would have great deal to do with this problem,
whether or not this was a customer of theirs or they allowed or 
encouraged this activity, their server is still set up to permit
anyone to use it as a relay. Their mail server should only accept
connection from within their address to send mail outside of their 
domain, or from anywhere on the Internet to one of their customers.

Many ISP's don't configure their systems to block relays, allowing
people to eat up their copmuter resources spamming. Even if they
don't care, the people being spammed do.

Again, I did not actually look at the header so that I am not positive
if this is the case.

> 
> My advice would be to complain to the technical contact for hkstar.com
> namely Rimen Wong , being sure to include the FULL
> headers from the messages received.
> 
> Best wishes,
> Matthew

-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
On Tuesday, August 19, 1997 1:56 PM, Ng Gek Po [SMTP:gpng@mol.com.my]
wrote:
> I am facing this funny problem. I am the admin for the primary 
> domain controler. One of the main directory I set it with the 
> administrators have full control on it together with all the ...

Am I the only person receiving this message 30+ times per day??? Could
someone PLEASE stop this insanity?!

Steven Chanyi - Systems Administrator - Insurance Council of BC
Tel: 604-688-0321 x333 * Fax: 604-662-7767 * Cell: 604-644-8963
-------------------------------------------------
The world is filled with willing people; some willing to work,
the rest willing to let them. - Robert Frost

I had another Engineer ask me if I knew any good ways to audit a share
access and I said why dont you turn on auditing. He said the same
thing, it crawls when you do.

-jjs

>-----Original Message-----
>From: Matthew Patton [SMTP:patton@sysnet.net]
>Sent: Sunday, August 17, 1997 12:28 PM
>To: Bob Toth
>Cc: ntsecurity@iss.net
>Subject: RE: [NTSEC] Creating duplicate logs.
>
>bobt@pcdocs.com wrote:
>
>>Would duplicates really help? As the log is being changed by the native
>>application, it also changes the duplicate.
>>
>>Why not instead audit any access to the log files though NT auditing?
>
>I turned on auditing on the entire filesystem and tailored it to the
>specific directories but my poor machine thrashes like crazy. Generating
>hundreds of audit messages about object access. None of which had anything
>to do with the filesystem. Is there ANY way to separate Object auditing
>from filesystem auditing? It was impossible to do anything at this point
>so I was forced to turn auditing off. This is nuts for a system supposedly
>designed for the security concious.
>
>Windows95: noun. 32-bit extensions and a graphical shell for a 16-bit
> patch to an 8-bit operating system originally coded for a 4-bit
> microprocessor, written by a 2-bit company that can't stand 1 bit of
> competition.
>
>
On Tue, 19 Aug 1997 13:07:17 -0700, you wrote:

>Send this to "proxybug@microsoft.com". It'll get right to the dev team.
>
>It's always a good idea to look for the "bug report" email address on
>all beta software (at least from MS).
>
>> ----------
>> From: jrobbins@scitor.com[SMTP:jrobbins@scitor.com]
>> Reply To: jrobbins@scitor.com
>> Sent: Tuesday, August 19, 1997 11:32 AM
>> To: ntsecurity@iss.net; Itai Dor-on
>> Subject: Re: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
>> 
>> Hello,

This is off topic, but guys can we please use a lil bit of the old tag
and delete when replying to an email, there is nothing worse than a
huge reply with 2 or 3 lines of comment attached.

Ciao

Drew
where does microsoft find these yahoos?

anyway, challenge/response does work in ie3 & 4 (all versions), but what
i think your problem is:

challenge/response requires a PDC/BDC for the host machine to
communicate with. since your authentication from the outside happens in
proxy form, initial challenge/response fails (there is nobody available
to challenge), and the browser reverts to basic (clear-text)
authentication. that's why it works when basic authentication works.

-joav kohn
 sr. technical consultant - MCSE/MCP
 it/workgroup communications
 landis & staefa
"inside...we're all wet" - bjork

> -----Original Message-----
> From: jrobbins@scitor.com [SMTP:jrobbins@scitor.com]
> Sent: Tuesday, August 19, 1997 1:32 PM
> To: ntsecurity@iss.net; Itai Dor-on
> Subject: Re: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
> 
> Hello,
> 
> I have been testing MS Proxy Server (version 2.0 beta) for the
> last 
> couple of weeks. I'm trying to use the "reverse proxy" and
> "reverse 
> hosting" features to allow mobile and home users to access the
> company 
> intranet. The initial test configuration was as follows:
> 
> 1) The Intranet Server is running NT 4.0 Service Pack 3 and IIS
> 3.0. 
> IIS was set up to use NT Challenge/Response only. If you are a
> member 
> of the company domain users, you can access the intranet server.
> 
> 2) The Proxy Server is 2.0 beta on NT 4.0 Service Pack 3 and IIS
> 3.0. 
> IIS was set up to use NT Challenge/Response only. Since proxy
> server 
> runs as a sub-service to IIS, it uses the security features of
> IIS. 
> The Proxy is setup as:
> 
> Permissions - enable access control for company domain users.
> Caching - enabled
> Publishing - Enable Web Publishing and directed to Intranet
> Server.
> 
> 3) The clients were running Win95 and using MS Internet Explorer
> 3.02. 
> IE was configured to use the Proxy Server for only HTTP
> connections. 
> The primary logon was MS Client for Networks, and you were
> requested 
> to logon to the company domain.
> 
> We were using a service provided by Sprint called Dial IP. The 
> service provides local phone numbers throughout the US to access
> their 
> network. The Sprint network is strictly TCP/IP with no naming
> service. 
> You map a Sprint IP Address to your proxy server IP address.
> 
> The test was as follows:
> 
> Attempt #1: Logged on to Sprint Network. Receive error message
> that a 
> domain controller can't be found. Whoops! Since our domain
> controller 
> is on our network, not Sprints, we can't use MS Client for
> Networks to 
> log on to the Sprint Network.
> 
> Attempt #2: Logged on using Windows Logon. No error message. We
> are 
> asked to authenticate at the Proxy Server. Try entering
> DOMAIN\UserID 
> and password. Seem to be authenticated. Tried accessing the
> intranet 
> server and received the Proxy Error Message : Access is denied.
> (I 
> learned to hate this message.) It seemed like the authentication
> 
> between the Proxy Server and Intranet Server wasn't working.
> 
> After several other attempts (3,4,5,6,?), I finally broke down
> and 
> called Microsoft. The first tech support person suggested going
> back 
> to version 1.0. I didn't have the heart to tell him that reverse
> 
> proxying wasn't supported in the earlier version, and that if he
> had 
> read his own wonderful documentation, he would have known the 
> difference. So, I called again and asked for a different tech
> support 
> person. After explaining my set up, he informed me that Windows
> NT 
> Challenge/Response doesn't work in IE 3.02 and still doesn't in
> 4.0. 
> Ergggggggg!!!!!!!!! He suggested trying Basic Authentication or 
> Anonymous.
> 
> Using Basic Authentication worked, but users on our internal
> network 
> would be required to log onto the intranet server. Currently,
> once 
> they are authenticated on the company domain, they don't have to
> log 
> onto the intranet server.
> 
> Lastly, from reading the MS Proxy Server 2.0 documentation, the
> Proxy 
> Server should only direct external HTTP requests to one server. 
> However, we have a second server using anonymous security which I
> was 
> able to access. Why was I able to get to the second server? Did I
> have 
> proxy configured incorrectly or did I not understand the
> documentation 
> correctly?
> 
> Has anyone been able to get NT Authentication working using MS
> Proxy 
> Server 2.0? I don't know whether to believe MS or not. There was
> no 
> reference to the problem in their KB (Surprise!). Oh by the way,
> I was 
> able to use RAS and authenticate using NT Challenge/Response, but
> with 
> no Proxy Server. Could the problem be with the Proxy Server? Any 
> feedback would be appreciated.
> 
> Thanks in advance,
> 
> John Robbins
>

Please help, any ideas are greatly appreciated.

While at my BDC, I issue the command to sync with the PDC, but this fails.  The PDC's Event Viewer reports that "the session setup from the computer ALF failed to authenticate.  The name of the account referenced in the security database is ALF$.  The following error occurred:  Access it denied".

What is this account they're referring to?

Thanks mucho!
Paul Iglesia
Information Systems Manager
Adroit Systems Inc.
Alexandria, VA 22314

> I deleted the massage a while ago without bothering to look at the
> headers, but I would assume that it was actually sent from this
> ip-54-69.dialup.hkstar.com to hotmail.com to iss.net to all of us.

You would be wrong. The relay used was mongkok.hk.super.net
[202.14.67.46].

> Meaning that hotmail would have great deal to do with this problem,
> whether or not this was a customer of theirs or they allowed or
> encouraged this activity, their server is still set up to permit
> anyone to use it as a relay.

Sorry, wrong again.

> Their mail server should only accept
> connection from within their address to send mail outside of their
> domain, or from anywhere on the Internet to one of their customers.

I refer the learned poster to the following intercourse with Hotmail's
SMTP server:-

220 m1.hotmail.com Server SMTP ready at Tue, 19 Aug 1997 15:14:07 +0100
helo matthew
250 m1.hotmail.com Hello matthew
mail from:test1@itconsult.co.uk
250 Ok
rcpt to:test2@user.itconsult.co.uk
551 'hotmail.com' is not a relay host.

which shows conclusively that Hotmail do not relay.

> Again, I did not actually look at the header so that I am not positive
> if this is the case.

Indeed, but you could have checked whether Hotmail does relay before
posting.

Best wishes,
Matthew

ps: enough of this - back to the "proper" discussions for this list :-)




Apologies for my previous posting.

1. Can Windows NT have a 3-try lock out?
 - When a particular user tries 3 times, can NT lock him out?

2. Can Windows NT automatically know if the connection to a HOST ( as in
IBM Mainframe) was broken? and inform a particular application running
over it?

Thanks,

Eugene A. Tayam


quit ntsecurity

Sorry, I meant to forward this to the list as well.

If I'm going to be vocal about calling someone wrong, 
I may as well be as vocal when I am proven wrong.

 Ryan

---------- Forwarded Message ----------


To: paulle
cc: 
From: Ryan Russell/SYBASE
Date: 08/19/97 04:40:08 PM
Subject: RE: [NTSEC] Remote management of local administrator accounts...


Perhaps I stand corrected. I shall try some of the characters listed and
satisfy myself that it is as the FAQ says.

Does that mean you're not going to cough up some hash
values for me to play with?

 Ryan

---------- Previous Message ----------
To: Ryan.Russell
cc: ntsecurity
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 08/19/97 01:25:12 PM
Subject: RE: [NTSEC] Remote management of local administrator accounts...

Please read the FAQ (see http://www.ntadvice.com/samfaq.htm) . The
actual number of combinations for LANMAN passwords is 107 per character.
That's LANMAN, not NT -- for NT its upper and lower case, and so 133
possible combinations per character. And those are the facts, regardless
of what LMI says some specs say -- if L0phtcrack only tests the "spec'd"
legal chars, then an easy defense is to pick one of the "unspec'd" ones,
right?



 Joav,
 
 Thanks for the reply. I forgot to mention that the Proxy Server and 
 the Intranet Server are in the company domain which has a PDC. I have 
 seen suggestions in another newsgroup to put the Proxy Server on a 
 BDC. However, since the Proxy Server is already in the company 
 domain, I didn't think it would work. But, maybe it is worth a try.
 
 Thanks,
 John


______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
Author: "Kohn; Joav" at Internet
Date: 8/19/97 4:07 PM


where does microsoft find these yahoos?
 
anyway, challenge/response does work in ie3 & 4 (all versions), but what 
i think your problem is:
 
challenge/response requires a PDC/BDC for the host machine to 
communicate with. since your authentication from the outside happens in 
proxy form, initial challenge/response fails (there is nobody available 
to challenge), and the browser reverts to basic (clear-text) 
authentication. that's why it works when basic authentication works.
 
-joav kohn
 sr. technical consultant - MCSE/MCP
 it/workgroup communications
 landis & staefa
"inside...we're all wet" - bjork
 
> -----Original Message-----
> From: jrobbins@scitor.com [SMTP:jrobbins@scitor.com] 
> Sent: Tuesday, August 19, 1997 1:32 PM
> To: ntsecurity@iss.net; Itai Dor-on
> Subject: Re: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!! 
> 
> Hello,
> 
> I have been testing MS Proxy Server (version 2.0 beta) for the 
> last 
> couple of weeks. I'm trying to use the "reverse proxy" and 
> "reverse 
> hosting" features to allow mobile and home users to access the 
> company 
> intranet. The initial test configuration was as follows: 
> 
> 1) The Intranet Server is running NT 4.0 Service Pack 3 and IIS 
> 3.0. 
> IIS was set up to use NT Challenge/Response only. If you are a 
> member 
> of the company domain users, you can access the intranet server. 
> 
> 2) The Proxy Server is 2.0 beta on NT 4.0 Service Pack 3 and IIS 
> 3.0. 
> IIS was set up to use NT Challenge/Response only. Since proxy 
> server 
> runs as a sub-service to IIS, it uses the security features of 
> IIS. 
> The Proxy is setup as:
> 
> Permissions - enable access control for company domain users. 
> Caching - enabled
> Publishing - Enable Web Publishing and directed to Intranet 
> Server.
> 
> 3) The clients were running Win95 and using MS Internet Explorer 
> 3.02. 
> IE was configured to use the Proxy Server for only HTTP 
> connections. 
> The primary logon was MS Client for Networks, and you were 
> requested 
> to logon to the company domain. 
> 
> We were using a service provided by Sprint called Dial IP. The 
> service provides local phone numbers throughout the US to access 
> their 
> network. The Sprint network is strictly TCP/IP with no naming 
> service. 
> You map a Sprint IP Address to your proxy server IP address. 
> 
> The test was as follows:
> 
> Attempt #1: Logged on to Sprint Network. Receive error message 
> that a 
> domain controller can't be found. Whoops! Since our domain 
> controller 
> is on our network, not Sprints, we can't use MS Client for 
> Networks to 
> log on to the Sprint Network. 
> 
> Attempt #2: Logged on using Windows Logon. No error message. We 
> are 
> asked to authenticate at the Proxy Server. Try entering 
> DOMAIN\UserID 
> and password. Seem to be authenticated. Tried accessing the 
> intranet 
> server and received the Proxy Error Message : Access is denied. 
> (I 
> learned to hate this message.) It seemed like the authentication 
> 
> between the Proxy Server and Intranet Server wasn't working. 
> 
> After several other attempts (3,4,5,6,?), I finally broke down 
> and 
> called Microsoft. The first tech support person suggested going 
> back 
> to version 1.0. I didn't have the heart to tell him that reverse 
> 
> proxying wasn't supported in the earlier version, and that if he 
> had 
> read his own wonderful documentation, he would have known the 
> difference. So, I called again and asked for a different tech 
> support 
> person. After explaining my set up, he informed me that Windows 
> NT 
> Challenge/Response doesn't work in IE 3.02 and still doesn't in 
> 4.0. 
> Ergggggggg!!!!!!!!! He suggested trying Basic Authentication or 
> Anonymous.
> 
> Using Basic Authentication worked, but users on our internal 
> network 
> would be required to log onto the intranet server. Currently, 
> once 
> they are authenticated on the company domain, they don't have to 
> log 
> onto the intranet server.
> 
> Lastly, from reading the MS Proxy Server 2.0 documentation, the 
> Proxy 
> Server should only direct external HTTP requests to one server. 
> However, we have a second server using anonymous security which I 
> was 
> able to access. Why was I able to get to the second server? Did I 
> have 
> proxy configured incorrectly or did I not understand the 
> documentation 
> correctly?
> 
> Has anyone been able to get NT Authentication working using MS 
> Proxy 
> Server 2.0? I don't know whether to believe MS or not. There was 
> no 
> reference to the problem in their KB (Surprise!). Oh by the way, 
> I was 
> able to use RAS and authenticate using NT Challenge/Response, but 
> with 
> no Proxy Server. Could the problem be with the Proxy Server? Any 
> feedback would be appreciated.
> 
> Thanks in advance,
> 
> John Robbins
> 
I am trying to find a way to reject mail from Spammers who spoof an
email headers to appear as if the sender and the recipient are the same
address. Case in point: Spam arrives in my inbox (gomberg@synair.com)
addressed to "friend@bubba.com" from "friend@bubba.com". Presumably the
target's actual address is embedded in the bcc portion of the header.

Reviewing the last several hundred Spams to our domain, about 70% to
80% are circumventing my current filters using this method. It seems to
me that there surely must be a way to reject a message where SENDER =
RECIPIENT (or FROM = TO) AND ACTUAL ADDRESSEE is BCC'd (or equivalent).

My current system configuration is NT4.0 SP3, WITH MS Proxy 2, MS
Exchange 5.0, and MIMESweeper. MIMESweeper is nice in that it will
auto-block or auto-delete any given message based on comparing its
lexical contents against a word/phrase list, however its header parsing
and handling fails to act on the BCC portion of the header, and thus,
IMNSHO needs some work. Likewise Exchange seems to be missing the
necessary options to block based on header configuration.

Is there anyone out there who has tackled this problem successfully who
can offer a solution or point me to a (hopefully) inexpensive
application that does? It's pretty obvious that any one of us could
have avoided the last barrage of Spam directed to this mailing list with
a good tool.

Thanks in advance,

Jeff ( I really hate Spam ) Gomberg

a.k.a.: Jeff ( the Anti-Spam Man) Gomberg
Maker of "Spam Be Gone" topical ointments and creams.
Available from a pyramid marketer near you.


Speaking of PPTP, does anybody know if there is a one-time password
device/implementation for MS-PPTP? I don't think Security Dynamics is
even considering this... 

-Simon

John,

I can't speak from any experience with Proxy 2.0, but I am confused about 
why you couldn't get authorized by your PDC.

First IE3 & 4 do use Challenge/Response to try to log you on. This was 
identified as a method of obtaining userid and encrypted password 
information while browsing web sites.

Secondly, if your userid and password are the same on your Windows 95 
Client and NT Server, you should have been authorized by pass through 
verification.

I would suggest you are not being validated because you have disabled 
Client Microsoft for Networks. You can fix the Domain validation problem, 
by un-clicking "Log on to Windows NT Domain" in the logon validation box of 
Client for Microsoft Networks.

This should allow you to logon to Windows 95 without the validation of your 
Domain. When you access your Proxy Server it should send a Challenge to 
Windows 95. Windows 95 will send a Response (encrypted with the Challenge) 
back to the Proxy Server. If the userid and passwords match you will be 
validated.

If you still are having problems, try accessing the IIS without the Proxy 
Server. If IIS validates you with C/R I would suspect the Proxy Server.


Rick Greep, MCSE
Darca, Inc
Rgreep@darca.com
800 383-1562 #1473
http://www.darca.com


-----Original Message-----
From: John Robbins [SMTP:jrobbins@scitor.com]
Sent: Tuesday, August 19, 1997 6:21 PM
To: Kohn; Joav
Cc: ntsecurity@iss.net
Subject: Re[2]: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!

 Joav,

 Thanks for the reply. I forgot to mention that the Proxy Server and
 the Intranet Server are in the company domain which has a PDC. I have 
 seen suggestions in another newsgroup to put the Proxy Server on a
 BDC. However, since the Proxy Server is already in the company
 domain, I didn't think it would work. But, maybe it is worth a try.

 Thanks,
 John


______________________________ Reply Separator 
_________________________________
Subject: RE: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
Author: "Kohn; Joav" at Internet
Date: 8/19/97 4:07 PM


where does microsoft find these yahoos?

anyway, challenge/response does work in ie3 & 4 (all versions), but what
i think your problem is:

challenge/response requires a PDC/BDC for the host machine to
communicate with. since your authentication from the outside happens in
proxy form, initial challenge/response fails (there is nobody available
to challenge), and the browser reverts to basic (clear-text)
authentication. that's why it works when basic authentication works.

-joav kohn
 sr. technical consultant - MCSE/MCP
 it/workgroup communications
 landis & staefa
"inside...we're all wet" - bjork

> -----Original Message-----
> From: jrobbins@scitor.com [SMTP:jrobbins@scitor.com]
> Sent: Tuesday, August 19, 1997 1:32 PM
> To: ntsecurity@iss.net; Itai Dor-on
> Subject: Re: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
>
> Hello,
>
> I have been testing MS Proxy Server (version 2.0 beta) for the
> last
> couple of weeks. I'm trying to use the "reverse proxy" and
> "reverse
> hosting" features to allow mobile and home users to access the
> company
> intranet. The initial test configuration was as follows:
>
> 1) The Intranet Server is running NT 4.0 Service Pack 3 and IIS
> 3.0.
> IIS was set up to use NT Challenge/Response only. If you are a
> member
> of the company domain users, you can access the intranet server.
>
> 2) The Proxy Server is 2.0 beta on NT 4.0 Service Pack 3 and IIS
> 3.0.
> IIS was set up to use NT Challenge/Response only. Since proxy
> server
> runs as a sub-service to IIS, it uses the security features of
> IIS.
> The Proxy is setup as:
>
> Permissions - enable access control for company domain users.
> Caching - enabled
> Publishing - Enable Web Publishing and directed to Intranet
> Server.
>
> 3) The clients were running Win95 and using MS Internet Explorer
> 3.02.
> IE was configured to use the Proxy Server for only HTTP
> connections.
> The primary logon was MS Client for Networks, and you were
> requested
> to logon to the company domain.
>
> We were using a service provided by Sprint called Dial IP. The
> service provides local phone numbers throughout the US to access
> their
> network. The Sprint network is strictly TCP/IP with no naming
> service.
> You map a Sprint IP Address to your proxy server IP address.
>
> The test was as follows:
>
> Attempt #1: Logged on to Sprint Network. Receive error message
> that a
> domain controller can't be found. Whoops! Since our domain
> controller
> is on our network, not Sprints, we can't use MS Client for
> Networks to
> log on to the Sprint Network.
>
> Attempt #2: Logged on using Windows Logon. No error message. We
> are
> asked to authenticate at the Proxy Server. Try entering
> DOMAIN\UserID
> and password. Seem to be authenticated. Tried accessing the
> intranet
> server and received the Proxy Error Message : Access is denied.
> (I
> learned to hate this message.) It seemed like the authentication
>
> between the Proxy Server and Intranet Server wasn't working.
>
> After several other attempts (3,4,5,6,?), I finally broke down
> and
> called Microsoft. The first tech support person suggested going
> back
> to version 1.0. I didn't have the heart to tell him that reverse
>
> proxying wasn't supported in the earlier version, and that if he
> had
> read his own wonderful documentation, he would have known the
> difference. So, I called again and asked for a different tech
> support
> person. After explaining my set up, he informed me that Windows
> NT
> Challenge/Response doesn't work in IE 3.02 and still doesn't in
> 4.0.
> Ergggggggg!!!!!!!!! He suggested trying Basic Authentication or
> Anonymous.
>
> Using Basic Authentication worked, but users on our internal
> network
> would be required to log onto the intranet server. Currently,
> once
> they are authenticated on the company domain, they don't have to
> log
> onto the intranet server.
>
> Lastly, from reading the MS Proxy Server 2.0 documentation, the
> Proxy
> Server should only direct external HTTP requests to one server.
> However, we have a second server using anonymous security which I
> was
> able to access. Why was I able to get to the second server? Did I
> have
> proxy configured incorrectly or did I not understand the
> documentation
> correctly?
>
> Has anyone been able to get NT Authentication working using MS
> Proxy
> Server 2.0? I don't know whether to believe MS or not. There was
> no
> reference to the problem in their KB (Surprise!). Oh by the way,
> I was
> able to use RAS and authenticate using NT Challenge/Response, but
> with
> no Proxy Server. Could the problem be with the Proxy Server? Any
> feedback would be appreciated.
>
> Thanks in advance,
>
> John Robbins
>

John,
I can't speak from any experience with Proxy 2.0, but I am interested in 
why you couldn't get authorized by your PDC.
First IE3 & 4 do use Challenge/Response to try to log you on. This was 
identified as a method of obtaining userid and encrypted password 
information while browsing web sites.
Secondly, if your userid and password are the same on your Windows 95 
Client and NT Server, you should have been authorized by pass through 
verification.
I would suggest you are not being validated because you have disabled 
Client Microsoft for Networks. You can fix the Domain validation problem, 
by un-clicking "Log on to Windows NT Domain" in the logon validation box of 
Client for Microsoft Networks.
This should allow you to logon to Windows 95 without the validation of your 
Domain. When you access your Proxy Server it should send a Challenge to 
Windows 95. Windows 95 will send a Response (encrypted with the Challenge) 
back to the Proxy Server. If the userid and passwords match you will be 
validated.
If you still are having problems, try accessing the IIS without the Proxy 
Server. If IIS validates you with C/R I would suspect the Proxy Server.

Rick Greep, MCSE
Darca, Inc
Rgreep@darca.com
800 383-1562 #1473
http://www.darca.com


-----Original Message-----
From: John Robbins [SMTP:jrobbins@scitor.com]
Sent: Tuesday, August 19, 1997 1:32 PM
To: ntsecurity@iss.net; Itai Dor-on
Subject: Re: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!

 Hello,

 I have been testing MS Proxy Server (version 2.0 beta) for the last
 couple of weeks. I'm trying to use the "reverse proxy" and "reverse
 hosting" features to allow mobile and home users to access the company 
 intranet. The initial test configuration was as follows:

 1) The Intranet Server is running NT 4.0 Service Pack 3 and IIS 3.0.
 IIS was set up to use NT Challenge/Response only. If you are a member
 of the company domain users, you can access the intranet server.

 2) The Proxy Server is 2.0 beta on NT 4.0 Service Pack 3 and IIS 3.0. 
 IIS was set up to use NT Challenge/Response only. Since proxy server
 runs as a sub-service to IIS, it uses the security features of IIS.
 The Proxy is setup as:

 Permissions - enable access control for company domain users.
 Caching - enabled
 Publishing - Enable Web Publishing and directed to Intranet Server.

 3) The clients were running Win95 and using MS Internet Explorer 3.02. 
 IE was configured to use the Proxy Server for only HTTP connections.
 The primary logon was MS Client for Networks, and you were requested
 to logon to the company domain.

 We were using a service provided by Sprint called Dial IP. The
 service provides local phone numbers throughout the US to access their 
 network. The Sprint network is strictly TCP/IP with no naming service. 
 You map a Sprint IP Address to your proxy server IP address.

 The test was as follows:

 Attempt #1: Logged on to Sprint Network. Receive error message that a
 domain controller can't be found. Whoops! Since our domain controller
 is on our network, not Sprints, we can't use MS Client for Networks to 
 log on to the Sprint Network.

 Attempt #2: Logged on using Windows Logon. No error message. We are
 asked to authenticate at the Proxy Server. Try entering DOMAIN\UserID
 and password. Seem to be authenticated. Tried accessing the intranet
 server and received the Proxy Error Message : Access is denied. (I
 learned to hate this message.) It seemed like the authentication
 between the Proxy Server and Intranet Server wasn't working.

 After several other attempts (3,4,5,6,?), I finally broke down and
 called Microsoft. The first tech support person suggested going back
 to version 1.0. I didn't have the heart to tell him that reverse
 proxying wasn't supported in the earlier version, and that if he had
 read his own wonderful documentation, he would have known the
 difference. So, I called again and asked for a different tech support
 person. After explaining my set up, he informed me that Windows NT
 Challenge/Response doesn't work in IE 3.02 and still doesn't in 4.0.
 Ergggggggg!!!!!!!!! He suggested trying Basic Authentication or
 Anonymous.

 Using Basic Authentication worked, but users on our internal network
 would be required to log onto the intranet server. Currently, once
 they are authenticated on the company domain, they don't have to log
 onto the intranet server.

 Lastly, from reading the MS Proxy Server 2.0 documentation, the Proxy
 Server should only direct external HTTP requests to one server.
 However, we have a second server using anonymous security which I was
 able to access. Why was I able to get to the second server? Did I have 
 proxy configured incorrectly or did I not understand the documentation 
 correctly?

 Has anyone been able to get NT Authentication working using MS Proxy
 Server 2.0? I don't know whether to believe MS or not. There was no
 reference to the problem in their KB (Surprise!). Oh by the way, I was 
 able to use RAS and authenticate using NT Challenge/Response, but with 
 no Proxy Server. Could the problem be with the Proxy Server? Any
 feedback would be appreciated.

 Thanks in advance,

 John Robbins


[Rick Greep] 
On Mon, 18 Aug 1997 10:25:18 -0700, you wrote:

>Besides attempting to control .tmp file access via ACLs, other concerns I
>have with .tmp files is that they occasionally contain information that may
>be 'sensitive' in an environment where 'bypass traverse checking' is on,
>such as locations and/or names. Also .tmp's may be exploited if some
>program used a '.tmp' file in leu of using the registry. Note: Exe's
>renamed to .tmp files can't be executed on my NT box...
try it from a shell.

>
>Also, someone asked me what a (215MB) ~pst2297.tmp file was doing in their
>computer (unable to read with notepad/wordpad/word) where the owner was
>administrator. I could not answer them.


-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
Answer to part 1:
 Yes Nt can do account lockouts. Look in User Manager for 
 Domains-Policies-Account.

As for part 2:
 If the application is prepared to handle the exception, it can
handle
 faults like this. Witness FTP and telnet. (Yes I know that
these
 are protocol examples) I depends on the communication scheme
 you use and the applications on each end. They have to be aware
 of the possibility of loosing a connection.

Michael Harmer
harmer@udri.udayton.edu

> -----Original Message-----
> From: Eugene A. Tayam [SMTP:eugeneatayam@unn.unisys.com]
> Sent: Tuesday, August 19, 1997 6:48 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] NT Logon Security!
> 
> 
> 
> 
> 
> Apologies for my previous posting.
> 
> 1. Can Windows NT have a 3-try lock out?
> - When a particular user tries 3 times, can NT lock him out?
> 
> 2. Can Windows NT automatically know if the connection to a HOST ( as
> in
> IBM Mainframe) was broken? and inform a particular application
> running
> over it?
> 
> Thanks,
> 
> Eugene A. Tayam
> 
Suffice it to say, a complaint has been sent to hotmail, and the people
who run hkstar.com<>hk.super.net.

The spam has stopped, somehow, so lets get back to business.

On Tue, 19 Aug 1997, Matthew Richardson wrote:

> > I deleted the massage a while ago without bothering to look at the
> > headers, but I would assume that it was actually sent from this
> > ip-54-69.dialup.hkstar.com to hotmail.com to iss.net to all of us.
> 
> You would be wrong. The relay used was mongkok.hk.super.net
> [202.14.67.46].
> 
> > Meaning that hotmail would have great deal to do with this problem,
> > whether or not this was a customer of theirs or they allowed or
> > encouraged this activity, their server is still set up to permit
> > anyone to use it as a relay.
> 
> Sorry, wrong again.
> 
> > Their mail server should only accept
> > connection from within their address to send mail outside of their
> > domain, or from anywhere on the Internet to one of their customers.
> 
> I refer the learned poster to the following intercourse with Hotmail's
> SMTP server:-
> 
> 220 m1.hotmail.com Server SMTP ready at Tue, 19 Aug 1997 15:14:07 +0100
> helo matthew
> 250 m1.hotmail.com Hello matthew
> mail from:test1@itconsult.co.uk
> 250 Ok
> rcpt to:test2@user.itconsult.co.uk
> 551 'hotmail.com' is not a relay host.
> 
> which shows conclusively that Hotmail do not relay.
> 
> > Again, I did not actually look at the header so that I am not positive
> > if this is the case.
> 
> Indeed, but you could have checked whether Hotmail does relay before
> posting.
> 
> Best wishes,
> Matthew
> 
> ps: enough of this - back to the "proper" discussions for this list :-)
> 

--
"If it fails, then we know we are making progress!"
-- John E. Jasen // DNRC Ambassador to Earth \\ jjasen1@umbc.edu --
-- My views are those of the DNRC only. Prepare to be domesticated --


 Hello,

is there a way using the "net" command for exemple, to restart a 
service running on another machine in the same domain?

TIA

Thomas Kernen
We are trying to implement the mandatory screen saver lockout feature in
our WinNT 3.51 environment. We currently use mandatory profiles for
users or lock them out of control panel to standardize their desktops.
I am taking a survey of anyone out there who utilizes the timed lockout
feature to gain support with our management to adopt it. For those who
may not know, this feature will lock the workstation after a
predetermined time period requiring the user to input their password to
return to their session. I would like to know if you utilize this
feature and, if you do, what length of time do you use. Please respond
directly to me because others in this group may not be interested.

Thank you for your help in this matter.

John

 Simon Yeo queried the Listocracy:

>Speaking of PPTP, does anybody know if there is a one-time password
>device/implementation for MS-PPTP? I don't think Security Dynamics is
>even considering this...

 Oh, I think the NT user community is important enough that SDTI
paused to "consider" PPTP;-) Jeeeze, how could they not?

 PPTP contained some awkward surprises for SDTI. NT has a
undocumented M'soft-proprietary call for External Authentication from
ACE/SecurID, but in the PPTP release, a "bug" -- a pointer referencing a
bad memory address -- unexpectedly blocked it. Microsoft has delivered
two hotfixs (rasrad.dll for the RAS call; then mprddm.dll) which, with a
simple Registry hack to force PAP, allows routine ACE/SecurID user
authentication over a Radius server. Even then, however, support for
important ACE admin services which require a second exchange with the
authentication server --"Next Tokencode" demands for resynch; "New PIN"
input, to allow a user to change his PIN -- remain broken under PPTP.

 (One hacker's ASAP fix for these Radius/PPTP/SecurID limitations:
hang a modem off the ACE/Server for direct dialin -- just to support
SecurID resynch or new PINs. Many sites, of course, have both dialin and
net authentication services to begin with.)

 Third-party options for welding PPTP and ACE/SecurID -- with or
without supplementary crypto for either an application or the session --
are already available, and others are expected soon. Support for the full
array of tunneling alternatives (PPTP, L2F, EAP, SOCKS, and L2PT) will
likely become common in muscular encrypting firewalls and Extranet-oriented
routers. User-based authentication (tokens) and machine-based encryption
are natural complements. ACE/SecurID (with maybe 70 percent of the
Fortune 1000 market for hand-held authenticators) is not likely to be
overlooked -- particuarly, with its ACE/Client already integrated into
shipping versions of almost all leading firewalls and comm servers.

 If your network can use Funks' Steelbelted RADIUS -- which can be
configured with two-way message support in the Dialer, part of Funk's
Radius Manager -- you can immediately ride PPTP with full support for the
ACE protocol and offer complete SecurID functionality for users.

 Alternatively -- in a category likely to expand quickly -- with
Radius and a crypto product like InfoExpress's VTCP/Secure, you can set it
up to force PAP, then use SDTI's Access Manager as the Radius Proxy. That
gives you a VPN and, within it, full ACE/SecurID user authentication.

 And EAP, as part of NT 5.0 hopefully available in Q1 '98, will
offer a clean two-way connection for ACE/SecurID.

 PPTP/SecurID is an interesting and cautionary tale.

 SDTI and Microsoft are deeply entwined, have been for quite a while
-- but 5.X has been the focus of their synergy (and probably where M'soft
tunneling will open up a snug fit for ACE.) As noted, M'soft wrote an
External Authentication call in NT RAS specifically for ACE/SecurID.
Recently, at the Black Hat hacker workshops in Vegas, NT Marketing Director
Carl Karanan was referring to ACE/SecurID as _the_ standard for strong
authentication for NT environments -- a recommended upgrade for
security-conscious corporate customers who have become distainful of NT's
ongoing crisis in password security.

 Strong (two-factor) user authentication -- something "known,"
something "held" -- with physical hand-held authenticators (HHAs) will
likely become important tools to help secure corporate NT networks (as we
wait for market forces to refine smartcard-supported PKI over the next 3-5
years.)

 I'm not without bias (I've been a consultant to SDTI for years) but
I suggest that, as HHAs become more important in the NT cosmos, the
ease-of-use factor which has let SecurIDs dominate the big-network strong
authentication market will again come into play. Already, half of the
ACE/SecurId system sales are for NT servers.

 SDTI's RSA crypto subsidiary has been a key Microsoft partner for
years -- one of the few M'soft brags of -- and RSA's public-key,
symmetric-key, and message-digest crypto and protocols (S/MIME, etc.) will
be interwoven throughout much of M'soft's future security enhancements, in
NT as elsewhere. OTP tokens are expected to morph into RSA-based PKC
smartcards, so SDTI's plans to evolve its ACE authentication server into a
crypto-key and certificate management system are doubtless NT-savvy and
M'soft-sensitive.

 For all that, however, SDTI is a friendly flea dancing with an
elephant -- and its experience with PPTP suggests it's hard to keep such a
Big Boy focused on those tiny crucial details of mutual interest. The
beast is always hungry, don't ya know?

 Suerte,
 _Vin



"Cryptography is like literacy in the Dark Ages. Infinitely potent, for
good and ill... yet basically an intellectual construct, an idea, which by
its nature will resist efforts to restrict it to bureaucrats and others who
deem only themselves worthy of such Privilege."
_ A thinking man's Creed for Crypto/ vbm.

 * Vin McLellan + The Privacy Guild + *
 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548


(I can't find a "proper" forum for this, so I'm using the two closest
fits):

Reading through the PFX Syntax and Protocol Standard, it seems to me
that there's a significant weakness here. Specifically, where a user's
private keys are being sent to a destination platform under the
encryption of a public key owned by the platform itself, then the
corresponding private key must be held on the platform. This private key
must be accessible to all users, so that PFX can decrypt their incoming
credentials. Granted, it need not (and had better not!) be obvious where
to find the key - and it may be obfuscated through whatever devious
means the developers can come up with. But at the end of the day, it's
obfuscation, not true encryption, and thus can be penetrated by an
attacker with enough determination and time on his hands. Note that the
private key may indeed be encrypted, but because the encryption key must
be embedded somewhere on the platform (or in the executable) it doesn't
count as true encryption - only obfuscation.

Does anyone think this is not a problem? And if so, can you explain why
you think it's not a problem?

-- 

Bill Buffam
Unisys, Malvern PA
bjb@trsvr.tr.unisys.com

 Rick,
 
 Thanks for the suggestions. I agree with you that NT 
 Challenge/Response works for IE. I tried changing my Client Microsoft 
 for Networks per your suggestion, but I didn't get challenged at the 
 proxy server.
 
 Next, I tried going directly to the IIS Server and it worked! I 
 checked this before, but I had forgotten. My Window user id and 
 password are the same as the domain, and therefore, I was passed 
 through to the homepage on the intranet server without being 
 challenged. Hmmm. looks like the Proxy Server is the problem.
 
 Thanks for everyone's help. I'm going to look at other options unless 
 I hear from Microsoft (right!).
 
 John


______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] PROXY SERVER QUESTION - APOLOGIES!!!
Author: Rick Greep at Internet
Date: 8/21/97 11:01 AM


John,
I can't speak from any experience with Proxy 2.0, but I am interested in 
why you couldn't get authorized by your PDC.
First IE3 & 4 do use Challenge/Response to try to log you on. This was 
identified as a method of obtaining userid and encrypted password 
information while browsing web sites.
Secondly, if your userid and password are the same on your Windows 95 
Client and NT Server, you should have been authorized by pass through 
verification.
I would suggest you are not being validated because you have disabled 
Client Microsoft for Networks. You can fix the Domain validation problem, 
by un-clicking "Log on to Windows NT Domain" in the logon validation box of 
Client for Microsoft Networks.
This should allow you to logon to Windows 95 without the validation of your 
Domain. When you access your Proxy Server it should send a Challenge to 
Windows 95. Windows 95 will send a Response (encrypted with the Challenge) 
back to the Proxy Server. If the userid and passwords match you will be 
validated.
If you still are having problems, try accessing the IIS without the Proxy 
Server. If IIS validates you with C/R I would suspect the Proxy Server.
 
Rick Greep, MCSE
Darca, Inc
Rgreep@darca.com
800 383-1562 #1473
http://www.darca.com
 
 
 
John Robbins 
Does anyone know of any _good_ software or software/hardware combo
that will let me "mirror" one server to another, so that in the event of
a 
disaster (natural or deliberately induced), the second server can take
over?

I'm sure I've seen ads for this...

If any vendors feel tempted to respond - please note I'm only after
solutions
available in the UK.

Thanks in advance!

---
The usual disclaimer:
These views are mine, not the company's. And no-one else can have them,
so there!

"No, we in IT don't have a sense of humour that we're aware of"
miss-quote, Mia

Amanda Appleton, network admin, hassled.
Ron Schreiner wrote:
> 
> If you hook up your NT box to a modem and/or a network, does this mean it is
> no longer C2 compliant - even if you meet ALL other C2 requirements and/or
> recommendations?
> -------------------------------------------------
> ---------------------------------------------------
> | RezPhreak Server Administrator |
> |___________________________________________________|
> |IRC Clients: minn.starchat.net |
> |IRC via the WWW: http://irc.minn.net:8080 |
> |Homepage: http://www1.minn.net/~sathia |
> ---------------------------------------------------
> -------------------------------------------------
The thing to remember about C2 evaluation is that it covers a given
hardware and software configuration. Any change from the evaluated
configuration makes the evaluation No More.
The other thing to remember is that the Rainbow Methodology is pointed
at base systems to give a (hopefully acceptable) level of assurance that
the foundation is sound. A secure starting point. That is all.
>From there you need to not be stupid and de-secure the start.

PHM
At 13:15 8/19/97 EDT, you wrote:

>How about this... On your NT box, create an account
>with a 14-character password, using an appropriate
>range of input characters. Run pwdump, and send me the line
>for the account you've created. I'll tell you how long it takes
>to crack.

I'm really fairly tired of this particular debate (tho it is relevant ) - 
could someone possibly run some experiments and see how long it _really_
takes?

It would be cool to try:

Varying password length from say 6-14 characters

all alpha
alpha + numeric
alpha + numeric + punctuation
alpha + numeric + punctuation + Alt characters

Let's quit arguing over whose math is right, etc - come up with a random
password generator, create say 4 users for each password length and
character set, run pwdump and L0pthCrack and tell us what happened.

IMHO, the objective is to make it so that even if we're subject to the poor
old lame LM hashes that it would take say > 30 days to crack on perhaps a
P6-200.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Harmer, Michael E. wrote:
> 
> Answer to part 1:
> Yes Nt can do account lockouts. Look in User Manager for
> Domains-Policies-Account..
> 
> As for part 2:
> If the application is prepared to handle the exception, it can
> handle
> faults like this. Witness FTP and telnet. (Yes I know that
> these
> are protocol examples) I depends on the communication scheme
> you use and the applications on each end. They have to be aware
> of the possibility of loosing a connection..
> 
> Michael Harmer
> harmer@udri.udayton.edu
> 
> > -----Original Message-----
> > From: Eugene A. Tayam [SMTP:eugeneatayam@unn.unisys.com]
> > Sent: Tuesday, August 19, 1997 6:48 PM
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] NT Logon Security!
> >
> >
> >
> >
> >
> > Apologies for my previous posting..
> >
> > 1. Can Windows NT have a 3-try lock out?
> > - When a particular user tries 3 times, can NT lock him out?
> >
> > 2. Can Windows NT automatically know if the connection to a HOST ( as
> > in
> > IBM Mainframe) was broken? and inform a particular application
> > running
> > over it?
> >
> > Thanks,
> >
> > Eugene A. Tayam
> >


Please remove me from your mail list. Thank you
John "E.R." Jasen wrote:
> 
> Suffice it to say, a complaint has been sent to hotmail, and the people
> who run hkstar.com<>hk.super.net..
> 
> The spam has stopped, somehow, so lets get back to business..
> 
> On Tue, 19 Aug 1997, Matthew Richardson wrote:
> 
> > > I deleted the massage a while ago without bothering to look at the
> > > headers, but I would assume that it was actually sent from this
> > > ip-54-69.dialup.hkstar.com to hotmail.com to iss.net to all of us..
> >
> > You would be wrong. The relay used was mongkok.hk.super.net
> > [202.14.67.46]..
> >
> > > Meaning that hotmail would have great deal to do with this problem,
> > > whether or not this was a customer of theirs or they allowed or
> > > encouraged this activity, their server is still set up to permit
> > > anyone to use it as a relay..
> >
> > Sorry, wrong again..
> >
> > > Their mail server should only accept
> > > connection from within their address to send mail outside of their
> > > domain, or from anywhere on the Internet to one of their customers..
> >
> > I refer the learned poster to the following intercourse with Hotmail's
> > SMTP server:-
> >
> > 220 m1.hotmail.com Server SMTP ready at Tue, 19 Aug 1997 15:14:07 +0100
> > helo matthew
> > 250 m1.hotmail.com Hello matthew
> > mail from:test1@itconsult.co.uk
> > 250 Ok
> > rcpt to:test2@user.itconsult.co.uk
> > 551 'hotmail.com' is not a relay host..
> >
> > which shows conclusively that Hotmail do not relay..
> >
> > > Again, I did not actually look at the header so that I am not positive
> > > if this is the case..
> >
> > Indeed, but you could have checked whether Hotmail does relay before
> > posting..
> >
> > Best wishes,
> > Matthew
> >
> > ps: enough of this - back to the "proper" discussions for this list :-)
> >
> 
> --
> "If it fails, then we know we are making progress!"
> -- John E. Jasen // DNRC Ambassador to Earth \\ jjasen1@umbc.edu --
> -- My views are those of the DNRC only. Prepare to be domesticated --


Please remove me from you mail lists. Thank You.
I went to TechEd97 a couple of weeks ago, and the guy giving the MS
Proxy 2.0 presentation said that 2.0 is "a REAL firewall". (It was on
one of the slides.)

However, consider the situation where you have a UNIX system running
sendmail as your SMTP mail hub. It is not a good idea to have sendmail
exposed to the Internet, so the firewall would ideally have an SMTP
proxy which simply accepted mail from either side of the firewall and
passed it on appropriately. From what I could figure out, the MS Proxy
solution is to install SOCKS on the UNIX system, and have the sendmail
listen remoted to the outside of the proxy.

This means that the proxy is effectively exposing sendmail on your
internal system to the Internet, thus decreasing security considerably
(unless, of course, you consider sendmail to be extremely secure 8-).

Even if you're using Exchange, the solution is apparently to install a
Winsock proxy on the Exchange server, which means Exchange is now
exposed to the Internet, thus making your mail connection only as secure
as Exchange.

(The generic solution for non-Windows proxy users seems to be SOCKS.)

Did I misunderstand, or is this how MS Proxy 2.0 really works? If this
*is* how it works, does this seem wrong?

PJDM
----
Peter Mayne
Digital Equipment Corporation (Australia),
Canberra, ACT
These are my opinions, not DEC's.
This was typed by an infinite number of monkeys.
>
>----------
>From: Paul D. Robertson[SMTP:proberts@clark.net]
>Sent: Wednesday, 20 August 1997 3:04
>To: Ron Schreiner
>Cc: ntsecurity@iss.net
>Subject: Re: [NTSEC] C2
>
>On Tue, 19 Aug 1997, Ron Schreiner wrote:
>
>> If you hook up your NT box to a modem and/or a network, does this mean it
>>is 
>> no longer C2 compliant - even if you meet ALL other C2 requirements and/or 
>> recommendations?
>
>Yes, just as if you have a floppy drive on the machine it doesn't meet the
>evaluated configuration, or if it isn't one of the two exact models of PC
>which were evaluated

Actually, there were three models evaluated. (I'm using one of them
now.) Since at least one of them has an EISA bus, and the EISA config
utility is run from the floppy, it would seem rather awkward to leave
off the floppy drive. Since it is impossible to boot from the floppy
drive on at least one of the evaluated configurations, it shouldn't be
that much of a problem.

PJDM
----
Peter Mayne
Digital Equipment Corporation (Australia),
Canberra, ACT
These are my opinions, not DEC's.
This was typed by an infinite number of monkeys.



join ntsecurity

Hi all

I have installed Web Administration for Windows NT Server ( Downloadable
from Microsoft Download Center ) . It needs IIS 2 / 3 to work with .. 

On the security side, I always have to check the Basic Text Authentification
if I were to use the Web Admin .. and if I use only Windows NT Challenge /
Respond, no matter how many times I tried, it still failed

Why does this happens ?

CJ ?

hehe... ok, didnt know that :D

-jjs

>-----Original Message-----
>From: Daniel Hill [SMTP:danhill@mcit.med.umich.edu]
>Sent: Monday, August 18, 1997 9:53 AM
>To: Joshua Soliz
>Cc: 'ntsecurity@iss.net'
>Subject: Re: [NTSEC] Time Server supplied with Resource kit - possibleDoS
>
>Joshua,
> On Aug 13 at approximately 5 pm EDT USNO disabled non-NTP time
>services. For systems using Timeserv with type=internet this caused
>100% CPU utilization. The fix is to switch to type=NTP and
>NTPServer=tick.usno.navy.mil. This is documented by the author at
>http://home1.gte.net/dougho/TimeServ.html
>
>Joshua Soliz wrote:
>> 
>> Ill confirm this, It happened to my NT server last week. I didnt even
>> think about the possiblity that it was caused by the outside, but now
>> I
>> realize it probably was.
>> 
>> -jjs
>> 
>> >-----Original Message-----
>> >From: randall g [SMTP:randallg@telemark.net]
>> >Sent: Thursday, August 14, 1997 5:08 PM
>> >To: ntsecurity@iss.net
>> >Subject: Re: [NTSEC] Time Server supplied with Resource kit -
>> possibleDoS
>> >
>> >At 08:45 PM 8/14/97 GMT, you wrote:
>> >>Hi,
>> >>
>> >>As of early this morning, several ISP's have informed me of CPU
>> >>utilisation hitting 95-100% on their servers running the time daemon
>> >>from the NT Resource Kit.
>> >>
>> >>As yet we have not been able to confirm this is a DoS attack, but
>> >>everything is pointing that way.
>> >>
>> >>Does anyone know anything about it??
>> >
>> >The exact same thing happened to one of my servers. Stopping the
>> service
>> >brought the CPU back to normal. No idea why...
>> >
>> >
>> >
>> >>The information gathered so far is being made public at:
>> >>
>> >>http://andrewsmith.webcafe.net/timebug.htm
>> >>
>> >>Both Andrew Smith and I are continuing to look into this problem, I
>> >>would appreciate information (even reports of further attacks).
>> >>
>> >>Microsoft Security Team has been emailed, no reply as of this time.
>> >>
>> >>Ciao
>> >>
>> >>Drew
>> >
>> >
>> >
>> >
>> >randall g =%^)> Stockwatch webmaster
>> >mailto:webmaster@canada-stockwatch.com
>> >http://www.canada-stockwatch.com
>> >
Hello,

Does anyone have any comments to the following proposal for securing a
standalone NT Server running as a dedicated web server (www, ftp and
gopher) with no "file and print services" (for access to/from other
boxes). In particular, concerning the "Net Logon" and "Workstation"
services.

Control Panel/Service:

The following services should NOT be started:

Alerter
ClipBook Server
Computer Browser
DHCP Client
Directory Replicator
Messenger
Net Logon ???
Network DDE
Network DDE DSDM
Plug and Play
Remote Procedure Call (RPC) Locator
Server
SNMP Trap Service
Spooler "unless print spooling is needed"
TCP/IP NetBIOS Helper
Telephony Service
Workstation ???

The following services MUST be started:

EventLog
FTP Publishing Service
Gopher Publishing Service
NT LM Security Support Provider
Remote Procedure Call (RPC) Service
SNMP
World Wide Web Publishing Service

The following services MAY be started if needed:

Schedule
UPS

Control Panel/Network/Bindings:

Disconnect the "NetBIOS Interface", the "Server" and the "Workstation"
from the "WINS Client(TCP/IP)"

--
Phil.Parker@jdc.dk JDC - makes IT easy
ADP Dealer Services Denmark A/S Switchboard +45 7941 6400 ext 6604
Haeldagervej 165 Direct +45 7941 6604
DK-7100 Vejle, DENMARK FAX +45 7941 6411
Hello,

I would like to be able to control which files IIS will execute
(hopefully per Web Site when running multiple virtual servers
once I get IIS 4.0), and restrict them to only be able to access
the Web Site that the script is in..

1. Is there any way I can setup IIS to only allow CGI applications
 and ISAPI DLL's to be executed using the "Web File Extension
 Mapping" feature (see below) and prevent IIS from allowing the
 file name of a CGI application or ISAPI DLL to be specified in
 a request URL - i.e. to prohibit entries such as 
 "http://.../scripts/httpodbc.dll/scripts/pubs.idc?lname=Smith" ???

2. Am I correct in assuming that the ONLY files that IIS 3.0 will
 execute using the "Web File Extension Mapping" feature are those
 in a directory that has IIS "Execute" according to the "Microsoft 
 Internet Service Manager" "WWW Service Properties" "Directories" 
 "Directory Properties" AND that have NTFS "Execute" either for 
 "Everyone" or for the "IUSR_machinename" account (unless using 
 non-anonymous access in which case the given account) and which 
 have a filename extension that can be found in the Registry Key
 "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSer\Services\W3SVC\Parameters\
Script Map Key" ???

Looking on my workstation this Registry Key contains the following:

 .ASA \\WINNT.0\System32\inetsrv\ASP\ASP.dll
 .ASP \\WINNT.0\System32\inetsrv\ASP\ASP.dll
 .idc \\WINNT.0\System32\inetsrv\httpodbc.dll
 .STM \\WINNT.0\System32\inetsrv\ssinc.dll

Which will allow "Active Server Pages" (.ASA and .ASP) to be executed 
and "Internet Database Connector" (.IDC) files, and "Server Side 
Includes" (.STM) files.

3. Looking at NTFS permissions on the above .dll's I can see that 
 EVERYONE has "Change (RWXD)" - would it not have been more friendly 
 of Microsoft to not have included "W" permission - which permits 
 anyone to overwrite the DLL with their own trojan horse version ???

4. At least I could see from the Registry Entry for "Script Map Key" 
 under Security/Permissions that EVERYONE did not have "Set Value" 
 - but only "Special" ("Query Value", Create Subkey", "Enumerate 
 Subkeys", "Notify" and "Read Control") prohibiting EVERYONE from 
 adding their own "Web File Extension Mappings" !!!

5. Lastly, is there no way I can "chroot" to protect Web Sites from 
 each other - e.g. to prevent a user from making ASP scripts that 
 do such things as <% Set OutStream= FileObject.CreateTextFile 
 ("C:\autoexec.nt", True, False) %> ???

--
Phil.Parker@jdc.dk JDC - makes IT easy
ADP Dealer Services Denmark A/S Switchboard +45 7941 6400 ext 6604
Haeldagervej 165 Direct +45 7941 6604
DK-7100 Vejle, DENMARK FAX +45 7941 6411
At 11:34 AM 8/20/97 +0800, you wrote:

...
>> and no corroborating evidence. 
...
>> Unless of course, the identity of the correspondent or source of the
>> mysterious 
>> article have been revealed? 

17 February 1997 edition of Network News, "the UK's leading networking
weekly" Volume 7, Number 20. Can't find a URL, but it's probably in a
real-world (non-internet) library. I updated the page to reflect the
source, Todd Hooper provided the correct reference.

Note that any misconfigured firewall can be broken through, even the more
trusted proxy server.

I take issue with 'firewalls' that don't rewrite packets, allowing 'naked'
packets to reach internal nodes, and that don't do full inspection at the
application layer. Among other things. Last night in S.F. I mentioned a
few companies that trusted a certain brand of state firewall, and the
dis.org folk I was with broke out into giggles. 

Bill Stout

Are the followed terms identical or are there some differents? :
 pointer to DACL is NULL == bit SE_DACL_PRESENT is FALSE 

Cheers Christian

>-----Ursprüngliche Nachricht-----
>Von: Ko [SMTP:ko@dayton.ues.com]
>Gesendet am: Dienstag, 19. August 1997 21:15
>An: Bürger, Fa. I&S
>Cc: ntsecurity@iss.net
>Betreff: Re: [NTSEC] SECURITY_DESCRIPTOR_CONTROL / SE_DACL_PRESENT
>
>
>
>On Tue, 19 Aug 1997, Burger, Fa. I&S wrote:
>
>> Help !
>> 
>> Is there someone who knows something about this fact:
>> 
>> If I use the Win32 function "GetSecurityDescriptorDacl" I can get the
>> information "is a DACL present". What does it mean if this flag is not
>> set. Is there no security available, is implicitly set "no aceess", or
>> will this object get an inheritance, but from where or from who?
>> 
>
>As far as file object is concerned, "no DACL present" means "no access
>control", in another word anyone can have full access of the file. One
>example is a file on a FAT file system.
>
>> Christian Buerger
>> christian.buerger@istech.de
>> 
>> 
>
>Cheers,
> Ko
>
Hi,
 As previoulsy pointed out by Phil(philipb@omincell.com) on the
list:

o bit SE_DACL_PRESENT==FALSE means object has no DACL. This implies
 EVERYONE can access object.

o pointer to DACL is NULL means the object's DACL is set to NULL. This
 implies NO ACCESS to anyone.

 Hopes this help.

 Cheers,

 Ko

On Wed, 20 Aug 1997, Burger, Fa. I&S wrote:

> Are the followed terms identical or are there some differents? :
> pointer to DACL is NULL == bit SE_DACL_PRESENT is FALSE 
> 
> Cheers Christian
> 

ntsecurity@iss.net wrote:
> 
> I have had trouble FTPing MS Word files over RAS, it seems the 0X13
> character in word causes some problems. Were these Word files?

I've tried MS-Word files, plain text files, COMMAND.COM without success.
We've used FTP and MS-Explorer for copying.

Greetings - Georg
ntsecurity@iss.net wrote:
> 
> Check how RAS is setup. There is an option to allow the calling party
> to only access the RAS server. 

This was one of the first thing I checked out- access to the whole
network is allowed.

Greetings - Georg
> I would be careful about configuring SMTP connectivity on/through
the 
> Proxy Server. If you check, Proxy Server uses Port 25, which is
also
> the port reserved for SMTP. So, if Proxy Server is using Port 25,
and 
> you have, say, the Exchange Internet Mail Connector/Service (IMC
in 
> V4.0 /IMS in V5.0) running on the same box, what are the chances
of 
> NOT having a problem on transactions over Port 25.
> 
> In fact, during a conversation with Microsoft Tech Support for
Proxy 
> Server, they advised us not to try it. Odd, marketing literature
said 
> it could be done --- HOW BIZARRE.

 Interesting. The Proxy Server 2 FAQ describes how to set it ip. I
tried
last weekend, but failed to get it to work. As an interesting sidenote,
enabling PS2's server hosting functionality killed PPTP on the machine.
> 
Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com 
Home: swaim@phoenix.net or maybe swaim@c-com.net, I don't know.
Disclaimer: I Lie


>>1. Can Windows NT have a 3-try lock out?
>> - When a particular user tries 3 times, can NT lock him out?
>
>UserMangler for Domains - Policies/Account, Account Lockout options at the
>middle bottom of the window.
>
>>2. Can Windows NT automatically know if the connection to a HOST ( as in
>>IBM Mainframe) was broken? and inform a particular application running
>>over it?
>
>That would probably have to be handled by the application itself, but perhaps
>you write a wrapper (Perl could do this for an IP connection, but I don't
>know about a mainframe connection) which starts the program, and then
>monitors the connection. If the connection goes away, the wrapper kills off
>the app, or some other programmed behavior.
>
>
>Micah O'C
At 07:06 8/18/97 +0200, you wrote:
>On 15 Aug 97 at 15:54, David LeBlanc wrote:
>
>> That should allow them to create files, but any files they do create
>> will be non-executable.
 
>Would be nice, but isn't.
>Joe is the owner of the file, so he has no problems giving this file 
>X permissions.

OK, let's just say they start out non-executable, and the user has to have
enough sense to go change that. This should rule out 99% of the users.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

netsvc in the reskit

At 10:29 PM 8/21/97 +0100, Thomas Kernen wrote:
> Hello,
>
>is there a way using the "net" command for exemple, to restart a 
>service running on another machine in the same domain?
>
>TIA
>
>Thomas Kernen
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
I just thought that I'd note the release of my extensions for managing
NT with TCL 8.0. These extensions allow manipulation of security on
files and registry keys. The also allow for controlling services,
creating and deleting user accounts, assigning and revoking user rights,
etc.

Also included are extensions for doing ODBC, ping, gif graphing (gd),
managing shortcuts, etc. With the odbc piece it is relatively trivial
to do extensive dumps of your NT account database into an access db for
reporting. 

You can see docs at http://zazu.maxwell.syr.edu
You can get TCL 8.0 from Sun's ftp site:
ftp://ftp.smli.com/tcl/tcl80.exe
You can get the extension dlls from
ftp://ftp.maxwell.syr.edu/tcl/tcl80/nt-tcl80-final.zip

-Chris
I have run into a procedure WNetEnumCachedPasswords, which I cannot find
reference to anywhere in the M$ docunentation I have access to. Could
someone possibly point me to a reference to this, and others like it?

Phil


Question: What version of Web browser are you using?

Suggestion:
Try the Web browser that support NT Challenge/Respond authentication. 
 Latest version of IE should support.

 -----Original Message-----
From: CJ LiM [SMTP:limcj@smm.my.sony.com.sg]
Sent: Thursday, 21 August 1997 18:00
To: ntsecurity@iss.net
Subject: [NTSEC] Web Administration of Windows NT Server

Hi all

I have installed Web Administration for Windows NT Server ( Downloadable
from Microsoft Download Center ) . It needs IIS 2 / 3 to work with ..

On the security side, I always have to check the Basic Text 
Authentification
if I were to use the Web Admin .. and if I use only Windows NT Challenge 
/
Respond, no matter how many times I tried, it still failed

Why does this happens ?

CJ ?

I do not think so.

But Windows NT 4.0 Server resource kit provided the utility to do so:
NETSVC.exe
You can use this to remotely start, stop and query the status of services 
from the command line

 -----Original Message-----
From: Thomas Kernen [SMTP:tkernen@deckpoint.ch]
Sent: Friday, 22 August 1997 7:30
To: ntsecurity@iss.net
Subject: [NTSEC] Services under NT

 Hello,

is there a way using the "net" command for exemple, to restart a
service running on another machine in the same domain?

TIA

Thomas Kernen 

It still doesn't explain why it causes CPU Util to be 100%. Tardis has
always worked, and had the ability to switch servers as well. Why are
all the programs in the Resource Kit so fallible? I mean, the mail
program didn't work, the GUIs were all substandard compared with the
usability qualifications they have with other apps, it's almost a wonder
MS can sell it. The only thing that looked interesting was C2 Config,
and though I initted the registry modifications, I don't know if it
really makes it all that secure, and if so why it wasn't by default in
NT anyway.

Can anyone recommend a clean breakdown-book of registry entries?
There's far too many undocumented things you can do with it, so IMO
compared with the NT Server Unleashed's explaination of the User
Manager, I'd like to know what unknown variables can be improved, rather
than the generalistic overviews these books usually dish out to the more
green. Reply in email pls.



> -----Original Message-----
> From: Joshua Soliz [SMTP:jsoliz@dpai.com]
> Sent: Wednesday, August 20, 1997 5:14 PM
> To: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Time Server supplied with Resource kit -
> possibleDoS
> 
> hehe... ok, didnt know that :D
> 
> -jjs
> 
> >-----Original Message-----
> >From: Daniel Hill [SMTP:danhill@mcit.med.umich.edu]
> >Sent: Monday, August 18, 1997 9:53 AM
> >To: Joshua Soliz
> >Cc: 'ntsecurity@iss.net'
> >Subject: Re: [NTSEC] Time Server supplied with Resource kit -
> possibleDoS
> >
> >Joshua,
> > On Aug 13 at approximately 5 pm EDT USNO disabled non-NTP time
> >services. For systems using Timeserv with type=internet this caused
> >100% CPU utilization. The fix is to switch to type=NTP and
> >NTPServer=tick.usno.navy.mil. This is documented by the author at
> >http://home1.gte.net/dougho/TimeServ.html
> >
> >Joshua Soliz wrote:
> >> 
> >> Ill confirm this, It happened to my NT server last week. I didnt
> even
> >> think about the possiblity that it was caused by the outside, but
> now
> >> I
> >> realize it probably was.
> >> 
> >> -jjs
> >> 
> >> >-----Original Message-----
> >> >From: randall g [SMTP:randallg@telemark.net]
> >> >Sent: Thursday, August 14, 1997 5:08 PM
> >> >To: ntsecurity@iss.net
> >> >Subject: Re: [NTSEC] Time Server supplied with Resource kit
> -
> >> possibleDoS
> >> >
> >> >At 08:45 PM 8/14/97 GMT, you wrote:
> >> >>Hi,
> >> >>
> >> >>As of early this morning, several ISP's have informed me of CPU
> >> >>utilisation hitting 95-100% on their servers running the time
> daemon
> >> >>from the NT Resource Kit.
> >> >>
> >> >>As yet we have not been able to confirm this is a DoS attack, but
> >> >>everything is pointing that way.
> >> >>
> >> >>Does anyone know anything about it??
> >> >
> >> >The exact same thing happened to one of my servers. Stopping the
> >> service
> >> >brought the CPU back to normal. No idea why...
> 
if you haven't the reskit, try Service Manager NT - it's freeware

 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 
Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
+49 355 69 2752 fsch@informatik.tu-cottbus.de
http://www-rnks.informatik.tu-cottbus.de/~fsch
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

 Administrate the NT services about the whole domain:
 Service Manager NT 1.0

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/


On Thu, 21 Aug 1997, Eric Germann wrote:

> netsvc in the reskit
> 
> At 10:29 PM 8/21/97 +0100, Thomas Kernen wrote:
> > Hello,
> >
> >is there a way using the "net" command for exemple, to restart a 
> >service running on another machine in the same domain?
> >
> >TIA
> >
> >Thomas Kernen
> >
> >
> 
> 
> ============================================================================
> ====
> Eric Germann Computer and Communications Technologies
> ekgermann@cctec.com Van Wert, OH 45891
> Phone: 419 968 2640
> http://www.cctec.com Fax: 419 968 2641
> 
> Network Design, Connectivity & System Integration Services 
> A Microsoft Solution Provider 
> 
> 
correct ftp address should be:

ftp://ftp.smli.com/pub/tcl/tcl80.exe

>----------
>From: Christopher Sedore[SMTP:cmsedore@maxwell.syr.edu]
>Sent: 22. august 1997 5:27
>To: ntsecurity@iss.net
>Subject: [NTSEC] extensions for the TCL scripting language for NT
>
>You can get TCL 8.0 from Sun's ftp site:
>ftp://ftp.smli.com/tcl/tcl80.exe
>
>-Chris
>
On 21 Aug 97 at 13:46, David LeBlanc wrote:

> I'm really fairly tired of this particular debate (tho it is
> relevant ) - could someone possibly run some experiments and see
> how long it _really_ takes?

Even more tired of this debate & boy am I glad that I was "offline" 
during some of the more recent episodes :-(

When I wrote my FAQ on all this tat several months ago, I did REAL
WORLD measurements with my own dictionary/brute-force code. When
L0phtCrack 1.0 turned up in public, I did the same measurements with 
that (somewhat slower) implementation.

There is a table in there somewhere that shows the number of 
password attempts per second on several different P6s. It also 
gives average crack times for passwords created with a couple of 
different character sets. These figures were for L0phtCrack 1.0. 
and (for me) it achieved 97084 password attempts per second on a 
PRO 200. 

The associated average times had to be extrapolations because LC 1.0
couldn't actually crack passwords containing unusual (e.g. ALT)
characters or spaces. Another reason they are extrapolations
concerns the number of machines I have available and of course, the
normal human lifespan ;-)

The FAQs main home is at http://www.ntbugtraq.com, however this 
is currently not quite the latest. _Temporarily_ a newer version 
is at http://www.geocities.com/ResearchTriangle/4472/samfaq.htm

Regards,

--Alan--
acr@als.co.uk
Amanda Appleton wrote:
> 
> Does anyone know of any _good_ software or software/hardware combo
> that will let me "mirror" one server to another, so that in the event of
> a
> disaster (natural or deliberately induced), the second server can take
> over?
> 
> I'm sure I've seen ads for this...
> 
> If any vendors feel tempted to respond - please note I'm only after
> solutions
> available in the UK.
> 
> Thanks in advance!
> 
One product which provides mirroring and has been ported from a stable
product on NetWare is Vinca Standby Server, web site

 http://www.vinca.com/

> ---
> The usual disclaimer:
> These views are mine, not the company's. And no-one else can have them,
> so there!
> 
> "No, we in IT don't have a sense of humour that we're aware of"
> miss-quote, Mia
> 
> Amanda Appleton, network admin, hassled.
Hello all :)

Does anyone know a good and quite cheap firewall ?
If so please tell me :)
Thanks.

Carsten
>Last night in S.F. I mentioned a
>few companies that trusted a certain brand of state firewall, and the
>dis.org folk I was with broke out into giggles. 
>
>Bill Stout

Is there a purpose to this smear campaign against Check Point
Firewall-1? Why is it that you continually fail to mention the "certain
brand of state firewall"? Could it be that you realize your comments are
slander? Or is it to leave yourself an out by being able to say "oh, I
wasn't talking about that one!".

I TRUST CHECK POINT FIREWALL-1.

I believe your comments about it serve no useful security purpose, and I
believe your method of trying to prove your point that Proxies are more
secure is testimony to your lack of knowledge of Firewall-1. You've been
unable to suggest a single scenario where it might fail (when properly
configured) and can only supply conspiracy theorist crap to support your
claim that Proxies are "more trusted" (which in my world they are not,
some are simply "trusted" and others are "less trusted").

You want "naked" packets, then use any Proxy Firewall. Virtually every
single installed Proxy Firewall will be using screend for something.
Most of them, including TIS Gauntlet and Altavista Firewall '97 will be
using the generic screend supplied with the underlying OS (whichever OS
its running on).

I had thought you were better able to articulate security issues, but it
seems that since you didn't get what you wanted out of this same
discussion on the firewalls@greatcircle.com list you seem to think
you'll have better success here. Its interesting that you don't seem
willing to post these types of claims to the Firewalls list, guess you
figure you'd really do your reputation some damage if you did (either
that or you have far less respect for the NTSecurity readership than the
Firewall's folk).

Oh, and using your posting style...
"Every single hacker that I've asked about Check Point Firewall-1, and
I've spoken to way more than you have, agrees that its impossible to
break through a properly configured Check Point Firewall-1"...now prove
that this is not true.

...sigh...we've lost an independent, insightful, and thought-provoking
voice and had it replaced with that of a fanatic man with a
mission...sigh...see ya Bill (and this could be any Bill), we'll miss
you.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list: http://www.ntbugtraq.com

 We just upgraded a PDC to a new machine and have a user that cannot 
 logon the domain anymore. We've unjoined and then rejoined the domain 
 and created a new computer account in the domain for his workstation. 
 We also recreated the SAM from scratch rather than exporting the old 
 one to the new server. The PDC is running 4.0 with SP3 and the 
 workstation is 4.0 with SP3.
 
 Here's the problem when this user logs in to the domain it looks as if 
 he's getting logged on but then it returns to the logon screen. If we 
 log him on at a different workstation everything works ok. The user 
 can log in locally (using his local id and password - not the domain 
 user id). Looks like a problem specific to his workstation but I 
 don't know what it would be.
 
 All of my other users can logon the domain after rejoining and 
 creating a new computer account in the domain.
 
 Any suggestions? We'd rather not re-install or loose any of his 
 software settings and rights.
 
 Thanks!
 
 Davi
>However, consider the situation where you have a UNIX system running
>sendmail as your SMTP mail hub. It is not a good idea to have sendmail
>exposed to the Internet, so the firewall would ideally have an SMTP
>proxy which simply accepted mail from either side of the firewall and
>passed it on appropriately. From what I could figure out, the MS Proxy
>solution is to install SOCKS on the UNIX system, and have the sendmail
>listen remoted to the outside of the proxy.

>Even if you're using Exchange, the solution is apparently to install a
>Winsock proxy on the Exchange server, which means Exchange is now
>exposed to the Internet, thus making your mail connection only as
secure
>as Exchange.

>Did I misunderstand, or is this how MS Proxy 2.0 really works? If this
>*is* how it works, does this seem wrong?

 That's mostly correct. With Exchange, you're prpbably only going to
expose
SMTP and possibly POP3. Exchange's native connectors are unaffected.
 Otherwise, that's substantially correct. While it would be nice for
proxy server
to have a SMTP relay, I don't particularly see it happening. On the
other hand,
there's nothing to prevent you from putting your own mail relay agent on
your
proxy server. That's what we did with Proxy Server 1.0, and it appears
to be
working fine.


Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com 
Home: swaim@phoenix.net or maybe swaim@c-com.net, I don't know.
Disclaimer: I Lie

-----BEGIN PGP SIGNED MESSAGE-----

Carsten Goebels wrote:
>
> Hello all :)
>
> Does anyone know a good and quite cheap firewall ?
> If so please tell me :)
> Thanks.
>
> Carsten

Use a pair of scissors to cut the wire.

Bye,
 Wolfgang Ley (DFN-CERT)
- --
Wolfgang Ley, DFN-CERT, Vogt-Koelln-Str. 30, 22527 Hamburg, Germany
Email: ley@cert.dfn.de Phone: +49 40 5494-2262 Fax: +49 40 5494-2241
PGP-Key available via finger ley@ftp.cert.dfn.de any key-server or via
WWW from http://www.cert.dfn.de/~ley/ ...have a nice day

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBM/2aBgQmfXmOCknRAQG2ZwP9FDAnZCFKjL4fZ1FBfM4yEetI85AjvIPc
lBmLOUA1AqjDCvbZ+QaipZtPL9vlLdF82gGDH49fT8KwP+B1QC2UUr/viFViIL/T
C6xKaPlotlk+eMGwWqdO1O9Oarzq6fUD9cAN7KJ0cdxhjrbEVFt8bGmHxm3cktJ4
Ggru4yjzRVA=
=+2Wf
-----END PGP SIGNATURE-----
the two are mutually exclusive.


rwc

Carsten Goebels wrote:
> 
> Hello all :)
> 
> Does anyone know a good and quite cheap firewall ?
> If so please tell me :)
> Thanks.
> 
> Carsten

-- 
richard w crawford mailto:rich.crawford@breakwater.net
system engineer http://www.breakwater.net
Breakwater Technologies, Inc.
10210 NE Points Drive, Suite 110 Voice: 425-803-5002 x111
Kirkland, WA 98033.7872 Fax: 425-803-5001
one that i've heard of is called octopus. they've got a web page at
http://www.octopustech.com/. good luck.


rwc

Amanda Appleton wrote:
> 
> Does anyone know of any _good_ software or software/hardware combo
> that will let me "mirror" one server to another, so that in the event of
> a
> disaster (natural or deliberately induced), the second server can take
> over?
> 
> I'm sure I've seen ads for this...
> 
> If any vendors feel tempted to respond - please note I'm only after
> solutions
> available in the UK.
> 
> Thanks in advance!
> 
> ---
> The usual disclaimer:
> These views are mine, not the company's. And no-one else can have them,
> so there!
> 
> "No, we in IT don't have a sense of humour that we're aware of"
> miss-quote, Mia
> 
> Amanda Appleton, network admin, hassled.

-- 
richard w crawford mailto:rich.crawford@breakwater.net
system engineer http://www.breakwater.net
Breakwater Technologies, Inc.
10210 NE Points Drive, Suite 110 Voice: 425-803-5002 x111
Kirkland, WA 98033.7872 Fax: 425-803-5001

A cheap PC with LINUX correctly configured is the cheapest.


On Fri, 22 Aug 1997, Carsten Goebels wrote:

:Hello all :)
:
:Does anyone know a good and quite cheap firewall ?
:If so please tell me :)
:Thanks.
:
:Carsten
:

Thomas Kernen wrote:
> 
> Hello,
> 
> is there a way using the "net" command for exemple, to restart a
> service running on another machine in the same domain?
> 
> TIA
> 
> Thomas Kernen
Please remove me from your mail list. This is my third request.
At 12:25 8/20/97 -0400, you wrote:
>Hi,
> As previoulsy pointed out by Phil(philipb@omincell.com) on the
>list:
>
>o bit SE_DACL_PRESENT==FALSE means object has no DACL. This implies
> EVERYONE can access object.
>
>o pointer to DACL is NULL means the object's DACL is set to NULL. This
> implies NO ACCESS to anyone.

You've got this backwards. Check the doc on GetSecurityDescriptorDacl() - 

If the function stores a NULL value in the pointer pointed to by pDacl, the
security descriptor has a NULL discretionary ACL. A NULL discretionary ACL
implicitly allows all access to an object. 

This is a gotcha when writing code - if you're running around checking
security on files, as long as you use NTFS, if the lpbDaclPresent
parameter is true, you'll get back a DACL. However, if you hit a FAT
partition, you'll get a condition where lpbDaclPresent is true, but pDacl
== NULL. If you don't check for this before you call GetAclInformation(),
you'll throw an exception.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

fwtk is pretty cheap ;-)
Hi Carsten,

Carsten Goebels wrote:
> 
> Hello all :)
> 
> Does anyone know a good and quite cheap firewall ?
> If so please tell me :)
> Thanks.
> 
> Carsten

A Firewall is _not_ a single Product, it's a philosophy how to combine
certain boxes with different jobs in the right manner.

So one advice in Advance: _before_ you start buying stuff, start to
develop a policy for your site, or when you already did so, explain what
kind of device you need for your setup.

Bye

Jens
-- 
Jens-Uwe Schmidt * jus@ix.heise.de 

 iX * Magazin fuer professionelle Informationstechnik
Verlag Heinz Heise * Helstorfer Str. 7 * 30625 Hannover
 Tel +49 511 5352-375 Fax ...-361
Awwwww! This is good and cheap:

http://www.tis.com/docs/products/fwtk/readme.html

Just don't sell it. (And prepare yourself to do a little bit...or
perhaps a lot...of work.)

Richard Crawford wrote:
> 
> the two are mutually exclusive.
> 
> rwc
> 
> Carsten Goebels wrote:
> >
> > Hello all :)
> >
> > Does anyone know a good and quite cheap firewall ?
> > If so please tell me :)
> > Thanks.
> >
> > Carsten
> 
> --
> richard w crawford mailto:rich.crawford@breakwater.net
> system engineer http://www.breakwater.net
> Breakwater Technologies, Inc.
> 10210 NE Points Drive, Suite 110 Voice: 425-803-5002 x111
> Kirkland, WA 98033.7872 Fax: 425-803-5001
On Fri, 22 Aug 1997, Russ wrote:

> I TRUST CHECK POINT FIREWALL-1.

I don't. More specificly, I don't trust the current release of 
Firewall-1 under *either* NT or Solaris. I won't cast any aspersions, 
and I won't offer any proofs, so take it as you will, but I'll go on the 
record with the following:

In pure stateful packet filter terms, that is to do the job of filtering 
packets with its state table, and not addressing transport or internetwork 
layer issues at all, I do not trust Checkpoint Firewall-1's 
implementation of stateful packet filtering to function correctly. 

We can go back and forth on this game forever. There's a wide difference 
between not trusting stateful packet filtering as a security mechanism, 
and not trusting Checkpoint Firewall-1. I'm willing to cross both those 
lines right now, but it's not relevent to NTSEC, so I'll save it for 
comp.securtiy.firewalls.

> I believe your comments about it serve no useful security purpose, and I
> believe your method of trying to prove your point that Proxies are more
> secure is testimony to your lack of knowledge of Firewall-1. You've been
> unable to suggest a single scenario where it might fail (when properly
> configured) and can only supply conspiracy theorist crap to support your

Define properly configured. Does that include having to write your own 
inspect code? Are you aware that as shipped FW-1 doesn't maintain 
complete state for ICMP? Yes, that's a trivial example, and not 
necessarily an exploitable weakness other than in conjunction with 
something like the reverse telnet over ICMP applications floating around the 
net. 

> You want "naked" packets, then use any Proxy Firewall. Virtually every
> single installed Proxy Firewall will be using screend for something.
> Most of them, including TIS Gauntlet and Altavista Firewall '97 will be
> using the generic screend supplied with the underlying OS (whichever OS
> its running on).

No Russ, I have to disagree here. "Will be using" isn't the correct 
terminology. You have the _ability_ to let raw packets through, but 
that's an exception, not the rule in a hybrid (proxy/packet filter based) 
firewall. With a packet filtering firewall you don't have the ability 
to protect yourself from transport and internetwork layer attacks which 
fit within the protocol specification, or others should they not have been 
specifically addressed in code. There's a wide gulf between those two 
possibilities.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280


David,
 You are absolutely right! I stand corrected and apologise to anyone
who happens to be confused by my posting.

 I've written a lot of code for examining ACL on NT less than a year
ago, and my posting was from (obviously badly corrupted) memory.

 Cheers,

 Ko

David LeBlanc wrote:
> 
> At 12:25 8/20/97 -0400, you wrote:
> >Hi,
> > As previoulsy pointed out by Phil(philipb@omincell.com) on the
> >list:
> >
> >o bit SE_DACL_PRESENT==FALSE means object has no DACL. This implies
> > EVERYONE can access object.
> >
> >o pointer to DACL is NULL means the object's DACL is set to NULL. This
> > implies NO ACCESS to anyone.
> 
> You've got this backwards. Check the doc on GetSecurityDescriptorDacl() -
> 
> If the function stores a NULL value in the pointer pointed to by pDacl, the
> security descriptor has a NULL discretionary ACL. A NULL discretionary ACL
> implicitly allows all access to an object.
> 
> This is a gotcha when writing code - if you're running around checking
> security on files, as long as you use NTFS, if the lpbDaclPresent
> parameter is true, you'll get back a DACL. However, if you hit a FAT
> partition, you'll get a condition where lpbDaclPresent is true, but pDacl
> == NULL. If you don't check for this before you call GetAclInformation(),
> you'll throw an exception.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
> On Fri, 22 Aug 1997, Carsten Goebels wrote:
> 
> :Hello all :)
> :
> :Does anyone know a good and quite cheap firewall ?
> :If so please tell me :)
> :Thanks.
> :
> :Carsten
> :

Firewall toolkit. If you want something for NT, I would
suggest The Wall from Raptor.



-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
linux with ipfwadm is quite good, and quite cheap.

Carsten Goebels wrote:
> 
> Hello all :)
> 
> Does anyone know a good and quite cheap firewall ?
> If so please tell me :)
> Thanks.
> 
> Carsten
Hey,

We have about 30 NTW4 machines without a PDC. All username/passwords are
maintained locally and it's a pain. It's been my experience that if I
create a PDC and suggest users log in to the domain, they will lose their
local profiles: Example: /winnt/profiles/joe will be
/winnt/profiles/joe.000 for the NT domain

Is there anyway that users can logon to a domain and still retain there
local profile settings? Copying all files from ~/joe to ~/joe.000 gets
pretty close, but not all settings. 

Apologies if this a lame question.

Todd


What's your take on the SOCKS proxy?


I'm trying to find an explanation to the different type of logons, as 
indicated in Event ID 528 in the Security Log (see below). I'm trying 
to find out if these are "real" logons by people, or is some service 
doing something that is registering as a type-3 logon.

In particular, my Security audit logs are full of type 528's showing 
that a KSecDD logon Process logging into to just about any and all 
servers. Any info would be greatly appreciated.

Event ID: 528
Type: Success Audit
Category: Logon\Logoff

Successful Logon:
 User Name: RONNIE
 Domain: DOMAINA
 Logon ID: (0x0,0x2FDAB1)
 Logon Type: 3
 Logon Process: KSecDD
 Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Workstation Name: \\RONNIEHOME


....................................................................... 
....................................
Ronnie Bouchon, MCSE, CNE
Infrastructure Systems Engineer
SAS Institute, Infrastructure Support Team
919-677-8000 x4367 | snorjb@wnt.sas.com


I am looking for the Linux Boot Disk that comes with the NT SAM extractor. It allows you to change any users password to anything you want. I had a copy and it, well, melted on my dashboard. I have been looking all over hell for it but don't remember where I got it.

I someone could let me know where I could find it, I would greatly appreciate it
 
Can there be a permissioning change on his hard drive? This would
prevent him from accessing critical files for the logon process on his
workstation only. Can anyone else at his security level logoon to the
workstation? If not, then can the Domain Admin logon to his
workstation?

Chance.


-----Original Message-----
From: DOttenheimer@rad-eng-po.radiology.uiowa.edu
[SMTP:DOttenheimer@rad-eng-po.radiology.uiowa.edu]
Sent: Friday, August 22, 1997 10:32 AM
To: ntsecurity@iss.net
Subject: 

 We just upgraded a PDC to a new machine and have a user that cannot

 logon the domain anymore. We've unjoined and then rejoined the
domain 
 and created a new computer account in the domain for his
workstation. 
 We also recreated the SAM from scratch rather than exporting the
old 
 one to the new server. The PDC is running 4.0 with SP3 and the 
 workstation is 4.0 with SP3.
 
 Here's the problem when this user logs in to the domain it looks as
if 
 he's getting logged on but then it returns to the logon screen. If
we 
 log him on at a different workstation everything works ok. The
user 
 can log in locally (using his local id and password - not the
domain 
 user id). Looks like a problem specific to his workstation but I 
 don't know what it would be.
 
 All of my other users can logon the domain after rejoining and 
 creating a new computer account in the domain.
 
 Any suggestions? We'd rather not re-install or loose any of his 
 software settings and rights.
 
 Thanks!
 
 Davi
I would love it if this discussion (and others on the same topic) moved
to the firewalls list.

> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> Reply To: Paul D. Robertson
> Sent: Friday, August 22, 1997 8:22 AM
> To: Russ
> Cc: ntsecurity@iss.net; 'Bill Stout'
> Subject: RE: [NTSEC] Firewalls
> 
> On Fri, 22 Aug 1997, Russ wrote:
> 
> > I TRUST CHECK POINT FIREWALL-1.
> 
> 
-----Original Message-----
From: Swaim, Mike [SMTP:mpswaim@gdseng.com]
Sent: Friday, August 22, 1997 10:03 AM
To: Arner, Tom
Subject: Microsft Proxy server security issues?


My reply: excuse me, I'm new to the list . I will follow correct
protocols in the future.
>I work for an MS solution provider and we are very interested in the
>security issues with MS Proxy. We have much of the configuration
>you're referring to. What is your take MS Proxy?
 I've been fairly happy with it.
My reply: likewise , the network people have been happy with it. We
don't allow FTP at this point which is a issue.

> We have a net exposed
>to the internet with 2 MS Proxy servers and a web server connected to a
>external ISP router and internal router. And we don't let any other ip
nets
>in through our router. Through a trust relationship we've nailed down
>the internal communiction with our Proxy NT domain, one way trust. The
>PDC/Exchange srv trusts the Proxy. Communication is through an IMC
>connection. 
That's much like our configuration. I'm not sure that I'd give the web
Server a connection to the internal network. I still don't really trust
IIS.
My reply> the IIS web server is available using HTTP, the ways you can
address the server probably is a question. The web/proxy domain does not
trust the internal. Thinking about that ? There might be ways around
that. For instance in the untrusted domain I can : ping the proxy PC,
but not the IIS PC, from IE I can load the HTTP IP addr of IIS PC but
not a NBT SMB call form IE(net view \\ 204.3.10.3 equiv..) , On proxy
load HTTP I get proxy error make a SMB call I have file access. Can't
see much but I'm on. ?
Also, I'd make
sure that everything's disabled on the proxy servers external network
cards except
basic TCP/IP. You should also block the ports that proxy server uses at
the router
connected to the internet.
My reply: The router I believe is owned by ISP , this is a good point.
>Is there any documentation on MS Proxy or white papers that someone can
>point me to on the reliability of this product. It's a cheap solution
>and it seems to work in combination with routers. All the commercial
>tests seemed to be with the big firewall names, but nothing about MS
>Proxy.
 I really haven't seen anything. Proxy 1.0 isn't a real firewall, and
2.0 hasn't
been officially released.
My reply: The statement "isn't a real firewall" I've heard before,
this is the reason for this thread.
In conjunction with proper configured routers is this really true?


Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com 
Home: swaim@phoenix.net or maybe swaim@c-com.net, I don't know.
Disclaimer: I Lie
you can use the at command. cheesey solution, but it's free!

at \\hostname 14:39 c:\winnt35\system32\net start "clipbook server"
just do a net time \\hostname then set your at job to 1 minute later.
(doesn't work if your trying to start the schedule service though)
----------
> From: Joo Soo Lim 
> To: Thomas Kernen 
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Services under NT
> Date: Friday, August 22, 1997 7:34 PM
> 
> 
> I do not think so.
> 
> But Windows NT 4.0 Server resource kit provided the utility to do so:
> NETSVC.exe
> You can use this to remotely start, stop and query the status of
services 
> from the command line
> 
> -----Original Message-----
> From: Thomas Kernen [SMTP:tkernen@deckpoint.ch]
> Sent: Friday, 22 August 1997 7:30
> To: ntsecurity@iss.net
> Subject: [NTSEC] Services under NT
> 
> Hello,
> 
> is there a way using the "net" command for exemple, to restart a
> service running on another machine in the same domain?
> 
> TIA
> 
> Thomas Kernen 
NT Server 4.0 Resource Kit version 2 has a .hlp file entitled regentry. 
 This enumerates quite a few of the previously undocumented registry 
entries. Version 2 shipped recently.

--eric


Hello,

I'm setting up system policies and was trying to figure
out how to define a group policy for settings in the
'default computer'.

It appears that group settings only relate to items
in the 'default user'. Can I setup a group setting
based on the 'default computer' settings?



Thanks in advance.

Les Mayeda
Cedars-Sinai Medical Center
mayeda@csmc.edu



--Boundary_[ID_AXctX/6TYIbVIl9esa/31A]--

Return-path: <>
Received: from PTCP-DAEMON by CSMC.EDU (PMDF V5.1-7 #15047)
 id <01IMQHTBERWW938EPZ@CSMC.EDU>; Fri, 22 Aug 1997 09:36:44 PDT
Received: from CSMC.EDU (PMDF V5.1-7 #15047) id <01IMQHSDDUOW938TOD@CSMC.EDU>;
 Fri, 22 Aug 1997 09:36:36 -0700 (PDT)
Date: Fri, 22 Aug 1997 09:36:36 -0700 (PDT)
From: PMDF e-Mail Interconnect 
Subject: Delivery Notification: Delivery has failed
To: MAYEDA@CSMC.EDU, postmaster@CSMC.EDU
Message-id: <01IMQHT8N3YE938TOD@CSMC.EDU>
MIME-version: 1.0
Content-type: MULTIPART/REPORT; BOUNDARY="Boundary_[ID_AXctX/6TYIbVIl9esa/31A]"
At 10:15 PM 8/19/1997 -0400, Jeff wrote:
>I am trying to find a way to reject mail from Spammers who spoof an
>email headers to appear as if the sender and the recipient are the same
>address. Case in point: Spam arrives in my inbox (gomberg@synair.com)
>addressed to "friend@bubba.com" from "friend@bubba.com". Presumably the
>target's actual address is embedded in the bcc portion of the header.
>
I receive about 400 messages a day. So I want spam out of the way as
quickly as possible. The best and easiest way to filter everything I can
identify as legitimate and then set the rest aside as possible spam. 

I use Eudora which has a pretty good set of mail filters. What I do is as
follows: 

1) Filter all mail from mail lists I've subscribed to into separate
folders. 
2) Filter mail directly to me into a personal folder. 
3) Filter known spam sites like cyberpromo, uu.net, etc. into spam folder
4) Filter remaining mail into a potential spam folder. 

This takes advantage of the fact that almost all unsolicited bulk email is
sent to blind copies rather than to your address. Thus, if you've gotten
rid of the legitimate mail lists, anything left after filtering mail
addressed to you, anything left is probably spam. 

I would say that this is about 98% effective. Note that this would not
have caught the spam sent to this mail list. If I switched the order of the
above filters to 3,1,2,4 and added this guy to my known spammer list it
would catch him too. 
 
 Scott Peterson


Disclaimer: Any errors in spelling, tact,or fact are transmission errors. 
Is there a way to set up a BDC so that only certain folks can log on
locally without setting that option for the domain in user rights? I
currently have my server set up so that the last login id is erased.
Unfortunately someone has been unlocking my server by logging in and
subsequently killing my backups.
HELP...

Connie Darr 
Coord., Computer Systems Control
Florida Gulf Coast University
cedar@fgcu.edu

At 10:47 8/22/97 -0700, you wrote:
>I am looking for the Linux Boot Disk that comes with the NT SAM extractor.
 It allows you to change any users password to anything you want. I had a
copy and it, well, melted on my dashboard. I have been looking all over
hell for it but don't remember where I got it.
>
>I someone could let me know where I could find it, I would greatly
appreciate it

For a nice bunch of links, see http://www.iss.net/vd/sitesn.html

That link is among them. BTW, if anyone has any really good NT security
links that we don't have, please pass them back to me - we'd like that part
of our site to be known as a good resource.

There are actually links to 2 other cheap to free ways to "recover" admin
passwords - no need for those high-priced "services"...


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

On Fri, 22 Aug 1997, Patrick Murphree wrote:

> I am looking for the Linux Boot Disk that comes with the NT SAM extractor. It allows you to change any users password to anything you want. I had a copy and it, well, melted on my dashboard. I have been looking all over hell for it but don't remember where I got it.
> 
> I someone could let me know where I could find it, I would greatly appreciate it

See: http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html


=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

Great point. I'd go a step further and suggest that the firewall is a
perimeter defense, only. Therefore, it's important to layer your
defenses, implement protection at the (protected) server level as well,
and organize your management of the various layers from a central point
of view (that is, managed as if they're part of the same organization
(one security policy).)


> Carsten Goebels wrote:
> > 
> > Hello all :)
> > 
> > Does anyone know a good and quite cheap firewall ?
> > If so please tell me :)
> > Thanks.
> > 
> > Carsten
> 
> 
> Jens-Uwe Schmidt wrote: 
> >
> >A Firewall is _not_ a single Product, it's a philosophy how to
> combine
> >certain boxes with different jobs in the right manner.
> >
> 
But of course you can start the schedule service through "Server
Manager".

Greg...

> -----Original Message-----
> From: chris@gkm.com [SMTP:chris@gkm.com]
> Sent: Friday, August 22, 1997 1:46 PM
> To: Joo Soo Lim; Thomas Kernen
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Services under NT
> 
> you can use the at command. cheesey solution, but it's free!
> 
> at \\hostname 14:39 c:\winnt35\system32\net start "clipbook server"
> just do a net time \\hostname then set your at job to 1 minute later.
> (doesn't work if your trying to start the schedule service though)
> ----------
> > From: Joo Soo Lim 
> > To: Thomas Kernen 
> > Cc: ntsecurity@iss.net
> > Subject: RE: [NTSEC] Services under NT
> > Date: Friday, August 22, 1997 7:34 PM
> > 
> > 
> > I do not think so.
> > 
> > But Windows NT 4.0 Server resource kit provided the utility to do
> so:
> > NETSVC.exe
> > You can use this to remotely start, stop and query the status of
> services 
> > from the command line
> > 
> > -----Original Message-----
> > From: Thomas Kernen [SMTP:tkernen@deckpoint.ch]
> > Sent: Friday, 22 August 1997 7:30
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] Services under NT
> > 
> > Hello,
> > 
> > is there a way using the "net" command for exemple, to restart a
> > service running on another machine in the same domain?
> > 
> > TIA
> > 
> > Thomas Kernen 
 Forgive my non-technical opinion--but on 22 Aug 97 Paul wrote:
 
 "There's a wide difference between not trusting stateful packet 
 filtering as a security mechanism, and not trusting Checkpoint 
 Firewall-1."
 
 The operative word being "Trusting," I agree with Paul, and I too 
 don't trust Check Point or Firewall-1 when it comes to protecting U.S. 
 information systems.
 
 Check Point Software Technologies Ltd. is an Israeli owned company 
 with their international headquarters located at Ramat Gan, Israel. 
 My lack of trust is based on being associated with DoD comm/computer 
 services for over 24 years. Much has been published about "INFORMATION 
 WARFARE" targeting select U.S. high tech companies and the banking 
 industry. Historically, the commercial sector has not had to be 
 concerned with such security related issues as "Foreign Ownership, 
 Control, or Influence, (FOCI)." However, I feel this too will change 
 as technology destroys the protection offered by borders and large 
 military budgets.
 
 I don't trust FOCI information technology to protect U.S. information 
 systems and its nationality doesn't matter. I'm sure foreigners feel 
 the same about U.S. products when it comes to protecting their 
 information. This doesn't mean that U.S. companies build superior 
 products nor does it mean that an individual programmer working alone 
 will not create back doors that allow unauthorized access. However, I 
 tend to "trust" U.S. companies and will look to them first, then to an 
 evaluated product, prior to considering a FOCI system.
 
 Jerry Taylor, SMSgt (Ret) 

 I've seen that software.com can restrict who can use it as a mail 
 router -- prevent spammers from using it fr routing. Does exchange or 
 other mail routers have similar controls?
 
 Davi


______________________________ Reply Separator _________________________________
At 10:15 PM 8/19/1997 -0400, Jeff wrote:
>I am trying to find a way to reject mail from Spammers who spoof an 
>email headers to appear as if the sender and the recipient are the same 
>address. Case in point: Spam arrives in my inbox (gomberg@synair.com) 
>addressed to "friend@bubba.com" from "friend@bubba.com". Presumably the 
>target's actual address is embedded in the bcc portion of the header.
>
Scott wrote:
I receive about 400 messages a day. So I want spam out of the way as 
quickly as possible. The best and easiest way to filter everything I can 
identify as legitimate and then set the rest aside as possible spam.
 
We are using TimeServ to synchronize our NT servers to UTC.

We would like our NT servers to act as NTP servers for the UNIX systems in
our intranet. 

Does anyone know of any products to do this? What are they? Where can we
find them?

Thanks!
John
********************************************************************
John Freymann j.freymann@aaiate.com
INS Department (847)821-3347
Advantest America, Inc. (847)634-2552 FAX


This email address may not be added to any commercial mail list with out my
permission. Violation of my privacy with advertising or SPAM will result
in a suit for a MINIMUM of $500 damages/incident, $1500 for repeats.
US Code Title 47, Sec.227(b)(1)(C), Sec.227(a)(2)(B)
********************************************************************


I wanted to let everyone know that what Dennis suggested by limited the
share level permissions to "Everyone - Change (RWXD)" worked
beautifully. It prevented normal users from changing the permissions on
files/directories that they created, however, it did not prevent the
Administrators from changing the permissions. Thanks Dennis.

What David suggested with the "explicit access denied ACL that prohibits
permission changing" might work, but I could not figure out how to make
the user interface allow me to give that permission. I believe that the
NTFS specification will allow this sort of thing, but the user interface
to changing permissions through Explorer will not allow you to add it
that way. It's either all or nothing when talking about access denied
ACEs.

So, I guess my final question would be: Does allowing Administrators
the ability to change permissions through a share when the share level
permissions are set at "Everyone - Change (RWXD)" constute a
bug/undocumented feature, or is this by design?

Greg...

 
> -----Original Message-----
> From: D. Flagg [SMTP:clay@halcyon.com]
> Sent: Tuesday, August 19, 1997 3:16 PM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] NTFS file security questions
> 
> You could try using the share level permissions. If the user does not
> have full control at the share level they will not be able to exercise
> full control i.e. change access permissions, at the ntfs level. This
> may mean you will need to rethink your share strategy.
> 
> Dennis
> 
> -----Original Message-----
> From: David LeBlanc [SMTP:dleblanc@iss.net]
> Sent: Monday, August 18, 1997 3:50 PM
> To: BRADLEY, GREGORY S
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] NTFS file security questions
> 
> At 11:14 8/18/97 -0500, you wrote:
> 
> >Is there a way we can prevent users from changing permissions on
> >files/directories that they create on remote NT servers?
> 
> AFAIK, there isn't any way to stop this. The problem is that
> creator-owner
> has an implicit right to set permissions. IMHO, this should be an
> assignable user right, since only admins truly need it.
> 
> What _may_ work, but I have not tried, is to set an explicit access
> denied
> ACL that prohibits permission changing. I know that NT checks access
> denied ACLs before it checks for allowed. Whether or not this will
> work
> depends on whether the implicit right to set permissions is checked
> before
> or after the rest of the ACL.
> 
> If that doesn't work, I'd recommend writing a script to take care of
> it.
> Otherwise, the user could have 10GB of GIF files, and you wouldn't
> know it.
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
Winat out of the reskit will force schedule to run as well. 

> -----Original Message-----
> From: BRADLEY, GREGORY S [SMTP:GSBRAD@exchange.monsanto.com]
> Sent: Friday, August 22, 1997 2:05 PM
> To: 'chris@gkm.com'; Joo Soo Lim; Thomas Kernen
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Services under NT
> 
> But of course you can start the schedule service through "Server
> Manager".
> 
> Greg...
> 
> > -----Original Message-----
> > From: chris@gkm.com [SMTP:chris@gkm.com]
> > Sent: Friday, August 22, 1997 1:46 PM
> > To: Joo Soo Lim; Thomas Kernen
> > Cc: ntsecurity@iss.net
> > Subject: Re: [NTSEC] Services under NT
> > 
> > you can use the at command. cheesey solution, but it's free!
> > 
> > at \\hostname 14:39 c:\winnt35\system32\net start "clipbook server"
> > just do a net time \\hostname then set your at job to 1 minute
> later.
> > (doesn't work if your trying to start the schedule service though)
> > ----------
> > > From: Joo Soo Lim 
> > > To: Thomas Kernen 
> > > Cc: ntsecurity@iss.net
> > > Subject: RE: [NTSEC] Services under NT
> > > Date: Friday, August 22, 1997 7:34 PM
> > > 
> > > 
> > > I do not think so.
> > > 
> > > But Windows NT 4.0 Server resource kit provided the utility to do
> > so:
> > > NETSVC.exe
> > > You can use this to remotely start, stop and query the status of
> > services 
> > > from the command line
> > > 
> > > -----Original Message-----
> > > From: Thomas Kernen [SMTP:tkernen@deckpoint.ch]
> > > Sent: Friday, 22 August 1997 7:30
> > > To: ntsecurity@iss.net
> > > Subject: [NTSEC] Services under NT
> > > 
> > > Hello,
> > > 
> > > is there a way using the "net" command for exemple, to restart a
> > > service running on another machine in the same domain?
> > > 
> > > TIA
> > > 
> > > Thomas Kernen 
I simply do not have time to read the volume of ntsecurtiy mail that I get in a ordinary day. I need to stop receiving NTSEC newsletter. Thank 
you. Charles Johnson
CMJChuck@SWBell.net
QUIT ntsecurity

**************************************************
Shane Patelakis
P.O. Box 1355
Lunenburg, N.S.
B0J 2C0

Tel (work): (902) 420-7907
 (Home): (902) 527-2158
 cell: (902) 489-0364 {Halifax #}
 Fax: 902-420-0219

Email(work): patelasj@tuns.ca
Email (home): shane@auracom.com

Grad student currently study for a Master's in
Food Science at T.U.N.S., Halifax, N.S.

"Don't ever think you got it made!"
**************************************************
QUIT ntsecurity

**************************************************
Shane Patelakis
P.O. Box 1355
Lunenburg, N.S.
B0J 2C0

Tel (work): (902) 420-7907
 (Home): (902) 527-2158
 cell: (902) 489-0364 {Halifax #}
 Fax: 902-420-0219

Email(work): patelasj@tuns.ca
Email (home): shane@auracom.com

Grad student currently study for a Master's in
Food Science at T.U.N.S., Halifax, N.S.

"Don't ever think you got it made!"
**************************************************
well, after my smart-alec response, i figure a reasonable answer to a reasonable
question is in order....
get linux (free, or very cheap if u get redhat or such)
get firewall-toolkit (fwtk) also free, and works on linux [i think] (see
www.tis.com for this)
you'll need a 486'ish machine probably...
while this solution is free (except for the h/w), you'll need to know a LOT more
than me (not necessarily hard to do, if you've read my previous posts)to set it
up right. basically you'll need someone very familiar with unix and ip in
general to do this right....
there's some nt based firewalls (more than free...but still reasonable) if
you're not unix-saavy...
check out this url
http://www.waterw.com/~manowar/vendor.html
for a good summary
altavista is the only one i know a price for ($3995 i think for 50 users),
(not a plug, i've never used it)
if i may..

this discussion what is good or what is bad seems to be pointless..

how about we discuss what is configurable easily or what dont take 3 years
to get the grasp of .. i have seem most firewalls setup incorrectly and
most set up correctly its my opion (for what its worth)that on the whole a
firewall is usless if misconfigured and most misconfigurations are due to
the lack of knowledge with the product...

as for what i this is a good wall... thats debatable but i have seen total
non techs configure the Guardian 2.2 with NAT from the manual (although i
think the manual writer needs a slap up the head ). and have it running
with no faults after only three attempts.. as for price i dont know we are
not a firewall reseller (unlike most folks who i have seen take part in this
debate)

there are extreamly well set up linux firewalls if you are prepared to play
with them and there are very poor out of the box solutions as well

knowledge is the real key here and if you are prepared to learn a bit then
that is where you will find success

respectfully

John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

When some products install they create a subkey with a path statement in. 
This often points to directory locations that are writeable and executeable 
as part of the functionality of the application. Corel Draw 7 is such an 
example. Anyone any clever workarounds to preserve the functionaility but 
avoid the obvious security holes? This is a similar problem to the RAS path 
and directory problem documented by Frank Ramos.

Kind regards,


Mark

______________________________________
Mark Curphey
Insight Consulting
Churchfield House
The Quintet
Churchfield Road
Walton on Thames
Surrey
KT12 2TZ

Tel 01932 - 241000
Fax 01932 - 244590
Mobile 0410 - 034066
E Mail MarkC@insight.co.uk
E Mail m.curphey@rhbnc.ac.uk
World Wide Web www.insight.co.uk
World Wide Web www.curphey.com


> Hello all :)
> 
> Does anyone know a good and quite cheap firewall ?
> If so please tell me :)
> Thanks.

Linux Masquerading. Cost - Nothing.
 Installing time - 1 - 3 hours.

ONU


 \\\___///
 \\ - - //
 ( @ @ ) 
 +----------------------oOOo-(_)-oOOo-----------------------+
 | Vahur Laas, General Staff of the Estonian Defence Forces |
 | Network Administrator |
 | Tel: 22 441-251 |
 | mailto:onu@mil.ee, mailto:onu@medical.magnum.ee |
 +-----------------------------Oooo-------------------------+
 oooO ( ) 
 ( ) ) /
 \ ( (_/
 \_) 




Good luck. I have tried and tried to stop this subscription and I keep
getting an automated "unrecognized command" response. Does anyone
really know how to get off of this list? or is this just a cruel joke
with no exit?

>-----Original Message-----
>From: Freya Lynn Johnson [SMTP:cmjchuck@swbell.net]
>Sent: Friday, August 22, 1997 9:35 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] stop subscription
>
>I simply do not have time to read the volume of ntsecurtiy mail that I get in
>a ordinary day. I need to stop receiving NTSEC newsletter. Thank 
>you. Charles Johnson
>CMJChuck@SWBell.net
Does anyone have any experience of SP3 creating instabilty in a system? Particularly with regard to anti-virus products.

Regards,

______________________________________
Mark Curphey
Insight Consulting
Churchfield House
The Quintet
Churchfield Road
Walton on Thames
Surrey
KT12 2TZ

Tel 01932 - 241000
Fax 01932 - 244590
Mobile 0410 - 034066
E Mail MarkC@insight.co.uk
E Mail m.curphey@rhbnc.ac.uk
World Wide Web www.insight.co.uk
World Wide Web www.curphey.com

On Sat, 23 Aug 1997, Vahur Laas wrote:

> > Hello all :)
> > 
> > Does anyone know a good and quite cheap firewall ?
> > If so please tell me :)
> > Thanks.
> 
> Linux Masquerading. Cost - Nothing.
> Installing time - 1 - 3 hours.
> 

Masquerading by itself is not really security. Granted it will stop the 
script kiddies until someone writes some Masquerading spoofing tools (if 
they haven't been written already). It does not provide access control 
of any real kind. ipfwadm, the tool you would use to set up your 
masquerading rules, DOES provide mechanisms for access control though. 

I also do not disagree with the spirit of your post. There is definetly a 
price/paranoia range for which a linux box with some public domain tools 
can provide all that is neccesarry for a small office, or internal 
firewall. 

I've spent the last two days setting one up, the majority of time was 
spent training a new employee on how to do it. Took to it like water 
with an explanation of the fundamentals.


Craig Brozefsky craig@onshore.com
onShore Inc. http://www.onshore.com/~craig
Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)

On Sat, 23 Aug 1997, John Johnson wrote:

[original subject line re-instated so those who are dumping this
topic automatically don't have to see this]

> how about we discuss what is configurable easily or what dont take 3 years
> to get the grasp of .. i have seem most firewalls setup incorrectly and

Because from a security standpoint, it's pointless. Firewalling is 
necessisarily technical. If you want security, then you need someone with a 
clue of security. The point of a firewall is to let traffic enter and 
leave the security domain. If you let traffic enter and leave the 
domain, you have an open attack vector. The most reasonable example of 
this was the IP over SMTP example a few years back. Almost everyone 
allows SMTP in and out, ergo almost everyone can be vulnerable (The same 
example works over UUCP as well).
 
> most set up correctly its my opion (for what its worth)that on the whole a
> firewall is usless if misconfigured and most misconfigurations are due to
> the lack of knowledge with the product...

Which is why most companies are using security professionals to configure 
and install their firewalls, even if they don't have the capital to keep 
them on-staff. However, _that_does_not_ take care of the operational 
responsibilities of running a firewall. There is a trend towards 
outsourcing that as well, and like the home security business, you'll 
probably see that grow over the next few years.

> as for what i this is a good wall... thats debatable but i have seen total
> non techs configure the Guardian 2.2 with NAT from the manual (although i

I've seen a lot of people configure a lot of products from the manual,
just to open up something boneheaded because _they_don't_have_a_clue_. 

> not a firewall reseller (unlike most folks who i have seen take part in this
> debate)

Funny, I just went back over the messages in this thread, and I didn't 
see as many resellers as non-resellers. I'm _neither a reseller nor a 
consultant_ if you want to start casting aspersions.

Now perhaps we can get back to NTSEC? 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280


Hello,

> Good luck. I have tried and tried to stop this subscription and I keep
> getting an automated "unrecognized command" response. Does anyone
> really know how to get off of this list? or is this just a cruel joke
> with no exit?

 Majordomo is automated. If you don't give it the proper commands,
it will give you and automated error message.

 I have a large number of people who successfully subscribe or
unsubscribe every day. I also use several off site test account and
subscribe and unsubscribe weekly to monitor response time and check for
errors. If you will please send me your "unrecognized command" message,
I would be glad to look at it and see what you are doing wrong.

> >-----Original Message-----
> >From: Freya Lynn Johnson [SMTP:cmjchuck@swbell.net]
> >Sent: Friday, August 22, 1997 9:35 PM
> >To: ntsecurity@iss.net
> >Subject: [NTSEC] stop subscription
> >
> >I simply do not have time to read the volume of ntsecurtiy mail that I get in
> >a ordinary day. I need to stop receiving NTSEC newsletter. Thank 
> >you. Charles Johnson
> >CMJChuck@SWBell.net

 For both of you, the correct way the unsubscribe from the list
is to send a message to "majordomo@iss.net" with the following commands
in the body.

unsubscribe ntsecurity
end

 Spelling counts, case does not. To minimize the possibilities
of random acts of terrorism by various non-standard mailers, I highly
recommend typing a new message and making sure the commands begin in
column one. The "end" command is optional but cut's out any noise
if your mailer inserts a signature after your message.

 Mike
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
At 09:27 AM 8/22/97 -0400, Russ wrote:

>Is there a purpose to this smear campaign against Check Point
>Firewall-1? Why is it that you continually fail to mention the "certain
>brand of state firewall"? 

I questioned 'Checkpoint' once on the firewall list three months ago, and it
was a FOCI* issue which most people, including you, turned out to be totally
clueless about. I questioned NCSA's page on 'state' in FW-1 v2.1 this
month, since state primarily appeared in v3.0. That does not constitute a
'smear campaign'. 

>I TRUST CHECK POINT FIREWALL-1.


"Jane you ignorant slut." - Belushi, SNL. 

You have a for your obvious bias? You just dropped several points on the
respectability scale. You spend all your time with NT security, and you
don't trust it, but you do trust FW-1 without knowing anything about it? No
respectable security expert will trust something they don't know everything
about. The default for firewalls is to explicitly deny everything, the
default for security professionals is to explicitly not trust anything.

You're stupid if you do (unless they prove or fix the technology), and that
casts doubt on any other recommendations you make. Russ, get off it.
That's as stupid as trusting Active-X, and telling folk to just let it
through since you curently don't know a way to bypass 'signing' which is
supposed to indicate trustability. I submit that a way to do that is known,
used, and undisclosed.

_Real_ security folk trust nothing. They don't tell their customers to
blindly trust security products. Do you? I was told about and found an
article about hackers breaking into and stealing a bit of source code from a
state-based firewall. Frank Willoughby (fortified.com) faxed it to me,
David Hollis (securecomputing.com) gave me the correct publisher and date,
and I put it on a page to prove the article was not mythical. It _happened_
to be a Checkpoint firewall that was broken through. Checkpoint is not the
only state-based firewall on the market.

I see no reason why the average company should not trust Checkpoint, the
company. However I don't trust state-based or packet filtering 'firewalls'
regardless _who_ provides it. I would not replace a proxy firewall with
Cisco's PIX or any other state-based filter. I doubt that these fully
protect (pre-sp3) NT boxes from IP Frag, OOB, DNS attacks, or CPU attacks.
You even stated in the firewall list:

 "but granted, stateful inspection is not the answer for every question."

 "If a company chooses to implement a Firewall without examining source
code, or knowing that some huge group of people (whom they may, or may
not know) has examined it on their behalf, then maybe they don't have
the expertise to understand the nuances or the industry insight to know
who does."

I also agree 100% with Paul Robertson and Jerry Taylor. They display the
traits required by security professionals. My customers in and around
Silicon Valley are BoA, WFB, Intel, finanical institutions, AMD, Nat'l Semi,
PacBell, and others. If you said you trusted a immature technology to for
their core MIS functions, they'd thank you for your time and politely walk
you out. 

I await another typical, annoying, long-winded, rambling, venting, baseless,
non-contributory reply from your hair-trigger flame thrower.

Bill Stout

*Thanks Taylor, for the official U.S. Government phrase I was looking for.
"Foreign Ownership, Control, or Influence, (FOCI)." An issue that typically
is only understood by present or former government or military personnel.
 ______________________________________________________________
 **** Prepare for NTExploits II. Biggest list yet. *****
 Note: I don't spend all my time with only security issues. 

Any suggestions for an NT-based, FTP server software that will handle 5K
users off the bat, and grow to 1M users? 'Only' 25 - 5,000 users will be
logged in concurrently. I can't have any of this 'restart the FTP service
to apply password changes' lameness.

The 5,000 users and 25 concurrent sessions are the most probable, though the
server does have a FDDI connection to an internet exchange.

UNIX ftp servers are a standby option, but account managability is an issue.

Bill Stout

-----BEGIN PGP SIGNED MESSAGE-----


I had a brilliant idea to set up NT server 4.0 on my personal laptop as a PDC 

and then have my client domain trust my PDC so that I could have access to 

ACL's directories etc without reciprocation on my part.


This worked perfectly the first time I set it up. I was able to access 

everything as Domain admin from my domain but when I packed up and went home 

the trust relationship was lost. Of course I was out of the loop when secret 

passwords were handed out, but I figured I would just delete the trust in 

user manager on both domains and reestablish.


This didn't work even though the trusting domain created the trust and 

generated a message saying that it now trusted my personal domain. Deleting 

and recreating the trust relationship isn't working. All I can think of 

doing is to call my domain something else each time I want to have the work 

domain trust me, but this seems like a tedious and worthless endeavor.


What might I be doing wrong?



-----BEGIN PGP SIGNATURE-----

Version: PGP for Personal Privacy 5.0

Charset: noconv


iQEVAwUBM/8tLsdkzYGunyULAQGR4gf/Tx/l4lKUcTWGA/oZCMEYRpmSm+tsvefG

sPVBOgbUfFnnd9qbfaQleeC/e6E/YQg7Lv+kh5lpT33baB9NwTOzLxaCOg0IzmYa

Iub5mQZIQoyoF9S2OcVREuOYsxGCrB7+qm+aT1aQJgm8n/3PueDbHhAjLMgPIwNL

L7Br1s3ojSLIs8l+R83eoJNhvncPSO6yiOT5FiO7IZ7bkpYJsYMsFcUJOYdIAS3/

HR9NVmoApTzDh4wxYHpZlSw2hq9rsPhDNJBTpZxQkoiGgqtgb69GYlVqSztRUAuw

+9K5vZXbTcs6GPaPlT3pCcL6JWuWaC9mecMNyfSPcGf6R0RtyH1w/g==

=Dyib

-----END PGP SIGNATURE-----
______________________________________

All Rights Reserved


Howard L. Bloom t/a PC-MAN

305 Earlington Road

Havertown, Pa. 19083

610-853-2828 Fax 610-622-5944

8080,0000,0000consult@pc-man.com
-----BEGIN PGP PUBLIC KEY BLOCK-----

Version: 4.5


mQENAjHfN5UAAAEIALHrGMFvJJu3PxAcg7T1Z2NFgV8u/Z7eYVkcSoc0I8bAEXJA

jndyCdd/9Xt6OhWc2uBi+WoXlusLpfCWJx1ZqL2OApQZGppIbHDKJ8+nYrhs+bmi

saicENsO3WKQ9cSBG/IBcwIFZyAbk+6AHz47A7ZNvGneWm5G7macXXyqeWiq766a

GLYwoGEiJh7zrC1E2Pa7AWuZUVNwmuKnBGnIJdBPq0L0bzDtL98aE5WWtPJE1aTr

PPh2peyiNxQIcOLtKfxJwl5Nx2ewrPwf4T7esU/NefYMCNdJtZRV+btX36iNcnRS

nUKp5wbYQUC4f7qihLcnC1IDHQuox2TNga6fJQsABRG0KUguIEhvd2FyZCBMZXdp

cyBCbG9vbSA8cGMtbWFuQG5ldGF4cy5jb20+iQEVAgUQMemIQUWh885V62ZpAQHV

mAf+ONKYTr3L92x2NEfwiPoqSxhTvUUbkcMZsWS4ZuqrMnI7fTwcs+JW55rKJeWx

4aSju/fVVkdeZWvVM/l3z0QYLfyYX5ZNwDKydDKYr6gGCk7/GWigDuzKhpYtXBRe

spyv2AKZFSJwkrpDxvESRHo+StBUSKahsICjTDI1wvrkzI+2b0/wjWHVklcwJeAf

yf+fA2x2uNGveqkHr1oesPzh5A4TW8Xku/l8TkwVOl7nvWjbVX2gcZ5v209SAyBF

Rjn0eSlfbsuHQtmqZCh299C6YGEaN7GlArVCLvnLuXE5aiWz0LWJcLM5S6XDLKFc

U1BVm+qNHL63CEAqhL/veSbw2okBFQIFEDHj6MvEquGBMmxbvQEBqWoIAKgE3NB7

MqkbipXrDj3wT2Um7Kggi0iyULmWmx8zEmSuWjjBP/qZs8F0JWCdhtG51l2Opf1n

lmodwcCSoSrdq9ySKk/XAQ1XbDLW1K1IrpU6M0LVJIJcTW+sxJncVy3DlSqLn7sp

OsODQ4EiyydU/SJQ72W1ByH8JjklUtg0A6vb5hGrfpX9rj2ESNJ4ItigihEDYDJ3

mbZttBX8X6YXZx7IKUoTGMeapdwZsfAotF1MdW3lbqTJuzI4EphvHF/UT3adTNkI

lkm3ut4N9GBJnQx+H/66cJvs1yn0Kx4YfxaDzv5Q6GxAe4y8I8hzCgsDwpQI3TDY

6qnh4QwFTSTP3oSJAJUCBRAx4BcnKvdwrj+Z8FEBATP9BACeUZNG0n+Hc7mv6ol5

0NhrqY+b+pnMqzVgmicLu09+IUdJ1KbXQRvr2CgkC0cNZN/cG0/qfQHocKN/NZIl

3cD57vhPnm/WS3yjEJZhgkwqKYCETxHPwfkpRyLROz/c5TtHOTGY6aGR8L5bP/Ik

om9622kqPfXnLHq6qew+0Phtr4kBFQIFEDHgFv3HZM2Brp8lCwEBQ/8H/RQSvm62

CAqayRdDpWa9Jg3obfUGYzpZR2dVr/uQSfna4y3h0Zl+ZM3B338Q1OsxgbVlLIMQ

Xtt+kPs3g2/e0/ly+Z8jXbCctdjfaSQ7jN0Lzx26x4WWVoAFjlJoGxc5zXRzrpTt

aflf75QUkIP0uQ+V+sFUT3xbc88qxE0qNjLlD2Ibcl1v5yZLVdEmP7YLYXTfmVul

rpRB852eMLx0ev+BLCG+OC1xWCyF9Qau6Z3FhXULxQrHYZ7NEzRfSqi8znDheUYt

eDrVR3j/+oLCaTjwEtm6QyvM2r0wQrFekEOS7JKRymSQnWhz7jpSDu9h4HVBcs0e

kD3q2gIz2iin9D+JARUCBRAx3zwb6BRr/1d/QH0BAS3+B/9Gip/v1zQYq8xSalb6

aGZVwLQeHG01kyfRlfZcFYzimwHJCvRtuwZBvNCgThJrqFaIskaj+YAJMUiibWpC

Ta/eM6NitupNGQBObbBLHFyqBploAL+iwNsRN4RxCbICyCkXc0pxpPsRk3VIhmVb

gWTdw79TZv3ZSFsKxbTaispmMrH9knZeOKYzUvyCghy5Kfmx9RSMbJs5MKNBk81q

toe6c0ZHtqRoiuYve9Xp3vfejxq2snBwlUvWPCZNM3zMmDr8Aoj+mQBqygGzG76+

MsDRD9BBezvxwEHVAvyhCmpSUSn/nZ390L6OVu7feR1OFMCV7Cffvy2OXQ/JLq//

Czto

=bnEf

-----END PGP PUBLIC KEY BLOCK-----





On Tue, 19 Aug 1997, Patrick Donker wrote:

> osiris@pacificnet.net wrote:
> > 
> > Never! You will remain on this list for the rest of your natural life!!!
> 
> Well, if you ask me, I am braindead already....Can't even figure out how
> to leave this list ;)))
> (I do now, some 50 people replied)
> 
> Thanks all!

Glad to hear that you're still alive, after we black-iced your favorite 
porn site ...

Hello ,
Does anyone know Isn't there a product for NT4.0 with IIS3.0
 to allow users to change their passwords online? 
If so please tell me 
Thanks.

Gerasim
E-Mail: gerasim@tetra.bg


We are looking for a service which will allow us to manage NT 4.0
Workstations through Novell NDS. I have already tried out Novell
Workstation Management and Novell NT Administrator, and looked into the
Netvision Products.

Currently we run 25 or so NT boxes with NO services loaded with the
exception of the Novell Client Services (Novell's, not Microsoft's.) In
other words, we are not running an NT network.

The Novell products, and I believe the Netvision Synchronicity Products as
well, require you to run the normal NT network services, ie Workstation,
Server, Computer Browser, NetBIOS Interface, RPC. The product then
provides password and account synchronicity between this and Novell NDS.

Is anyone aware of a product which is a standalone service which does
password and account synchronization with Novell and DOES NOT require you
to use the NT services? 

Don Baker
Computer Services Group dbaker@arri.uta.edu
Automation & Robotics Research Institute (817) 272-5906
University of Texas at Arlington (817) 272-5952 fax 



Gerisim,

If you use Cold Fusion, I have a simple tag called CFX_ChangePass 
available at http://www.beluga.com/freebies/ .

Keep in mind that the passwords are passed as clear text, not a
particularly good thing.

-Matthew

At 12:39 AM 8/24/97 +0300, you wrote:
>Hello ,
>Does anyone know Isn't there a product for NT4.0 with IIS3.0
> to allow users to change their passwords online? 
>If so please tell me 
>Thanks.
>
>Gerasim
>E-Mail: gerasim@tetra.bg
>
>


BUG WARNING

Last year a friend of mine upgraded GirlFriend 1.0 to Wife 1.0 and 
found
that it's a memory hog leaving very little system resources for other
applications. He is only now noticing that Wife 1.0 also is spawning
Child-Processes which are further consuming valuable resources. No 
mention
of this particular phenomena was included in the product brochure or 
the
documentation, though other users have informed him that this is to 
be
expected due to the nature of the application. Not only that, Wife 
1.0
installs itself such that it is always launched at system 
initialization
where it can monitor all other system activity. He's finding that 
some
applications such PokerNight 10.3, BeerBash 2.5 and PubNight 7.0 are 
no
longer able to run in the system at all, crashing the system when 
selected
(even though they always worked fine before). At installation, Wife 
1.0
provides no option as to the installation of undesired Plug-Ins such 
as
MotherInLaw 55.8 and BrotherInLaw Beta release. Also system 
performance
seems to diminish with each passing day.

The feature he'd like to see in the upcoming Wife 2.0 include:

- A "Don't remind me again" button;
- Minimize button;
- An install shield feature that allows Wife 2.0 to be installed with 
the
option to uninstall at anytime without the loss of cache and other 
system
resources;
- An option to run the network driver in promiscuous mode which would 
allow
the systems hardware probe feature to be much more useful.

I myself decided to avoid all of the headaches associated with Wife 
1.0 by
sticking with GirlFriend 2.0. Even here, however, I found many 
problems.
Apparently you cannot install GirlFriend 2.0 on top of GirlFriend 
1.0. You
must uninstall GirlFriend 1.0 first. Other users say this is a long 
standing
bug which I should have been aware of. Apparently the versions of 
GirlFriend
have conflicts over shared use of the I/O port. You think they would 
have
fixed such a stupid bug by now. To make matters worse, the uninstall 
program
for GirlFriend 1.0 doesn't work very well leaving undesirable traces 
of the
application in the system.

Another thing that sucks - all versions of GirlFriend continually 
pop-up
little annoying messages about the advantage of upgrading to Wife 
1.0.

UNDOCUMENTED BUG

Wife 1.0 has an undocumented bug. If you try to install Mistress 1.1 
before
uninstalling Wife 1.0, Wife 1.0 will delete Microsoft Money files 
before
doing the uninstall itself. Then Mistress 1.1 will refuse to install,
claiming insufficient resources.

BUG WORK-AROUNDS

To avoid the above bug, try installing Mistress 1.1 on a different 
system
and never run any file transfer applications such as LapLink 6.0. 
Also,
beware of similar shareware that have been known to carry viruses 
that may
affect Wife 1.0.

Another solution would be to run Mistress 1.0 via a UseNet provider 
under an
anonymous name. Here again, beware of the viruses which can 
accidentally be
downloaded from the UseNet.
At 10:43 AM 8/23/97 -0700, Bill Stout allegedly wrote:

>Any suggestions for an NT-based, FTP server software that will handle 5K
>users off the bat, and grow to 1M users? 'Only' 25 - 5,000 users will be
>logged in concurrently. I can't have any of this 'restart the FTP service
>to apply password changes' lameness.
>
>The 5,000 users and 25 concurrent sessions are the most probable, though the
>server does have a FDDI connection to an internet exchange.
>
>UNIX ftp servers are a standby option, but account managability is an issue.
>
>Bill Stout


Bill,

Typically, I see that the planned number of users & concurrent sessions 
tends to be exceeded in a fairly short period of time. If the company 
gets a lot of attention in the media, or comes with a popular new Internet
toy, the FTP server could see a sudden load which would dwarf its average
or projected peak utilization. I tend to plan for unexpected peak loads 
(and steadily increasing normal usage) when I design network security 
solutions.

Given the sluggishness of NT's performance (particularly when compared to
other Operating Systems), I would venture that the only NT solution which 
would be capable of efficiently handling peak loads and the number of users
you specified would be on an Alpha Server (stuffed to the gills with memory).
(Of course, an Alpha Server running Unix would be even faster. However, then
we wouldn't have all of the other benefits that NT has over Unix systems).

Best Regards,


Frank
The opinions of the author of this mail may not necessarily be 
representative of the opinions of Fortifed Networks, Inc.

Fortified Networks, Inc. - http://www.fortified.com/
Expert (vendor-neutral) Computer and Network Security Consulting
Phone: (317) 573-0800 Fax: (317) 573-0817
> (Of course, an Alpha Server running Unix would be even
> faster. However, then we wouldn't have all of the other
> benefits that NT has over Unix systems).

... such as stability, scalability, maturity, and
interoperability?

--
Simon (sjm@condor.com.au)

turn around, look at what you see...
 ... in her face, the mirror of your dreams
Some other logon types defined:

2 Interactive
3 Network
4 Batch
5 Service
6 Proxy
(0 & 1 are invalid)

I've noticed that Type-3 logons are triggered extensively via the 
KSECDD logon process. This is a Device that is loaded under NT. 
 Even looking at the Event log of another machine will trigger this 
type-3 logon in that computers' event log. I would really like a 
detailed explanation of what this KSECDD process is, and what NT 
processes use it.

Event ID: 528
Type: Success Audit
Category: Logon\Logoff

 Successful Logon:
 User Name: RONNIE
 Domain: DOMAINA
 Logon ID: (0x0,0x2FDAB1)
 Logon Type: 3
 Logon Process: KSecDD
 Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Workstation Name: \\RONNIEHOME

Ronnie Bouchon, MCSE, CNE
Infrastructure Systems Engineer
SAS Institute, Infrastructure Support Team
919-677-8000 x4367 | snorjb@wnt.sas.com


-----Original Message-----
From: Frank Heyne [SMTP:fh@Rcs1.urz.tu-dresden.de]
Sent: Monday, August 25, 1997 8:53 AM
To: Allan Bourdius
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] Logon Type?

In my logs of event 528 type 2 seems to be a local logon.
When exactly do you get a type 1 event?

Other known types:
4 - Batch
5 - Service

On 25 Aug 97 at 8:11, Allan Bourdius wrote:

> Does anybody know where I can find a list of the "Logon Type" codes
> found in audits in the Security Log for Logon/Logoff entries (Event
> 528, etc.)? I've looked in the KB, Resource Kits for both 3.51 &
> 4.0, the 3.51 manual set, etc. to no avail.
>
> >From just looking at the logs, I've figured out that Type 1 is a 
console
> login, Type 3 is a network interactive login, and Type 7 is
> unlocking the workstation, but it would really help to know all of
> them.
>
> Thanks!
>
> Allan
> 
--------------------------------------------------------------------
> - All new computing problems must be reported to the Help Desk.
> 
--------------------------------------------------------------------
> - Allan Bourdius Help Desk: (412) 742-7444
> System Administrator (NT Servers) Direct: (412) 742-7409
> Information Systems & Services Main: (412) 742-4444
> FORE Systems, Inc. Fax: (412) 742-7300
> 1000 FORE Drive Email: abourdiu@fore.com
> Warrendale, PA 15086-7502 URL:
> http://www.fore.com "At the FOREfront of ATM internetworking - The
> ATM Experts." Personal URL:
> http://www.geocities.com/CapitolHill/8260/

Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/

Vin McLellan gave a most illuminating response on this one
concerning SecurID and PPTP when used in a Client-to-Server
PPTP environment - but how can we get an equivalent level
of security (one-time password) when running in a Server-
to-Server PPTP environment as supported by Microsoft's
new Routing & RAS product.

Kind Regards,
--
Phil.Parker@jdc.dk JDC - makes IT easy
ADP Dealer Services Denmark A/S Switchboard +45 7941 6400 ext 6604
Haeldagervej 165 Direct +45 7941 6604
DK-7100 Vejle, DENMARK FAX +45 7941 6411

>----------
>
> Simon Yeo queried the Listocracy:
>
>>Speaking of PPTP, does anybody know if there is a one-time password
>>device/implementation for MS-PPTP? I don't think Security Dynamics is
>>even considering this...
>
> Oh, I think the NT user community is important enough that SDTI
>paused to "consider" PPTP;-) Jeeeze, how could they not?

TEXT DELETED
>
Lots of.... Just a few seconds after install in SP3 on 2 machines, both stopped accessing the network... 

----- Mensagem original -----
De: Mark Curphey [SMTP:m.curphey@rhbnc.ac.uk]
Enviada em: Saturday, August 23, 1997 8:18 AM
Para: 'ntsecurity@iss.net'
Assunto: [NTSEC] SP3

Does anyone have any experience of SP3 creating instabilty in a system? Particularly with regard to anti-virus products.

Regards,

______________________________________
Mark Curphey
Insight Consulting
Churchfield House
The Quintet
Churchfield Road
Walton on Thames
Surrey
KT12 2TZ

Tel 01932 - 241000
Fax 01932 - 244590
Mobile 0410 - 034066
E Mail MarkC@insight.co.uk
E Mail m.curphey@rhbnc.ac.uk
World Wide Web www.insight.co.uk
World Wide Web www.curphey.com


On Fri, 22 Aug 1997, Darr, Connie wrote:

> Is there a way to set up a BDC so that only certain folks can log on
> locally without setting that option for the domain in user rights? I
> currently have my server set up so that the last login id is erased.
> Unfortunately someone has been unlocking my server by logging in and
> subsequently killing my backups.

Set the User Can Only Log into these Workstations screen from user
manager. List the BDC's you want them to be able to login to and the
workstations they work from, then give them the right to login to the
server from the user rights screen. *But* they'll only be able to login
to the workstations you list, and nowhere else... If I recall correctly
you can list upto 8 machines (including the BDC's...) 

Either that, or create a different account for that user that can only
login to the BDC's and put them in the correctgroup (Admins, Account Ops,
etc...) and do the above.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

Is there a registry entry for NT that will indicates if a RAS is set for
clients to access the "Entire network" or "This computer only?" 

And what about Windows '95 Dialup-?

Thanx in advance.

qp
<_

See winbase.h:
#define LOGON32_LOGON_INTERACTIVE 2
#define LOGON32_LOGON_NETWORK 3
#define LOGON32_LOGON_BATCH 4
#define LOGON32_LOGON_SERVICE 5

Regards,
Steffen

On Mon, 25 Aug 1997 14:53:13 +0200, you wrote:

:In my logs of event 528 type 2 seems to be a local logon.
:When exactly do you get a type 1 event?
:
:Other known types:
:4 - Batch
:5 - Service
:
:On 25 Aug 97 at 8:11, Allan Bourdius wrote:
:
:> Does anybody know where I can find a list of the "Logon Type" codes
:> found in audits in the Security Log for Logon/Logoff entries (Event
:> 528, etc.)? I've looked in the KB, Resource Kits for both 3.51 &
:> 4.0, the 3.51 manual set, etc. to no avail.
:> 
:> >From just looking at the logs, I've figured out that Type 1 is a console
:> login, Type 3 is a network interactive login, and Type 7 is
:> unlocking the workstation, but it would really help to know all of
:> them.
:> 
:> Thanks!
:> 
:> Allan
:> --------------------------------------------------------------------
:> - All new computing problems must be reported to the Help Desk.
:> --------------------------------------------------------------------
:> - Allan Bourdius Help Desk: (412) 742-7444
:> System Administrator (NT Servers) Direct: (412) 742-7409
:> Information Systems & Services Main: (412) 742-4444
:> FORE Systems, Inc. Fax: (412) 742-7300
:> 1000 FORE Drive Email: abourdiu@fore.com
:> Warrendale, PA 15086-7502 URL: 
:> http://www.fore.com "At the FOREfront of ATM internetworking - The
:> ATM Experts." Personal URL: 
:> http://www.geocities.com/CapitolHill/8260/
:
:Frank Heyne
:
:Nobody is perfect - sorry for not beeing nobody.
:http://rcswww.urz.tu-dresden.de/~fh/

---------------------------------------------
Steffen Krause skrause@astberlin.de
Dipl.-Inf., skrause@informatik.hu-berlin.de
Microsoft Certified Systems Engineer

Howdy,

The MS Proxy White Papers can be found on the Microsoft Web-Site !

http://www.microsoft.com/proxy/


(or didn't I understand your problem ?? )


Bart Hermus 
E-mail: Barth@wcc.nl 

WCC Services B.V
Eekholt 54; 1112 XH Diemen-Zuid
Tel: +31 (0)20-4160266 ; Fax: +31 (0)20-4160267
 We need to back up an NTFS partition on an additional server (not BDC
 or PDC) from an OS/2 workstation. We've defined a user on the domain
 as a Domain Admin, and added Domain Admins to the Administrators local
 group. We've given Domain Admins full access to all partitions. But
 when the user tries to access the files, she gets "Access Denied".
 We've made sure the OS/2 and NT userids and passwords are
 synchronized. I've even tried logging on to the Additional server and
 adding the user locally, but still no luck. Are we overlooking
 something?

 BTW, we have a similar problem accessing the additional server from a
 NT Workgroup Workstation.

 Thanks
 Duston Suits
This was a problem in Service Pack 2, which was fixed in Service Pack 3.
You need to disable you Anti-virus software, before installing SP3. We had
the same problem, just after loading SP2.

There are also TCP/IP hotfixes for SP3 on MonkeySoft's site.

At 12:46 PM 8/25/97 -0300, Rodrigo Simon Coutinho wrote:
>Lots of.... Just a few seconds after install in SP3 on 2 machines, both
stopped accessing the network... 
>
>----- Mensagem original -----
>De: Mark Curphey [SMTP:m.curphey@rhbnc.ac.uk]
>Enviada em: Saturday, August 23, 1997 8:18 AM
>Para: 'ntsecurity@iss.net'
>Assunto: [NTSEC] SP3
>
>Does anyone have any experience of SP3 creating instabilty in a system?
Particularly with regard to anti-virus products.
>
>Regards,
>
>______________________________________
>Mark Curphey
>Insight Consulting
>Churchfield House
>The Quintet
>Churchfield Road
>Walton on Thames
>Surrey
>KT12 2TZ
>
>Tel 01932 - 241000
>Fax 01932 - 244590
>Mobile 0410 - 034066
>E Mail MarkC@insight.co.uk
>E Mail m.curphey@rhbnc.ac.uk
>World Wide Web www.insight.co.uk
>World Wide Web www.curphey.com
>
>
>
>
This is an audit log record I see often also. Upon initial research,
the SeTcbPrivilege means the user is trying to act as part of the
operating system. I am not sure why though.

John

G. Richard Bellamy wrote:

> This is a failure I see often, and though it doesn't seem to be
> causing
> me any problems, I'm very curious about what it is........ sorry if
> this
> is ground already covered.
>
> Privileged Service Called:
> Server: NT Local Security Authority / Authentication
> Service
> Service: LsaRegisterLogonProcess()
> Primary User Name: SYSTEM
> Primary Domain: SYSTEM
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: JoeAdminUser
> Client Domain: ADOMAIN.COM
> Client Logon ID: (0x0,0x15B1)
> Privileges: SeTcbPrivilege
>
> G. Richard Bellamy
> http://www.intlcafe.com
> mailto:richard@intlcafe.com
> VOX:707.887.8814
> FOX:707.887.1810
> _,.-~-.,__,.-~-.,__,.-~-.,__,.-~-.,_
> I am coffee of Borg.
> Instant is futile.
> You will be percolated.
> _,.-~-.,__,.-~-.,__,.-~-.,__,.-~-.,_
> p_priority=PFUN+(p_work/4)+(2*p_cash)





>-----Original Message-----
>From: Phil.Parker@jdc.dk [SMTP:Phil.Parker@jdc.dk]
>Sent: Wednesday, August 20, 1997 1:58 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Securing NT for dedicated IIS
>
>Hello,
>
>Does anyone have any comments to the following proposal for securing a
>standalone NT Server running as a dedicated web server (www, ftp and
>gopher) with no "file and print services" (for access to/from other
>boxes). In particular, concerning the "Net Logon" and "Workstation"
>services.
>
>[CP] 
> 
>Control Panel/Network/Bindings:
>
>Disconnect the "NetBIOS Interface", the "Server" and the "Workstation"
>from the "WINS Client(TCP/IP)"
>
>[CP] You shouldn't have any problems going one step farther and disabling
>the "WINS client(TCP/IP)" from the adapter. If you do that, you may also be
>able to disable "WINS Client" in devices.
>
>Chris
>--
>Phil.Parker@jdc.dk JDC - makes IT easy
>ADP Dealer Services Denmark A/S Switchboard +45 7941 6400 ext 6604
>Haeldagervej 165 Direct +45 7941 6604
>DK-7100 Vejle, DENMARK FAX +45 7941 6411
In my logs of event 528 type 2 seems to be a local logon.
When exactly do you get a type 1 event?

Other known types:
4 - Batch
5 - Service

On 25 Aug 97 at 8:11, Allan Bourdius wrote:

> Does anybody know where I can find a list of the "Logon Type" codes
> found in audits in the Security Log for Logon/Logoff entries (Event
> 528, etc.)? I've looked in the KB, Resource Kits for both 3.51 &
> 4.0, the 3.51 manual set, etc. to no avail.
> 
> >From just looking at the logs, I've figured out that Type 1 is a console
> login, Type 3 is a network interactive login, and Type 7 is
> unlocking the workstation, but it would really help to know all of
> them.
> 
> Thanks!
> 
> Allan
> --------------------------------------------------------------------
> - All new computing problems must be reported to the Help Desk.
> --------------------------------------------------------------------
> - Allan Bourdius Help Desk: (412) 742-7444
> System Administrator (NT Servers) Direct: (412) 742-7409
> Information Systems & Services Main: (412) 742-4444
> FORE Systems, Inc. Fax: (412) 742-7300
> 1000 FORE Drive Email: abourdiu@fore.com
> Warrendale, PA 15086-7502 URL: 
> http://www.fore.com "At the FOREfront of ATM internetworking - The
> ATM Experts." Personal URL: 
> http://www.geocities.com/CapitolHill/8260/

Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/
Yes, NetBIOS Gateway entry, but that doesn't really pertain to Proxy. A
local host filter would be preferrable via R&RAS. 

> -----Original Message-----
> From: Vanek, Jim [SMTP:JVanek@hdrinc.com]
> Sent: Monday, August 25, 1997 7:16 AM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Microsft Proxy server security issues?
> 
> Is there a registry entry for NT that will indicates if a RAS is set
> for
> clients to access the "Entire network" or "This computer only?" 
> 
> And what about Windows '95 Dialup-?
> 
> Thanx in advance.
> 
> qp
> <_
No need - at least as I understand the question. 

I tend to limit SYSTEM privs and perms to a "need to be there basis". In
other words, there are lots of rexources SYSTEM does not have
permissions to do anything with in my environments. 

> -----Original Message-----
> From: Udi Kedar [SMTP:udik@aviv.co.il]
> Sent: Monday, August 25, 1997 6:10 AM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Security Group
> 
> Hi
> I posted this question before but did not see any response, so I am
> trying again.
> Can someone explain me the use of the User/Group system (The operating
> system), that appears when dealing with object (file/directory)
> security. Is there a need to put it in the Object Permission by
> default.
> Thanks in advance
> 
> 
> 

I am looking for pointers how to set up Windows NT 4.0 files
access rights and registry after an installation to
increase local security. There have been multiple
pointers to documents explaining what to change and why,
but I haven't saved them.

Please reply to my accunt, not to the list, since this is
probably a FAQ. I will summarize to the list if I get
interesting replies. 

Kristian

-- 
Kristian Koehntopp, Wassilystrasse 30, 24113 Kiel, +49 431 688897
"Where do we go from here? (no-TM)"
 -- Thomas Sivertsen
This is a failure I see often, and though it doesn't seem to be causing
me any problems, I'm very curious about what it is........ sorry if this
is ground already covered.

Privileged Service Called:
 Server: NT Local Security Authority / Authentication
Service
 Service: LsaRegisterLogonProcess()
 Primary User Name: SYSTEM
 Primary Domain: SYSTEM
 Primary Logon ID: (0x0,0x3E7)
 Client User Name: JoeAdminUser
 Client Domain: ADOMAIN.COM
 Client Logon ID: (0x0,0x15B1)
 Privileges: SeTcbPrivilege 


G. Richard Bellamy
http://www.intlcafe.com
mailto:richard@intlcafe.com
VOX:707.887.8814
FOX:707.887.1810
_,.-~-.,__,.-~-.,__,.-~-.,__,.-~-.,_
I am coffee of Borg.
Instant is futile.
You will be percolated.
_,.-~-.,__,.-~-.,__,.-~-.,__,.-~-.,_
p_priority=PFUN+(p_work/4)+(2*p_cash)


On August 24th I sent an Email to the mailing list titled 
"A NEW KIND OF BUG!".

Although I had received some positive responses many subscribers 
were not pleased to receive such kind of a letter.

I apologize to all the people who were offended by the content 
of the letter. 

I would like to clarify my intentions for sending this kind of message.

I innocently assumed that it would bring a smile to people coming 
to work on Monday morning.

The analogy between the software industry and the stereotype of marital 
institution was in my opinion rather funny. I had no intention of 
declaring any discriminating chauvinistic ideas through it. 

The mailing lists "Firewall" & "ntsecurity" helped me to understand 
many important issues related to security. I have no intention
whatsoever 
to hurt the quality and prestige of both lists

All the best,

Itai Dor-on.





Mike Stoico@METLIFE
08/25/97 01:16 PM

Does OS/2 even recognize NTFS?




DSUITS@INS084R1.STATE.IL.US on 08/25/97 07:41:11 AM

Please respond to DSUITS@INS084R1.STATE.IL.US

To: ntsecurity@ISS.NET
cc: (bcc: Mike Stoico/Bsg/MetLife/US)
Subject: [NTSEC] Backup from OS/2 Client




 We need to back up an NTFS partition on an additional server (not BDC
 or PDC) from an OS/2 workstation. We've defined a user on the domain
 as a Domain Admin, and added Domain Admins to the Administrators local
 group. We've given Domain Admins full access to all partitions. But
 when the user tries to access the files, she gets "Access Denied".
 We've made sure the OS/2 and NT userids and passwords are
 synchronized. I've even tried logging on to the Additional server and
 adding the user locally, but still no luck. Are we overlooking
 something?
 BTW, we have a similar problem accessing the additional server from a
 NT Workgroup Workstation.
 Thanks
 Duston Suits







At 10:59 8/23/97 +0100, you wrote:
>When some products install they create a subkey with a path statement in. 
>This often points to directory locations that are writeable and executeable 
>as part of the functionality of the application. 

Fairly simple. You also lock down your registry entries to be read-only to
non-admins. In the case of the scanner, we lock down our entire registry
section, and every output and executable directory we use to admins only.
Unless you're an admin, you aren't going to even read anything belonging to
the scanner.

OTOH, we're a paranoid bunch, so...

Same principle still applies for more normal stuff, but you allow ordinary
users to read certain areas. You'd also want their output directories to
be kept in HKEY_CURRENT_USER.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Does anybody know where I can find a list of the "Logon Type" codes found
in audits in the Security Log for Logon/Logoff entries (Event 528, etc.)?
I've looked in the KB, Resource Kits for both 3.51 & 4.0, the 3.51 manual
set, etc. to no avail.

>From just looking at the logs, I've figured out that Type 1 is a console
login, Type 3 is a network interactive login, and Type 7 is unlocking the
workstation, but it would really help to know all of them.

Thanks!

Allan
---------------------------------------------------------------------
All new computing problems must be reported to the Help Desk.
---------------------------------------------------------------------
Allan Bourdius Help Desk: (412) 742-7444
System Administrator (NT Servers) Direct: (412) 742-7409
Information Systems & Services Main: (412) 742-4444
FORE Systems, Inc. Fax: (412) 742-7300
1000 FORE Drive Email: abourdiu@fore.com
Warrendale, PA 15086-7502 URL: http://www.fore.com
"At the FOREfront of ATM internetworking - The ATM Experts."
Personal URL: http://www.geocities.com/CapitolHill/8260/
I should give a few more details.

I designed the server hardware as dual Alpha 4100s running four 466MHz CPUs
each, and 1GB of RAM each. The internet feed is directly to an internet
exchange at 100MB/sec (FDDI w/4K packets). The primary function is to be a
'rated G' image server with thumbnail pages and compressed images. Digital
clustering for NT will be used over shared SCSI busses, later to be upgraded
to Wolfpack. Clustering will be used primarily for service and IP address
failover. RAID will be striped, then mirrored between the systems.

The biggest issue is large scale user management, though that will be automated.

The biggest group of users will be read-only, and theoretically can be up to
one _million_ users. Really. Only a fraction of these will be concurrently
browsing the site. A smaller group will have write access, and the most
that group is projected to be is 5,000. The number of real user accounts I
estimate at ~10,000. 5,000 for read, 5,000 for write.

Anyone have experience with MCIS Membership system?

BTW - The last message to Russ/Re: Firewalls was released by Eudora before I
was finished editing/rewording it. It came out sounding way too personal to
be professional. My apologies for the tone of the message.

Bill Stout

I'm interesred in any White Papers on MS Proxy? Or good advice.


My reply: excuse me, I'm new to the list . I will follow correct
protocols in the future.
 >I work for an MS solution provider and we are very interested
in the
 >security issues with MS Proxy. We have much of the
configuration
 >you're referring to. What is your take MS Proxy?
I've been fairly happy with it.
My reply: likewise , the network people have been happy with it. We
don't allow FTP at this point which is a issue.
 > We have a net exposed
 >to the internet with 2 MS Proxy servers and a web server
connected to a
 >external ISP router and internal router. And we don't let any
other ip
nets
 >in through our router. Through a trust relationship we've
nailed down
 >the internal communiction with our Proxy NT domain, one way
trust. The
 >PDC/Exchange srv trusts the Proxy. Communication is through an
IMC
 >connection. 
That's much like our configuration. I'm not sure that I'd give the web
Server a connection to the internal network. I still don't really trust
IIS.
My reply> the IIS web server is available using HTTP, the ways you can
address the server probably is a question. The web/proxy domain does not
trust the internal. Thinking about that ? There might be ways around
that. For instance in the untrusted domain I can : ping the proxy PC,
but not the IIS PC, from IE I can load the HTTP IP addr of IIS PC but
not a NBT SMB call form IE(net view \\ 204.3.10.3 equiv..) , On proxy
load HTTP I get proxy error make a SMB call I have file access. Can't
see much but I'm on. ?
Also, I'd make sure that everything's disabled on the proxy servers
external network cards except basic TCP/IP. You should also block the
ports that proxy server uses at the router connected to the internet.
My reply: The router I believe is owned by ISP , this is a good point.
 >Is there any documentation on MS Proxy or white papers that
someone can
 >point me to on the reliability of this product. It's a cheap
solution
 >and it seems to work in combination with routers. All the
commercial
 >tests seemed to be with the big firewall names, but nothing
about MS
 >Proxy.
I really haven't seen anything. Proxy 1.0 isn't a real firewall, and 2.0
hasn't been officially released.
My reply: The statement "isn't a real firewall" I've heard before,
this is the reason for this thread.
In conjunction with proper configured routers is this really true?

Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com 
Home: swaim@phoenix.net or maybe swaim@c-com.net, I don't know.
Disclaimer: I Lie


> ----------
> From: Ronnie Bouchon[SMTP:snorjb@wnt.sas.com]
> Reply To: Ronnie Bouchon
> Sent: Monday, August 25, 1997 7:09 AM
> To: 'Frank Heyne'; 'Allan Bourdius'
> Cc: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Logon Type?
> 
> Some other logon types defined:
> 
> 2 Interactive
> 3 Network
> 4 Batch
> 5 Service
> 6 Proxy
> (0 & 1 are invalid)
> 
> I've noticed that Type-3 logons are triggered extensively via the 
> KSECDD logon process. This is a Device that is loaded under NT. 
> Even looking at the Event log of another machine will trigger this 
> type-3 logon in that computers' event log. I would really like a 
> detailed explanation of what this KSECDD process is, and what NT 
> processes use it.
> 
(Detailed it isn't, but) KSECDD stands for "Kernel Security Device
Driver" -- it's the part of LSA that needs to be in the kernel, often
for efficiency, so that kernel based callers don't need to LPC into the
LSA.

Looking at the CSV output in Excel and the event detail screen side by side
shows the columns in this order:

Date
Time
Source
Type
Category
Event ID
User
Computer
Description (which may be wrapped to multiple lines/fields in Excel due to
carriage returns)

HIH,
Erik

 *----------------------------*
 |Erik P. Sojka |
 |Network Administrator |
 |SCT Manufacturing Systems |
 |esojka@sctcorp.com |
 *----------------------------*

**REPLY SEPARATOR**




morganw@gcnet.com on 08/25/97 10:05:14 AM

Please respond to morganw@gcnet.com

To: ntsecurity@iss.net
cc: (bcc: Erik Sojka/MDS/SCT)
Subject: [NTSEC] NT Logs




Recently I've had to review NT 4.0 logs. I've imported the comma delimited
file into Excel for investigative purposes, but I need to find the what
each
column represents (other than the obvious date/time, etc...) I've looked
into manuals, and the like to no avail. Any source where all the entries
are
decoded? Or will Event Viewer give me what I need? Thanks.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Morgan Wright Mailto:morganw@gcnet.com
Forensic Computer Specialist Phone: 316.271.0040
2021 Mohawk Fax: 316.271.0040
Garden City, KS 67846-3833 http://www.gcnet.com/mwa/
 ICQ#: 2206768
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PGP Public Key available from:
http://www.pgp.com/keyserver/pks-toplev.cgi
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







Recently I've had to review NT 4.0 logs. I've imported the comma delimited
file into Excel for investigative purposes, but I need to find the what each
column represents (other than the obvious date/time, etc...) I've looked
into manuals, and the like to no avail. Any source where all the entries are
decoded? Or will Event Viewer give me what I need? Thanks.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Morgan Wright Mailto:morganw@gcnet.com
Forensic Computer Specialist Phone: 316.271.0040
2021 Mohawk Fax: 316.271.0040 
Garden City, KS 67846-3833 http://www.gcnet.com/mwa/
 ICQ#: 2206768
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PGP Public Key available from: 
http://www.pgp.com/keyserver/pks-toplev.cgi
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hi

I posted this question before but did not see any response, so I am trying again.

Can someone explain me the use of the User/Group system (The operating system), that appears when dealing with object (file/directory) security. Is there a need to put it in the Object Permission by default.

Thanks in advance

Hi

I posted this question before but did not see any response, so I am trying again.

Can someone explain me the use of the User/Group system (The operating system), that appears when dealing with object (file/directory) security. Is there a need to put it in the Object Permission by default.

Thanks in advance

Mike Stoico@METLIFE
08/25/97 10:18 AM

We have a PDC and a BDC that we are thinking of separating between a
firewall (fw-1). Has anyone tried this and what are the rules that need to
be set up so that they can talk to each other?
Mike Stoico


To: NTSECU1 --INTERNET ntsecurity@iss.net


We recently had a look at the recoverability of NT Server 4.0 DHCP service.
I'm not impressed.

The reskit covers troubleshooting/restoring the DHCP database. But we are
concerned with recovering the service following the loss of the server or its
hard drive.

In my naivete I had assumed that the copying of files from a backup of the
\systemroot\SYSTEM32\DHCP directory to the same location on the new server
would restore the DHCP service. Not so. It seems that these files only contain
active lease information.

To recover your service on a different server you must first recreate all
global settings, exclusion ranges etc. This is no small task for an
organization gradually converting to dhcp from statically assigned IP
addresses.

In converting to DHCP, our approach has been (of necessity) to serve the same
address blocks that had been statically assigned. Thus when a group of
addresses are retired from the list of static addresses, they are dropped from
one or more dhcp exclusion ranges and become available for lease to the next
group undergoing conversion. The resulting plethora of changing exclusion
ranges seems to exist solely in the registry of the dhcp server.

We had a go at exporting all the dhcp registry entries for later import but I
have concerns about this approach. How inter-operable is the registry
structure between versions (and patch levels) of NT Server? How can we be sure
we find all pertinent registry entries?

Is there a better way? What am I missing?

Regards,
Dann
**** This is a personal expression of the author and not ****
**** an official representation of the author's employer. ****
There are at least 2 methods

Here is the one I have used most

The DHCP server creates a backup of the database file and the registry
hive which contain the scopes every 15 minutes by default. 
These files are stored in $SYSTEM\system32\dhcp\backup.

Stop DHCP on the old and new servers.
Copy the backup directory to the new server
set the DHCP registry setting "restore" to 1
start the dhcp service

The backup database and configuration keys are then restored.

You can also just copy the whole dhcp directory while the servcice is
stopped but then you have to manully save and restore the
DHCP\Configuration portion of the registry.


Dave 




> -----Original Message-----
> From: Dann Mogg DRMOGG@BCSC02.GOV.BC.CA (604)252-3448 fax-3450
> [SMTP:DRMOGG@BCSC02.GOV.BC.CA]
> Sent: Monday, August 25, 1997 9:00 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] DHCP recovery
> 
> To: NTSECU1 --INTERNET ntsecurity@iss.net
> 
> 
> We recently had a look at the recoverability of NT Server 4.0 DHCP
> service.
> I'm not impressed.
> 
> The reskit covers troubleshooting/restoring the DHCP database. But we
> are
> concerned with recovering the service following the loss of the server
> or its
> hard drive.
> 
> In my naivete I had assumed that the copying of files from a backup of
> the
> \systemroot\SYSTEM32\DHCP directory to the same location on the new
> server
> would restore the DHCP service. Not so. It seems that these files only
> contain
> active lease information.
> 
> To recover your service on a different server you must first recreate
> all
> global settings, exclusion ranges etc. This is no small task for an
> organization gradually converting to dhcp from statically assigned IP
> addresses.
> 
> In converting to DHCP, our approach has been (of necessity) to serve
> the same
> address blocks that had been statically assigned. Thus when a group of
> addresses are retired from the list of static addresses, they are
> dropped from
> one or more dhcp exclusion ranges and become available for lease to
> the next
> group undergoing conversion. The resulting plethora of changing
> exclusion
> ranges seems to exist solely in the registry of the dhcp server.
> 
> We had a go at exporting all the dhcp registry entries for later
> import but I
> have concerns about this approach. How inter-operable is the registry
> structure between versions (and patch levels) of NT Server? How can we
> be sure
> we find all pertinent registry entries?
> 
> Is there a better way? What am I missing?
> 
> Regards,
> Dann
> **** This is a personal expression of the author and not ****
> **** an official representation of the author's employer. ****
> From ntsecapi.h, available in the security subdirectory on the Win32
> SDK CD:
> 
> //
> // Used by a logon process to indicate what type of logon is being
> // requested.
> //
> 
> typedef enum _SECURITY_LOGON_TYPE {
> Interactive = 2, // Interactively logged on (locally or
> remotely)
> Network, // Accessing system via network
> Batch, // Started via a batch queue
> Service, // Service started by service controller
> Proxy, // Proxy logon
> Unlock // Unlock workstation
> } SECURITY_LOGON_TYPE, *PSECURITY_LOGON_TYPE;
> 
> 
> 
 Phil Parker <Monaco>
asked:


>Vin McLellan gave a most illuminating response on this one

>concerning SecurID and PPTP when used in a Client-to-Server

>PPTP environment - but how can we get an equivalent level

>of security (one-time password) when running in a Server-

>to-Server PPTP environment as supported by Microsoft's

>new Routing & RAS product.


 If talk of a mixed marrage isn't heresy on this List, check out
F-Secure, the commercial version of Ssh (Secure Shell), or the
Ssh-based VPN, both from Datafellows: < 
They have a Win/NT Ssh client, but you'd your installations would also
require a secure SSh Unix server hung off the side on a PC. 

 

 I believe Datafellows also has an NT F-Secure server due soon, maybe
even beta -- but you'd have to get details from someone more informed
than I. 


 Since the Ssh development team is in Finland, you wouldn't have to
worry about the US regs controling the export of decent crypto to
non-Americans. (If necessary, your American correspondents can import
the Ssh or F-Secure crypto package -- 1012 RSA and IDEA/3xDES/Blowfish
-- freely into the US.) 


 Ssh is also about to become an IETF standard. There are three
interesting draft RFCs on Ssh by Tatu
YlonenMonaco that you might want to review.


 The Ssh/F-Secure Server spins along quite nicely (16 Mbit/s) on a
Pentium 120. If anyone has a suggestion with better price/performance,
I'd be interested in hearing about it. 


 Suerte,

 _Vin

 Vin McLellan + The Privacy Guild + <

 53 Nichols St., Chelsea, MA 02150 USA <<617> 884-5548

 -- <<@><<@> --


I have this problem too but only on Domain Controllers. Seems to work
on stations.

 ---
 Jean-Claude Berger
 Systems and RDBMS consultant (MCSE), Lyon, France
 E-mail : jcberger@imaginet.fr, Compuserve : 100305,2436


-----Original Message-----

I am having a problem getting a DDE session started. As Admin I have no
problems starting the session, but as a user I can not start it. 

When you rename a file or a directory NT acts as if it deleted the file and then 
recreated it. So you need the right to delete your directory (D) on the left list of
permissions of the directory itself OR full control on the container directory 
AND at least the RWX on the container directory (repectively for deleting and
adding).

Hope this helps.

 ---
 Jean-Claude Berger
 Systems and RDBMS consultant (MCSE), Lyon, France
 E-mail : jcberger@imaginet.fr, Compuserve : 100305,2436


-----Original Message-----

One of the main directory I set it with the administrators 
have full control on it together with all the 
subdirectory in it. But when I want to rename it, a window pop up 
saying that Cannot rename training. Access is denied.




I have an NT server running IIS for anonymous FTP users

going to /inetpub/ftproot fore various PUBLIC files but 

I also have the need for the "Administrator" account to 

be able to access the whole disk.


Currently, I setup "Virtual Dir" called "adminroot" in the IIS

tool that will let me get to the C:\. Though all users can't 

see this directory, both the Administrator and anonymous FTP 

logins.. can CD to it! ACK! Big problem.


How can I restrict only Administrator users to getting to

the C:\ directory?


Thanks,








^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

** Sami Mousa, 
ffff,0000,0000FORE ATM(WAN) Certified 
**

** International Network Services Office: (908)603-8541 x320 
 **

** Network Systems Engineer e-mail: sami_mousa@ins.com 
 **

** 120 Wood Ave South Pager: (888)896-4064 
 **

** Suite #615 Fax: (908)548-5630 
 **

** Iselin, New Jersey 08830 www.ins.com 
 **

=============================================================================

 "My statements in this message are personal opinions \

 which may have no basis whatsoever in fact."








I have an NT server running IIS for anonymous FTP users


going to /inetpub/ftproot fore various PUBLIC files but 


I also have the need for the "Administrator" account to 


be able to access the whole disk.



Currently, I setup "Virtual Dir" called "adminroot" in the IIS


tool that will let me get to the C:\. Though all users can't 


see this directory, both the Administrator and anonymous FTP 


logins.. can CD to it! ACK! Big problem.



How can I restrict only Administrator users to getting to


the C:\ directory?



Thanks,









^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

** Sami Mousa, 
ffff,0000,0000FORE ATM(WAN) Certified 
**

** International Network Services Office: (908)603-8541 x320 
 **

** Network Systems Engineer e-mail: sami_mousa@ins.com 
 **

** 120 Wood Ave South Pager: (888)896-4064 
 **

** Suite #615 Fax: (908)548-5630 
 **

** Iselin, New Jersey 08830 www.ins.com 
 **

=============================================================================

 "My statements in this message are personal opinions \

 which may have no basis whatsoever in fact."





Has anyone done a relative risk comparison between the Microsoft client
for Novell networks versus using the Novell client software for NT?
(Intranetware)

While I believe there are various (well-known?) risks with either of the
two client packages, due to password cacheing, or the presence (or lack
of) GINA-related registry entries, I do not recall ever seeing a direct
comparison of the strengths or weaknesses of the two clients.

alan





Mike Stoico@METLIFE
08/26/97 08:49 AM

I did not know that, (it's been years since I dealt with OS/2). I knew it
couldn't deal with an NTFS partition directly, but I wasn't sure if it
could deal with it as a share, thanks for the insight
Mike




RLesh@icfkaiser.com on 08/25/97 05:54:58 PM

To: Mike Stoico/Bsg/MetLife/US
cc:
Subject: RE: [NTSEC] Backup from OS/2 Client





Mike -
That's a bit of an open ended question.
An OS/2 machine cannot read an NTFS partition directly. But an OS/2
client can access a network share that happens to be on an NTFS
partition.
An NT machine can read an HPFS partition directly.
 --Dick.
Rlesh@icfkaiser.com
 -----Original Message-----
From: Mike Stoico [SMTP:mstoico@metlife.com]
Sent: Monday, August 25, 1997 1:42 PM
To: ntsecurity
Subject: Re: [NTSEC] Backup from OS/2 Client





Mike Stoico@METLIFE
08/25/97 01:16 PM
Does OS/2 even recognize NTFS?



DSUITS@INS084R1.STATE.IL.US on 08/25/97 07:41:11 AM
Please respond to DSUITS@INS084R1.STATE.IL.US
To: ntsecurity@ISS.NET
cc: (bcc: Mike Stoico/Bsg/MetLife/US)
Subject: [NTSEC] Backup from OS/2 Client



 We need to back up an NTFS partition on an additional server (not
BDC
 or PDC) from an OS/2 workstation. We've defined a user on the
domain
 as a Domain Admin, and added Domain Admins to the Administrators
local
 group. We've given Domain Admins full access to all partitions.
 But
 when the user tries to access the files, she gets "Access Denied".
 We've made sure the OS/2 and NT userids and passwords are
 synchronized. I've even tried logging on to the Additional server
and
 adding the user locally, but still no luck. Are we overlooking
 something?
 BTW, we have a similar problem accessing the additional server from
a
 NT Workgroup Workstation.
 Thanks
 Duston Suits







 ------ Message Header Follows ------
Received: from rs60003.icfkaiser.com by va01gtw1.icfkaiser.com
 (PostalUnion/SMTP(tm) v2.1.8d for Windows NT(tm))
 id AA-1997Aug25.131655.1474.543351; Mon, 25 Aug 1997 13:16:56 -0400
Received: from iss.net by relay1.UU.NET with SMTP
 (peer crosschecked as: phoenix.iss.net [208.21.0.5])
 id QQdedp27255; Mon, 25 Aug 1997 13:28:30 -0400 (EDT)
Received: (qmail 27898 invoked by alias); 25 Aug 1997 17:18:33 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 27892 invoked by alias); 25 Aug 1997 17:18:33 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 27887 invoked by uid 15); 25 Aug 1997 17:18:32 -0000
Received: (qmail 27882 invoked from network); 25 Aug 1997 17:18:31 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 25 Aug 1997 17:18:31 -0000
Received: from MetGwy02.metlife.com (ms.metlife.com [204.146.159.1]) by
arden.iss.net (8.8.7/8.7.3) with SMTP id NAA14154 for
;
Mon, 25 Aug 1997 13:19:28 -0400
Received: by MetGwy02.metlife.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))
 id
852564FE.005EBB2B ; Mon, 25 Aug 1997 13:14:42 -0400
X-Lotus-Fromdomain: METLIFE@METLIFENET
From: "Mike Stoico" 
To: ntsecurity@ISS.NET
Message-Id: <852564FE.005ECCED.00@MetGwy02.metlife.com>
Date: Mon, 25 Aug 1997 13:16:19 -0400
Subject: Re: [NTSEC] Backup from OS/2 Client
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: "Mike Stoico" 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to
majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to
ntsecurity@iss.net






Hi all,

I'm new here. I'm from Brazil, and sorry if I not write a good english.
Last two weeks I have problems with the WWW, FTP and Gopher Services. They
simple stop (In the services-control panel show WWW Automatic, (and the
funny, it's only in sunday). Anybody know if this is a bug??

regards,

========================================
Allan Christian Brandt - allan@netland.com.br
Sysop - Administrador da Rede
Netland Internet Providers
http://www.netland.com.br
Minas Gerais - Brazil - Phone: 0055 31 281-6434
========================================

First, ensure that privileges on the directory are defined only for the Administrator group.  Other accounts will not have privileges by default.  This will give only Administrator access to the whole disk.

Next, ensure that the default permissions "Everyone: Full Control" doesn't apply to your Virtual Dir.  This is a known, faulty default setting.  It sounds as if your VD is defined as C:\.  Are you sure that you want to establish a virtual dir to the root of C:\ rather than use the default share C$ which is already restricted?  If this is the way that you have to set it up, may I suggest auditing the share?

Hope this helps.
Paul Iglesia
Information Systems Manager
Adroit Systems Inc.
Alexandria, VA 22314

----------
> From: Sami Mousa <sami_mousa@INS.COM>
> To: ntsecurity@iss.net
> Subject: [NTSEC] FTP secuirty
> Date: Tuesday, August 26, 1997 8:07 AM
>
>
>
> I have an NT server running IIS for anonymous FTP users
>
> going to /inetpub/ftproot fore various PUBLIC files but
>
> I also have the need for the "Administrator" account to
>
> be able to access the whole disk.
>
>
> Currently, I setup "Virtual Dir" called "adminroot" in the IIS
>
> tool that will let me get to the C:\.  Though all users can't
>
> see this directory, both the Administrator and anonymous FTP
>
> logins.. can CD to it!  ACK!  Big problem.
>
>
> How can I restrict only Administrator users to getting to
>
> the C:\ directory?
>
>
> Thanks,
>
>
>
>
>
>
>
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> **   Sami Mousa,  <bigger><bigger>
> <color><param>ffff,0000,0000</param>FORE ATM(WAN) Certified
> </color></bigger></bigger>**
>
> **   International Network Services    Office: (908)603-8541 x320
>  **
>
> **   Network Systems Engineer          e-mail: sami_mousa@ins.com
>  **
>
> **   120 Wood Ave South                Pager:  (888)896-4064
>  **
>
> **   Suite #615                        Fax:    (908)548-5630
>  **
>
> **   Iselin,  New Jersey 08830                  www.ins.com
>  **
>
> =============================================================================
>
>      "My statements in this message are personal opinions \
>
>       which may have no basis whatsoever in fact."
>
>
>
>

I haven't seen this one here yet, so forwarded from Best Of Security.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

---------- Forwarded message ----------
Date: Mon, 25 Aug 1997 02:29:26 PDT
From: Attila Bartfai 
To: best-of-security@cyber.com.au
Subject: BoS: Exchange Server 5.0 POP3 Security Hole


>From the microsoft.public.exchange.clients newsgroup.

>Exchange Server 5.0 POP3 Security Hole found.
>Details at http://rajiv.org/active/
>Soon as a solution is found it will be posted there.
>________________________________________________________________
>Rajiv Pant (Betul) http://rajiv.org
>Philadelphia Online http://phillynews.com
>The Philadelphia Inquirer and Philadelphia Daily News newspapers

Details from http://rajiv.org/active

1997/Aug/20 Security Alert! MS Exchange Server 5.0 POP3 Service Password
Caching Problem. We found the following problem today and Microsoft has
successfully reproduced this bug and confirmed it to us as a possible
bug. We will hear a final answer from them tomorrow. The bug (as an
example): Create a user xyz on your NT domain with an Exchange 5.0
server with POP3 service. Set xyz's password to a1234. Things work fine
so far. Now change xyz's password to b5678. You will find that POP3 mail
clients can log in using either password a1234 or b5678 for user xyz.
Now change the password to something else. You will find that a POP3
client (or direct telnet to port 110) will allow you to log in as xyz
using any of the three passwords. They all work. The Exchange 5.0
service POP3 connector caches passwords in a non-hashing mechanism so
that all the passwords remain active. (I don't know for how long.) This
does not affect the new web page interface to get your mail which uses a
different authentication. Nor does it affect NT logons. In non-POP3
logins, the passwords are not cached. I have successfully reproduced
this problem with different NT domain policy settings as well as
Exchange 5.0 settings. I have done exhaustive testing of this in
different ways with varying settings. When I find a way to patch this,
I'll post it here. Implications: If an undesired person finds out your
mail password, changing it won't help because the POP3 service will
continue to accept the old passwords as well as the new ones. Possible
workaround (not tested yet): Try changing it too many times and reboot
the Exchange server hoping it will clear the cache.



______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com


Some time ago I seem to remember a discussion thread on
Microsoft NetMeeting. From what I can remember it had
something to do with the permissions granted to the remote
user on the local machine. The outcome of the thread, I think,
was that it is unwise to allow any NetMeeting sessions if one
is worried about compromising security.

We now have some users in the company who are actually
using NetMeeting across the internet to allow discussions
to take place with some of our offices in other countries.

My first reaction to this was to say "Hold on a minute", but
I cannot justify this as I have lost the earlier postings on this
subject. After searching through both the NT Security archives
(which for some reason seem to stop at the first week in Jan 97)
and some of the internet search engines, I have drawn a blank.

Can someone either repost the earlier thread, or point me to it.
Any other sites with this sort of info on NetMeeting will also be
appreciated.

Thanks in advance

Ian.

:-------------------------------------------------------------:
: Ian_Cummings@cegelecproj.co.uk #include :
: CEGELEC Projects Ltd, Rugby, England, CV21 1BU :
: Opinions expressed are my own, not those of my employer :
:-------------------------------------------------------------:


All anonymous logons are done through an account you created during the
IIS install. All files and directories therefor that you want anonymous
access to have to be given to this IIS account. To restrict what is given
to anonymous users, simply adjust the file and directory rights
accordingly. The anonymous user will be given an "access denied" message,
while an authorized user will be allowed to "cd" into the directory. Be
aware however, that the "read" and "write" rights in IIS superceed those
of NTFS file permissions.

But a more important issue is that you are now sending your administrative
password over the network CLEAR TEXT. I have had passwords sniffed and
have sniffed passwords this way before. This is very easy to do, if I see
the words "administrator" and "snooky" in two packets, I know I have
someones password.

Good luck,
Will Morgan
MCSE

On Tue, 26 Aug 1997, Sami Mousa wrote:

> 
> 
> I have an NT server running IIS for anonymous FTP users
> 
> going to /inetpub/ftproot fore various PUBLIC files but 
> 
> I also have the need for the "Administrator" account to 
> 
> be able to access the whole disk.
> 
> 
> Currently, I setup "Virtual Dir" called "adminroot" in the IIS
> 
> tool that will let me get to the C:\. Though all users can't 
> 
> see this directory, both the Administrator and anonymous FTP 
> 
> logins.. can CD to it! ACK! Big problem.
> 
> 
> How can I restrict only Administrator users to getting to
> 
> the C:\ directory?
> 
> 
> Thanks,
> 
> 
> 
> 
> 
> 
> 
> 
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> ** Sami Mousa, 
> ffff,0000,0000FORE ATM(WAN) Certified 
> **
> 
> ** International Network Services Office: (908)603-8541 x320 
> **
> 
> ** Network Systems Engineer e-mail: sami_mousa@ins.com 
> **
> 
> ** 120 Wood Ave South Pager: (888)896-4064 
> **
> 
> ** Suite #615 Fax: (908)548-5630 
> **
> 
> ** Iselin, New Jersey 08830 www.ins.com 
> **
> 
> =============================================================================
> 
> "My statements in this message are personal opinions \
> 
> which may have no basis whatsoever in fact."
> 
> 
> 
> 

Please pardon me if this has already been posted to the list, but I just
read it this morning! (I think it's still fresh!)

>From a C|Net News article about the new MS Logo requirements for Windows
applications:

When Windows NT 5.0 ships, the logo requirements will include the
following: 

System32 lockdown: NT 5.0 applications will not be able to overwrite
core DLLs when installing and uninstalling. This will prevent erasure of
key system components. This "lockdown" of the system software will not
make it into Memphis, however, which means that security surrounding
executable code will remain an issue for Windows 95 users until at least
the successor to Memphis.

Halleluia!!!

The entire article (as of 08/26/97) may be found at:

http://www.news.com/News/Item/0,4,13709,00.html

L8R!

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com

On Tue, 26 Aug 1997, Bivens, David R. wrote:

> key system components. This "lockdown" of the system software will not
> make it into Memphis, however, which means that security surrounding

So where can one find the spex for Memphis?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================


From: "Bivens, David R." 
>Please pardon me if this has already been posted to the list, but I just
>read it this morning! (I think it's still fresh!)
>
>>From a C|Net News article about the new MS Logo requirements for Windows
>applications:
>
>When Windows NT 5.0 ships, the logo requirements will include the
>following: 
>
>System32 lockdown: NT 5.0 applications will not be able to overwrite
>core DLLs when installing and uninstalling. This will prevent erasure of
>key system components. This "lockdown" of the system software will not
>make it into Memphis, however, which means that security surrounding
>executable code will remain an issue for Windows 95 users until at least
>the successor to Memphis.

Is this enforced by the OS or the application (ie. InstallShield)?

>Halleluia!!!

Yeah, I saw that and had the same thought. Of course it will likely 
break the installation procedure of a number of windows applications.
But such is the price of progress.

>The entire article (as of 08/26/97) may be found at:
>
>http://www.news.com/News/Item/0,4,13709,00.html

B.T.W. - what do people think of the security changes in NT 5.0, specifically
(links to white papers at http://www.microsoft.com/ntserver/info/pdcwp.htm):

* The Active Directory (NT Next Generation Directory Services) model with
 combo DNS & X.500 replacing the domain controller's registry as the
 repository of account information.
 ( http://www.microsoft.com/ntserver/MIGRATWP.EXE )
* NT Distributed Security Services.
 ( http://www.microsoft.com/ntserver/SECUREWP.EXE )
* Microsoft. Security Support Provider Interface (SSPI)
 ( http://www.microsoft.com/ntserver/NTSSPIWP.EXE )

H. Morrow Long, Yale Univ IT ISO -Info Technology Services Info Security Officer
175 Whitney Avenue, New Haven, CT 06520-8276, (203)432-1248(voice) 432-0593(FAX)
INET: http://pantheon.yale.edu/~long/ mailto:Morrow.Long@yale.edu
PAGE: (203)370-3081, (800)347-2574, mailto:1165469@pager.mcb.com PIN# 1165469

On Tue, 26 Aug 1997, Jean-Claude Berger wrote:

> When you rename a file or a directory NT acts as if it deleted the file and then 
> recreated it. So you need the right to delete your directory (D) on the left list of
> permissions of the directory itself OR full control on the container directory 
> AND at least the RWX on the container directory (repectively for deleting and
> adding).

Erm, does this mean that the file's or directory's ACL's & Audit info's
are zapped and new ones are inherited from the parent? That would be bad.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================


Alan Killenbeck wrote:
> 
> Has anyone done a relative risk comparison between the Microsoft client
> for Novell networks versus using the Novell client software for NT?
> (Intranetware)


Actually, related to this topic, I was wondering if there were a way to 
keep the average joe from turning on "login into NT only" or playing with 
which NT box they log into (local machine or domain). 

We have faculty members using NT workstations with the Intranetware 
client. They must log into both NetWare and and NT domain. Sometimes 
someone will come and go the the NT tab and turn on NT only, and then the 
user gets confused as to why they aren't getting their NetWare apps. 

Any ideas?

Thanks,

Patricia

 I get this also . . . can/would someone explain this issue a bit 
further please?

Danny
d016627c@dc.seflin.org

"Who looks outside, dreams; who looks inside, awakes."--Carl Jung

On Sat, 12 Jul 1997, John wrote:

> This is an audit log record I see often also. Upon initial research,
> the SeTcbPrivilege means the user is trying to act as part of the
> operating system. I am not sure why though.
> 
> John
> 
> G. Richard Bellamy wrote:
> 
> > This is a failure I see often, and though it doesn't seem to be
> > causing
> > me any problems, I'm very curious about what it is........ sorry if
> > this
> > is ground already covered.
> >
> > Privileged Service Called:
> > Server: NT Local Security Authority / Authentication
> > Service
> > Service: LsaRegisterLogonProcess()
> > Primary User Name: SYSTEM
> > Primary Domain: SYSTEM
> > Primary Logon ID: (0x0,0x3E7)
> > Client User Name: JoeAdminUser
> > Client Domain: ADOMAIN.COM
> > Client Logon ID: (0x0,0x15B1)
> > Privileges: SeTcbPrivilege
> >
> > G. Richard Bellamy
> > http://www.intlcafe.com
> > mailto:richard@intlcafe.com
> > VOX:707.887.8814
> > FOX:707.887.1810
> > _,.-~-.,__,.-~-.,__,.-~-.,__,.-~-.,_
> > I am coffee of Borg.
> > Instant is futile.
> > You will be percolated.
> > _,.-~-.,__,.-~-.,__,.-~-.,__,.-~-.,_
> > p_priority=PFUN+(p_work/4)+(2*p_cash)
> 
> 
> 
Hi Patricia,

If you're using the INW client for NT, you can also enable the NT
workstation manager, which provides several features that simplify NT
workstation management. For example:

1. Workstation manager allows you to centrally configure the NT Workstation
login screen, including the login tabs. From this configuration, you could
disable the Windows NT login tab, which would prevent users from setting the
"login into NT only" checkbox.

2. You can configure the pre-login screen with a custom bitmap. Many
customers are displaying a company logo with the standard disclaimer - i.e.,
"You're now accessing the UPenn network. Unauthorized access....."

3. Workstation manager provides the 'dynamic local user' feature - instead
of creating a user in both NDS and the NT domain, a user can be created once
in NDS. If associated with a Workstation Manager object in NDS, the user
can be dynamically created in the local NT Workstation SAM database and
added to the local NT workstation group specified in the NDS workstation
configuration object. This is one of the biggest features of Workstation
Manager - the ability to use NT Workstation security, profiles, and polices,
without the needs to deploy a NT domain. 

Best of all, if you already have NDS, the Workstation Manager is free!

For more information on Workstation Manager, see
http://www.novell.com/intranetware/ntint/products.html

Good luck 

Gary

>>> Patricia Thorp 08/26/97 10:46AM >>>

Alan Killenbeck wrote:
> 
> Has anyone done a relative risk comparison between the Microsoft client
> for Novell networks versus using the Novell client software for NT?
> (Intranetware)


Actually, related to this topic, I was wondering if there were a way to 
keep the average joe from turning on "login into NT only" or playing with 
which NT box they log into (local machine or domain). 

We have faculty members using NT workstations with the Intranetware 
client. They must log into both NetWare and and NT domain. Sometimes 
someone will come and go the the NT tab and turn on NT only, and then the 
user gets confused as to why they aren't getting their NetWare apps. 

Any ideas?

Thanks,

Patricia

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
With Novell's Workstation Manager, you can assign client configurations
to users through NDS. This allows you to set which tabs the user will
see on the GINA. The hitch is that you have to be running NDS.

Steve Tharp

> ----------
> From: thorp@sas.upenn.edu[SMTP:thorp@sas.upenn.edu]
> Sent: Tuesday, August 26, 1997 11:46 AM
> To: akill@roch875.mc.xerox.com
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Q:Novell Client security on NT
> 
> 
> Alan Killenbeck wrote:
> > 
> > Has anyone done a relative risk comparison between the Microsoft
> client
> > for Novell networks versus using the Novell client software for NT?
> > (Intranetware)
> 
> 
> Actually, related to this topic, I was wondering if there were a way
> to 
> keep the average joe from turning on "login into NT only" or playing
> with 
> which NT box they log into (local machine or domain). 
> 
> We have faculty members using NT workstations with the Intranetware 
> client. They must log into both NetWare and and NT domain. Sometimes 
> someone will come and go the the NT tab and turn on NT only, and then
> the 
> user gets confused as to why they aren't getting their NetWare apps. 
> 
> Any ideas?
> 
> Thanks,
> 
> Patricia
> 
One of our administrators found the following account
on her server:

IUSR_ : Internet Guest Account : Internet Server 
 Anonymous Access

She doesn't know who put it there. Another admin
has been playing with IIS (on her machine). I expect that 
IIS put the account there, but I am not familiar enough with it
to be sure. Could someone verify this or note the source
of this account. (IIS has been removed, though I think
this was botched.)

I disabled the account, but have not yet deleted it. I
am hoping to delete it if I can. We found this through
an unexplained access to this account by a non-employee.

Thanks,

-leonard
Site that shows how Active-X can change IE security level and other demos:

http://www.thur.de/home/steffen/activex/index_e.html

The below sites go a bit further, and discusses how a Active-X can be
subverted though subsequent attacks and a trojan. The following sites
mention the techniques were obtained via stealing from 'Jobi', a posting to
UNIXbugtraq mentioned they were stolen from 'Tobi'. Now who else rhymes
with that? ;)

http://www.network-security.com/activex/
-or-
http://www.dis.org/maglite/


Bill Stout
______________________________________________________________________
 Told you so. [tm]



> ----------
> From: Ray Arachelian[SMTP:sunder@brainlink.com]
> Reply To: Ray Arachelian
> Sent: Tuesday, August 26, 1997 9:06 AM
> To: Jean-Claude Berger
> Cc: 'gpng@mol.com.my'; 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] can't rename directory
> 
> On Tue, 26 Aug 1997, Jean-Claude Berger wrote:
> 
> > When you rename a file or a directory NT acts as if it deleted the
> file and then 
> > recreated it. So you need the right to delete your directory (D) on
> the left list of
> > permissions of the directory itself OR full control on the container
> directory 
> > AND at least the RWX on the container directory (repectively for
> deleting and
> > adding).
> 
The above statement is not true. Changing the name (with MoveFile)
merely requires (W) access to the directory. Some applications (e.g.
Word) will implement operations like "save" by creating a new file,
deleting the old one, and renaming the new one to the old name, which
will cause the behavior you saw above. 

> Erm, does this mean that the file's or directory's ACL's & Audit
> info's
> are zapped and new ones are inherited from the parent? That would be
> bad.
> 
If the app creates a new file and deletes the old one, and renames the
new one the same as the old name, without copying across the security
descriptor, that's the behavior you get. It's an app problem, not an OS
one.

Paul
ltimmons@acsatlanta.com in a lapsus wrote
>One of our administrators found the following account
>on her server:

>IUSR_ : Internet Guest Account : Internet Server 
 Anonymous Access



>She doesn't know who put it there. Another admin
>has been playing with IIS (on her machine). I expect that 
>IIS put the account there, but I am not familiar enough with it
>to be sure. Could someone verify this or note the source
>of this account. (IIS has been removed, though I think
>this was botched.)

>I disabled the account, but have not yet deleted it. I
>am hoping to delete it if I can. We found this through
>an unexplained access to this account by a non-employee.

>Thanks,

>-leonard

PLEASE READ THE F* MANUAL (RTFM) BEFORE SEND THIS KIND OF MESSAGES TO
THIS LIST!!!

_____________________________________________________________________
Sent by RocketMail. Get your free e-mail at http://www.rocketmail.com

It is from IIS. It is the account used by the IIS server to service
non-authenticated requests. I.e., if you ever had the web server up, any
vanilla request to the server would have resulted in this account being
logged in and accessing the web page.

> ----------
> From: Leonard Timmons[SMTP:ltimmons@acsatlanta.com]
> Reply To: Leonard Timmons
> Sent: Tuesday, August 26, 1997 12:14 PM
> To: NTSecurity
> Subject: [NTSEC] Unknown Account
> 
> One of our administrators found the following account
> on her server:
> 
> IUSR_ : Internet Guest Account : Internet Server 
> Anonymous Access
> 
> She doesn't know who put it there. Another admin
> has been playing with IIS (on her machine). I expect that 
> IIS put the account there, but I am not familiar enough with it
> to be sure. Could someone verify this or note the source
> of this account. (IIS has been removed, though I think
> this was botched.)
> 
> I disabled the account, but have not yet deleted it. I
> am hoping to delete it if I can. We found this through
> an unexplained access to this account by a non-employee.
> 
> Thanks,
> 
> -leonard
> 
It's all totally bogus, IMO. The attack amounts to the stellar
observation that running software that you mistakenly trusted can do bad
things to you (including leaving backdoors to let other bad software
in).

> ----------
> From: Bill Stout[SMTP:stoutb@pios.com]
> Reply To: Bill Stout
> Sent: Tuesday, August 26, 1997 4:38 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Interesting Active-X exploits
> 
> Site that shows how Active-X can change IE security level and other
> demos:
> 
> http://www.thur.de/home/steffen/activex/index_e.html
> 
> The below sites go a bit further, and discusses how a Active-X can be
> subverted though subsequent attacks and a trojan. The following sites
> mention the techniques were obtained via stealing from 'Jobi', a
> posting to
> UNIXbugtraq mentioned they were stolen from 'Tobi'. Now who else
> rhymes
> with that? ;)
> 
> http://www.network-security.com/activex/
> -or-
> http://www.dis.org/maglite/
> 
> 
> Bill Stout
> ______________________________________________________________________
> Told you so. [tm]
> 
If you actually check out this guy's web page -- he's had the "solution"
posted since yesterday. 

By design, Exchange Server maintains a secure credentials cache in
memory, on behalf of native Internet protocol clients (POP3, NNTP, LDAP)
so that it doesn't have to make a round trip over the network to the NT
Domain Controller every time a POP3 client does "check mail" (like every
5 minutes for most mail clients). Credentials are automatically aged out
of the cache -- 2 hours max lifetime by default, more quickly if they
aren't used often (15 minute idle time by default).

There's no new security risk here *unless your password has already been
stolen*. If you suspect that's the case, and you change your NT password
-- then there's an additional window of between 15 minutes and two hours
where your old password will still be valid for basic authentication via
POP3, NNTP, or LDAP. This only applies if you are using Basic
Authentication (plain-text authentication) for these Internet protocols.
The issue doesn't occur if you are using NTLM-aware POP3 mail clients --
like Outlook Express (since NTLM-aware clients do their own local
credentials caching).

If you don't want this caching, then you can easily disable it via a
registry setting -- this is described in KB article Q166620 at
http://www.microsoft.com/kb/articles/q166/6/20.htm. Keep in mind,
however that this will mean a round-trip to the domain controller for
every POP3 "check mail" operation.

Of course, from a security perspective -- using POP3 with clear-text
passwords isn't such a hot idea in the first place. If you want to use
POP3, we'd strongly recommend only using it with "Basic Auth over SSL
encryption" or "NTLM Challenge/Response Auth".

==========
Jim Reitz (mailto:jimre@microsoft.com)
Program Manager
Microsoft Corporation

> -----Original Message-----
> From: Paul D. Robertson [SMTP:proberts@clark.net]
> Sent: Tuesday, August 26, 1997 6:15 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] BoS: Exchange Server 5.0 POP3 Security Hole
> (fwd)
> 
> I haven't seen this one here yet, so forwarded from Best Of Security.
> 
> Paul
> ----------------------------------------------------------------------
> -------
> Paul D. Robertson "My statements in this message are personal
> opinions
> proberts@clark.net which may have no basis whatsoever in fact."
> 
> PSB#9280
> 
> ---------- Forwarded message ----------
> Date: Mon, 25 Aug 1997 02:29:26 PDT
> From: Attila Bartfai 
> To: best-of-security@cyber.com.au
> Subject: BoS: Exchange Server 5.0 POP3 Security Hole
> 
> 
> >From the microsoft.public.exchange.clients newsgroup.
> 
> >Exchange Server 5.0 POP3 Security Hole found.
> >Details at http://rajiv.org/active/
> >Soon as a solution is found it will be posted there.
> >________________________________________________________________
> >Rajiv Pant (Betul) http://rajiv.org
> >Philadelphia Online http://phillynews.com
> >The Philadelphia Inquirer and Philadelphia Daily News newspapers
> 
> Details from http://rajiv.org/active
> 
> 1997/Aug/20 Security Alert! MS Exchange Server 5.0 POP3 Service
> Password
> Caching Problem. We found the following problem today and Microsoft
> has
> successfully reproduced this bug and confirmed it to us as a possible
> bug. We will hear a final answer from them tomorrow. The bug (as an
> example): Create a user xyz on your NT domain with an Exchange 5.0
> server with POP3 service. Set xyz's password to a1234. Things work
> fine
> so far. Now change xyz's password to b5678. You will find that POP3
> mail
> clients can log in using either password a1234 or b5678 for user xyz.
> Now change the password to something else. You will find that a POP3
> client (or direct telnet to port 110) will allow you to log in as xyz
> using any of the three passwords. They all work. The Exchange 5.0
> service POP3 connector caches passwords in a non-hashing mechanism so
> that all the passwords remain active. (I don't know for how long.)
> This
> does not affect the new web page interface to get your mail which uses
> a
> different authentication. Nor does it affect NT logons. In non-POP3
> logins, the passwords are not cached. I have successfully reproduced
> this problem with different NT domain policy settings as well as
> Exchange 5.0 settings. I have done exhaustive testing of this in
> different ways with varying settings. When I find a way to patch this,
> I'll post it here. Implications: If an undesired person finds out your
> mail password, changing it won't help because the POP3 service will
> continue to accept the old passwords as well as the new ones. Possible
> workaround (not tested yet): Try changing it too many times and reboot
> the Exchange server hoping it will clear the cache.
> 
> 
> 
> ______________________________________________________
> Get Your Private, Free Email at http://www.hotmail.com
> 
On Tue, 26 Aug 1997, Paul Leach wrote:

> It's all totally bogus, IMO. The attack amounts to the stellar
> observation that running software that you mistakenly trusted can do bad
> things to you (including leaving backdoors to let other bad software
> in).

To which the Official Microsoft Response [TM] has been:

"Well, plug-ins are bad too!"

*sigh*

Yeah, object code off the Internet, what a "stellar" idea.


Paul

(Yes, I'm fighting that whole battle again, and yes, I'm _still_ pissed 
off that the whole authentication thing was half-assed)

> 
> > ----------
> > From: Bill Stout[SMTP:stoutb@pios.com]
> > Reply To: Bill Stout
> > Sent: Tuesday, August 26, 1997 4:38 PM
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] Interesting Active-X exploits
> > 
> > Site that shows how Active-X can change IE security level and other
> > demos:
> > 
> > http://www.thur.de/home/steffen/activex/index_e.html
> > 
> > The below sites go a bit further, and discusses how a Active-X can be
> > subverted though subsequent attacks and a trojan. The following sites
> > mention the techniques were obtained via stealing from 'Jobi', a
> > posting to
> > UNIXbugtraq mentioned they were stolen from 'Tobi'. Now who else
> > rhymes
> > with that? ;)
> > 
> > http://www.network-security.com/activex/
> > -or-
> > http://www.dis.org/maglite/
> > 
> > 
> > Bill Stout
> > ______________________________________________________________________
> > Told you so. [tm]
> > 
> 


-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

I don't mind it if you hate it and/or are pissed off. Just don't
misrepresent it (which is what the author of the "attack" is doing).

All I claim for authenticode is that you
1. Know who wrote the code (if you trust Verisign)
2. Know that all the bugs in it were out there by the people who wrote
it
3. Got to pick whether to trust the people who wrote it before you ran
it -- wither once or each time code from them was offered to you.

On all fronts, I believe that with authenticode you have more assurance
than if you bought the same code, unsigned, at Egghead. I.e., it's more
secure than what we do all the time, with the convenience of getting it
off the Internet. It would be really ironic if we couldn't use the
Internet for electronic commerce in the commodity (software) that made
the Internet possible.



> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> Sent: Tuesday, August 26, 1997 7:01 PM
> To: Paul Leach
> Cc: ntsecurity@iss.net; 'Bill Stout'
> Subject: RE: [NTSEC] Interesting Active-X exploits
> 
> On Tue, 26 Aug 1997, Paul Leach wrote:
> 
> > It's all totally bogus, IMO. The attack amounts to the stellar
> > observation that running software that you mistakenly trusted can do
> bad
> > things to you (including leaving backdoors to let other bad software
> > in).
> 
> To which the Official Microsoft Response [TM] has been:
> 
> "Well, plug-ins are bad too!"
> 
> *sigh*
> 
> Yeah, object code off the Internet, what a "stellar" idea.
> 
> 
> Paul
> 
> (Yes, I'm fighting that whole battle again, and yes, I'm _still_
> pissed 
> off that the whole authentication thing was half-assed)
> 
> > 
> > > ----------
> > > From: Bill Stout[SMTP:stoutb@pios.com]
> > > Reply To: Bill Stout
> > > Sent: Tuesday, August 26, 1997 4:38 PM
> > > To: ntsecurity@iss.net
> > > Subject: [NTSEC] Interesting Active-X exploits
> > > 
> > > Site that shows how Active-X can change IE security level and
> other
> > > demos:
> > > 
> > > http://www.thur.de/home/steffen/activex/index_e.html
> > > 
> > > The below sites go a bit further, and discusses how a Active-X can
> be
> > > subverted though subsequent attacks and a trojan. The following
> sites
> > > mention the techniques were obtained via stealing from 'Jobi', a
> > > posting to
> > > UNIXbugtraq mentioned they were stolen from 'Tobi'. Now who else
> > > rhymes
> > > with that? ;)
> > > 
> > > http://www.network-security.com/activex/
> > > -or-
> > > http://www.dis.org/maglite/
> > > 
> > > 
> > > Bill Stout
> > >
> ______________________________________________________________________
> > > Told you so. [tm]
> > > 
> > 
> 
> 
> ----------------------------------------------------------------------
> -------
> Paul D. Robertson "My statements in this message are personal
> opinions
> proberts@clark.net which may have no basis whatsoever in fact."
> 
> PSB#9280
> 



On Tue, 26 Aug 1997, Paul Leach wrote:
> It's all totally bogus, IMO. The attack amounts to the stellar
> observation that running software that you mistakenly trusted can do bad
> things to you (including leaving backdoors to let other bad software
> in).

You mean software such as Internet Explorer?

How about some technical substance in postings to this list?

> ----------
> From: Weld Pond[SMTP:weld@l0pht.com]
> Sent: Tuesday, August 26, 1997 7:22 PM
> To: Paul Leach
> Cc: ntsecurity@iss.net; 'Bill Stout'
> Subject: RE: [NTSEC] Interesting Active-X exploits
> 
> 
> 
> 
> On Tue, 26 Aug 1997, Paul Leach wrote:
> > It's all totally bogus, IMO. The attack amounts to the stellar
> > observation that running software that you mistakenly trusted can do
> bad
> > things to you (including leaving backdoors to let other bad software
> > in).
> 
> You mean software such as Internet Explorer?
> 
On Tue, 26 Aug 1997, Paul Leach wrote:

> I don't mind it if you hate it and/or are pissed off. Just don't
> misrepresent it (which is what the author of the "attack" is doing).
> 
> All I claim for authenticode is that you
> 1. Know who wrote the code (if you trust Verisign)

I don't totally agree with this. There's no originator control of 
signed objects, so an uncopied private key isn't necessarily a safe bet.
Also, with no real-time signature checking, there isn't a way to revoke 
the certificate, so once again you don't *know* who wrote it, you have a 
representation of who wrote it.

> On all fronts, I believe that with authenticode you have more assurance
> than if you bought the same code, unsigned, at Egghead. I.e., it's more

This is somewhat true, but I'm not buying into the predicate that "better 
than now" makes it a good thing. Being beaten is better than being shot, 
but I'd rather not have either thanks :)

Most companies, and that's the main point of contention I have with 
Authenticode, the corporate environment, do have better assurance than a 
retail environment. It's shipped from the manufacturer generally, and 
there's a paper trail of physical evidence there. There's also an 
approval mechanism, and auditability there that's a lot stronger than 
'off the Net' currently provides. Someone in the Systems department 
generally approves software purchases, not the end-user in the mailroom.

> secure than what we do all the time, with the convenience of getting it
> off the Internet. It would be really ironic if we couldn't use the
> Internet for electronic commerce in the commodity (software) that made
> the Internet possible.

I'm not sure that the distribution mechanism and execution mechanism 
should be both "in band" without a great deal more work. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

1) This is funny stuff. I'm laughing out loud at the characters on this
mailing list.

2) We suggest to our customers to disallow both Java and ActiveX on the
desktop. I think this is appropriate. ActiveX malware can't hurt you if
it doesn't work. Turn it off. Giving Fred in First National
Superconglomerate Bank's marketing department the responsibility of
deciding how to respond to a "This software is published by.... etc" dialog
box from SexxPixx that he's gonna breeze through anyway is just a bad idea.
 Isn't this just common sense?

----------
> From: Paul Leach 
> To: 'Weld Pond' 
> Cc: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Interesting Active-X exploits
> Date: Tuesday, August 26, 1997 10:26 PM
> 
> How about some technical substance in postings to this list?
> 
> > ----------
> > From: Weld Pond[SMTP:weld@l0pht.com]
> > Sent: Tuesday, August 26, 1997 7:22 PM
> > To: Paul Leach
> > Cc: ntsecurity@iss.net; 'Bill Stout'
> > Subject: RE: [NTSEC] Interesting Active-X exploits
> > 
> > 
> > 
> > 
> > On Tue, 26 Aug 1997, Paul Leach wrote:
> > > It's all totally bogus, IMO. The attack amounts to the stellar
> > > observation that running software that you mistakenly trusted can do
> > bad
> > > things to you (including leaving backdoors to let other bad software
> > > in).
> > 
> > You mean software such as Internet Explorer?
> > 
Ok Ok OK!!!!
Can we get back on topic?

At 11:45 PM 8/26/97 -0400, Chris McDonough wrote:
>1) This is funny stuff. I'm laughing out loud at the characters on this
>mailing list.
>
>2) We suggest to our customers to disallow both Java and ActiveX on the
>desktop. I think this is appropriate. ActiveX malware can't hurt you if
>it doesn't work. Turn it off. Giving Fred in First National
>Superconglomerate Bank's marketing department the responsibility of
>deciding how to respond to a "This software is published by.... etc" dialog
>box from SexxPixx that he's gonna breeze through anyway is just a bad idea.
> Isn't this just common sense?
>
>----------
>> From: Paul Leach 
>> To: 'Weld Pond' 
>> Cc: 'ntsecurity@iss.net'
>> Subject: RE: [NTSEC] Interesting Active-X exploits
>> Date: Tuesday, August 26, 1997 10:26 PM
>> 
>> How about some technical substance in postings to this list?
>> 
>> > ----------
>> > From: Weld Pond[SMTP:weld@l0pht.com]
>> > Sent: Tuesday, August 26, 1997 7:22 PM
>> > To: Paul Leach
>> > Cc: ntsecurity@iss.net; 'Bill Stout'
>> > Subject: RE: [NTSEC] Interesting Active-X exploits
>> > 
>> > 
>> > 
>> > 
>> > On Tue, 26 Aug 1997, Paul Leach wrote:
>> > > It's all totally bogus, IMO. The attack amounts to the stellar
>> > > observation that running software that you mistakenly trusted can do
>> > bad
>> > > things to you (including leaving backdoors to let other bad software
>> > > in).
>> > 
>> > You mean software such as Internet Explorer?
>> > 
>
>
 Phone 212-722-7953 Fax 212-427-1169
 mitch@kewling.com 
 www.Kewling.Com
 Imagination is more important than knowledge.....
 Knowledge is limited.....
 Imagination is not....... Albert Einstein, (1879-1955)
We have a customer that has Exchange Server (running on an NT Server, of
course), connected to the Internet via a 56k DUN connection to their
local ISP. This allows them to send internal and Internet
email--relatively small network, adequate performance. This customer
would like to install MS Proxy Server to grant users WWW access at their
desktops. As a proof-of-concept, they'd like to try this using their
existing connection to their ISP to do this.

Any comments on how to best go about doing this? I was thinking of
either:

Option 1) installing MS Proxy Server on the same server as Exchange/DUN
is on, thereby using the existing connection to the Internet to provide
web access.

Questions:
a) Will this work?
b) Does the Exchange Server sit 'behind' the proxy server, or at the
same 'level'?
b1) If behind, are there any "gotchas" to be aware of?
b2) If at the same level, are there any security issues to be aware of?

Option 2) installing MS Proxy server on a different server (moving the
DUN connection to that new server), and somehow have Exchange route
information to/from the Internet through that different server.

Questions:a) Will this work?
b) Does NT support routing of data in this way?
c) Would they need a second fixed IP address for the Exchange server,
since the existing fixed IP address would be used for the new server's
actual connection to the Internet?

If you have any other suggestions, I'd appreciate hearing them, too!
Perhaps RRAS and/or MS Proxy Server 2 may provide more/better options. I
searched TechNet high-and-low, but couldn't find any relevant
information about this. Thanks!

 - H2Os -


> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> Reply To: Paul D. Robertson
> Sent: Tuesday, August 26, 1997 7:57 PM
> To: Paul Leach
> Cc: ntsecurity@iss.net; 'Bill Stout'
> Subject: RE: [NTSEC] Interesting Active-X exploits
> 
> On Tue, 26 Aug 1997, Paul Leach wrote:
> 
> > I don't mind it if you hate it and/or are pissed off. Just don't
> > misrepresent it (which is what the author of the "attack" is doing).
> > 
> > All I claim for authenticode is that you
> > 1. Know who wrote the code (if you trust Verisign)
> 
> I don't totally agree with this. There's no originator control of 
> signed objects, so an uncopied private key isn't necessarily a safe
> bet.
> 
Our tamper proof signing black box is in a vault. Literally. And who
goes in and out is logged. Other companies, maybe they aren't so careful
with what they sign. Some companies used to let viruses onto their
distribution floppies, too. So, you deal with companies that you trust
to exercise what you consider adequate quality control. That's not
different, on or off the net.

> Also, with no real-time signature checking, there isn't a way to
> revoke 
> the certificate, so once again you don't *know* who wrote it, you have
> a 
> representation of who wrote it.
> 
So, once we have online CRLs, that'll make signed code secure in your
book?

> > On all fronts, I believe that with authenticode you have more
> assurance
> > than if you bought the same code, unsigned, at Egghead. I.e., it's
> more
> 
> This is somewhat true, but I'm not buying into the predicate that
> "better 
> than now" makes it a good thing. Being beaten is better than being
> shot, 
> but I'd rather not have either thanks :)
> 
> Most companies, and that's the main point of contention I have with 
> Authenticode, the corporate environment, do have better assurance than
> a 
> retail environment. It's shipped from the manufacturer generally, and
> 
> there's a paper trail of physical evidence there. There's also an 
> approval mechanism, and auditability there that's a lot stronger than 
> 'off the Net' currently provides. Someone in the Systems department 
> generally approves software purchases, not the end-user in the
> mailroom.
> 
I think you're saying that corporate end users can't be trusted to
acquire code, at Egghead or off the net, to run on their machines. If
so, I'd agree that that's an internally consistent position. But not the
one that people who chant "authenticode is insecure" take. However, a
lot of companies I know buy through Egghead (or equivalent), and get
exactly the same boxes that end up on the retail shelves, so I'm not
sure I buy the contention that the corporate channel is any better than
the retail one. 

Paul
On 26 Aug 97 at 22:41, Paul Leach wrote:

> Some companies used to let viruses onto their
> distribution floppies, too. 

Microsoft did this with it's CDs in Germany, too.

Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/

It's possible, by any registry special way, to set RAS SERVICE to export the LOG info to a COMMA DELIMITED TXT FILE ?
I dont what it on my system log ....


 ^ ^
--------------------------------------ooOOo--0.0--oOOoo-------------

Antonio B. Costa Junior

 Network, Internet and Intranet Systems Consultor
 Microsoft Certified Professional ( Hunting for Systems Enginner :)


http://www.cpunet.com.br/~antonio
Salvador-Bahia-Brazil

 IRC Net's Nick: UNF and related nicks
 IRC Net's Channel OP at: #bahia (.BR) and #brasil (EFNET)



 Had anyone successfully but a LINUX box to work on the intranet and use the MS Proxy Server to access the internet ?

 If so .. how i do it ?


 ^ ^
--------------------------------------ooOOo--0.0--oOOoo-------------

Antonio B. Costa Junior

 Network, Internet and Intranet Systems Consultor
 Microsoft Certified Professional ( Hunting for Systems Enginner :)


http://www.cpunet.com.br/~antonio
Salvador-Bahia-Brazil

 IRC Net's Nick: UNF and related nicks
 IRC Net's Channel OP at: #bahia (.BR) and #brasil (EFNET)

On 19 Aug 97 at 4:43, Antonio B. Costa Junior wrote:

> 
> It's possible, by any registry special way, to set RAS SERVICE to
> export the LOG info to a COMMA DELIMITED TXT FILE ? I dont what it
> on my system log ....

Not that I know, but I assume you want it in a txt file because you 
want to evaluate the RAS info?
If so, you should have a look at my tool R20050.exe which will 
extract all RAS logon info from the system logs into text files or 
onto the screen. It is on 
http://rcswww.urz.tu-dresden.de/~fh/nt/eventlog/index.html#Evaluate



Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/
During the past few days, my PDC gives me the following event in the
security log:

Category: Object Access, ID:560

Description:

Object Open:
 Object Server: Security Account Manager
 Object Type: SAM_DOMAIN
 Object Name: DOMAINT1
 New Handle ID: -
 Operation ID: {0,13533}
 Process ID: 2156448128
 Primary User Name: SYSTEM
 Primary Domain: NT AUTHORITY
 Primary Logon ID: (0x0,0x3E7)
 Client User Name: 
 Client Domain: 
 Client Logon ID: (0x0,0x1D99)
 Accesses CreateGlobalGroup 
 LookupIDs 
 
 Privileges -

Does anyone know what it means?


Panayiotes Psihoyios
e-mail : ppsihoyios@techno.hol.gr
 psihoyios@hol.gr
Technognosis S.A.
7, Agias Glikerias Street
Galatsi
Athens 111-47
Greece
Tel: ++301 - 2220549
Fax: ++301 - 2131303

On Wed, 27 Aug 1997, Frank Heyne wrote:

> On 26 Aug 97 at 22:41, Paul Leach wrote:
> 
> > Some companies used to let viruses onto their
> > distribution floppies, too. 
> 
> Microsoft did this with it's CDs in Germany, too.
> 
> Nobody is perfect - sorry for not beeing nobody.
> http://rcswww.urz.tu-dresden.de/~fh/

 Ok, we all know (or should) that MS isn't perfect (at best) but
I still fail to see the link between CD with virii and ActiveX
controls. Personally, I would be much more interested if someone
could expose a real security hole in ActiveX technology which,
IMHO, must exist in such complex piece of software.

 The idea behind this post: and what if we returned to NT
security related questions?

VZ

The IE4 preview 2 installs a new service under NT - the "Protected 
Storage Server". Anyone know what this does i.e. what is stored 
where and how it is protected?

--Alan--
acr@als.co.uk
IMO some of this stuff about the signing mechanisms not being
perfect misses the point that they don't have to be perfect
(which is impossible anyway), they just have to be no less
bad than the alternative.

For instance, a lot of managers I know get all worried about e-mail
not being secure, when they've previously been sending faxes that
have been read by the entire post room. And does anyone
believe that the physical post is 100% secure?

Similarly, while the Authenticode can be spoofed, so can the box
that the software comes in when you buy it. And which do you
trust more: your software dealer selling at low-low prices, or
Verisign? 

This isn't to say that it couldn't all be better; just to say that it
seems to me I'm in no worse a position than was before: I know
with reasonable (not 100%) certainty that the software is from
who it's supposed to be from, and I can make a decision,
based on my perception of the risk, whether I want to trust
that person's software on my PC.

One thing that *has* changed is that the risk may be higher than
it was before, e.g. where a PC has access to online commerce
facilities, and in that situation it will be necessary to
be more cautious about trust decisions than previously.

Steve 


This is fine and obviously understandable. Corel Draw won't run for a normal user if you do this !


On Monday, August 25, 1997 10:16 PM, David LeBlanc [SMTP:dleblanc@iss.net] wrote:
> At 10:59 8/23/97 +0100, you wrote:
> >When some products install they create a subkey with a path statement in. 
> >This often points to directory locations that are writeable and executeable 
> >as part of the functionality of the application. 
> 
> Fairly simple. You also lock down your registry entries to be read-only to
> non-admins. In the case of the scanner, we lock down our entire registry
> section, and every output and executable directory we use to admins only.
> Unless you're an admin, you aren't going to even read anything belonging to
> the scanner.
> 
> OTOH, we're a paranoid bunch, so...
> 
> Same principle still applies for more normal stuff, but you allow ordinary
> users to read certain areas. You'd also want their output directories to
> be kept in HKEY_CURRENT_USER.
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
Just had this interesting mail forwarded to me.

--Alan--
acr@als.co.uk

------- Forwarded Message Follows -------

Full report at: 
http://cnnfn.com/digitaljam/wires/9708/26/encrypt_wg/

# SAN FRANCISCO (Reuter) - U.S. government regulations on the export of
# encryption software are unconstitutional, a federal judge ruled on
# Monday. [...]
# 
# Patel also issued a permanent injunction barring the government from
# enforcing the regulations against plaintiff Daniel Bernstein or anyone
# who sought to use, discuss or publish his encryption program. [...]
# 
# Patel said that, having found the regulations to be invalid, she could
# have issued a nationwide injunction barring their enforcement. But she
# said she had kept the injunction as narrow as possible pending appeal
# because "the legal questions at issue are novel, complex and of public
# importance." [...]

RPCs and DCE services are becoming larger and larger problems. Does
anyone have any experiences implementing these services across firewalls
that they care to share?

Thanks,

--Tim
_______________________________________________________________________

Tim DeLoach, Senior Systems Engineer
Science Applications International Corp (SAIC)
Honolulu: (808) 433-1005 Fax: (808) 433-5049
San Diego: (619) 646-3584 Fax: (619) 535-7627
_______________________________________________________________________

Statements reflect personal opinions, unless explicitly stated as
positions of SAIC.

-----------------------------------------------------------------------
Personal web page: http://pw1.netcom.com/~timdel/central.html
-----------------------------------------------------------------------



Does anyone know which protocol, TCP or UDP, and ports an NT server uses
when it is looking for a domain controller? 

Also I have a question about configuring trust relationships in an
environment where the domains are separated by a firewall.

 NT Domain 1 | | NT Domain 2
_____________|Firewall|____________
 Net A | | Net B 


Would the trust relationships be static, or would they require proxies
through the firewall? 

All inputs will be greatly appreciated.


TNK,

 I know the administrator's account can not be locked out from repeated 
invalid password entries, but is there a way to do this with another 
account?

Thanks,
Keith Lynch, NT Sys Admin
On 27 Aug 97 at 8:35, Keith Lynch wrote:

> I know the administrator's account can not be locked out from
> repeated invalid password entries, but is there a way to do this with another
> account?

You can do it with all or none accounts (except the built in Admin).

Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/
Antonio B. Costa Junior wrote:
> 
> Had anyone successfully but a LINUX box to work on the intranet and use the MS Proxy Server to access the internet ?
> 
> If so .. how i do it ?
> 
> ^ ^
> --------------------------------------ooOOo--0.0--oOOoo-------------
> 
> Antonio B. Costa Junior
> 
> Network, Internet and Intranet Systems Consultor
> Microsoft Certified Professional ( Hunting for Systems Enginner :)
> 
> http://www.cpunet.com.br/~antonio
> Salvador-Bahia-Brazil
> 
> IRC Net's Nick: UNF and related nicks
> IRC Net's Channel OP at: #bahia (.BR) and #brasil (EFNET)

You would be better off using a linux box as your proxy server too. For
linux clients to access a proxy they must be recompiled to work with the
specific proxy server (except most WWW clients - they are usually
designed with proxy servers in mind.) I don't know what you are
proxying - if HTTP then get netscape for linux and set the proxy in the
options. If anything else then you would be better off running a linux
proxy with SOCKS or TIS FWTK or even Apache in proxy/cache mode and
letting your wintel clients run through it. This would allow you to
compile the "SOCKSified" or special proxy versions on your linux client
and have it work as well. Plus (and this is not the start of a flame
war), from everything I hear, MS Proxy is not a reliable product anyway.

-- 
-----------------------------------------------------------
Don Mills Internet Shaman
"The technology of any sufficiently advanced civilization is
indistiguishable from magic" - Arthur C. Clarke
"I'm like a sniper, hyper off the ginsing root" - Method Man


dmills@techcom.net Director of Internet Operations, Techcom.net
dmills@ipctech.com Web Developer/Network Engineer, IPC Technologies
On Tue, 26 Aug 1997, Paul Leach wrote:

> > > I don't mind it if you hate it and/or are pissed off. Just don't
> > > misrepresent it (which is what the author of the "attack" is doing).
> > > 
> > > All I claim for authenticode is that you
> > > 1. Know who wrote the code (if you trust Verisign)
> > 
> > I don't totally agree with this. There's no originator control of 
> > signed objects, so an uncopied private key isn't necessarily a safe
> > bet.
> > 
> Our tamper proof signing black box is in a vault. Literally. And who
> goes in and out is logged. Other companies, maybe they aren't so careful
> with what they sign. Some companies used to let viruses onto their
> distribution floppies, too. So, you deal with companies that you trust
> to exercise what you consider adequate quality control. That's not
> different, on or off the net.

Right, and again, as an MIS department, we feel qualified to make that 
decision. We don't necessarily feel the guy in the mailroom is.

 > 
> > Also, with no real-time signature checking, there isn't a way to
> > revoke 
> > the certificate, so once again you don't *know* who wrote it, you have
> > a 
> > representation of who wrote it.
> > 
> So, once we have online CRLs, that'll make signed code secure in your
> book?

More secure. That's definitely a big step in the right direction.

> 
> > > On all fronts, I believe that with authenticode you have more
> > assurance
> > > than if you bought the same code, unsigned, at Egghead. I.e., it's
> > more
> > 
> > This is somewhat true, but I'm not buying into the predicate that
> > "better 
> > than now" makes it a good thing. Being beaten is better than being
> > shot, 
> > but I'd rather not have either thanks :)
> > 
> > Most companies, and that's the main point of contention I have with 
> > Authenticode, the corporate environment, do have better assurance than
> > a 
> > retail environment. It's shipped from the manufacturer generally, and
> > 
> > there's a paper trail of physical evidence there. There's also an 
> > approval mechanism, and auditability there that's a lot stronger than 
> > 'off the Net' currently provides. Someone in the Systems department 
> > generally approves software purchases, not the end-user in the
> > mailroom.
> > 
> I think you're saying that corporate end users can't be trusted to
> acquire code, at Egghead or off the net, to run on their machines. If
> so, I'd agree that that's an internally consistent position. But not the

That's certainly the "negative way" of looking at our position. (and a 
fairly factual representation) Which is why we have approved software,
approved vendors, and all that.

> one that people who chant "authenticode is insecure" take. However, a
> lot of companies I know buy through Egghead (or equivalent), and get
> exactly the same boxes that end up on the retail shelves, so I'm not
> sure I buy the contention that the corporate channel is any better than
> the retail one. 

I tend to seperate "Business" and "Corporate" by size, and in a large 
corporation, I think it's normally the case. Certainly it is the norm in 
our environment.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

On Wednesday, August 27, 1997 3:35 PM, Keith Lynch
[SMTP:Keith-Lynch@mssc.com] wrote:
> I know the administrator's account can not be locked out from
repeated 
> invalid password entries, but is there a way to do this with another

> account?

In User Manager the menu Policies | Account... brings up a dialog
where you may select if a account should be looked out if a user
enter a wrong password and for how long.

My guestion is if it is possible to set it for only a specific
number of account like IIS accounts but not the FTP-account on
a web-server? (Or maybe that was your question too...?)

Andrew
-- 
* Dansk Gospel Kalender: http://www.Kristuskirken.dk/sog/dgk.html NEW! *
*** The opinions expressed are not necessarily those of my employer. ***
* Software Engineer * Leif Andrew Rump * BLIK og ROERarbejderforbundet *
* AAlholmvej 55 * 2500 Valby * Tlf: +45 3871 3022 * Fax: +45 3871 2599 *
mailto:Andrew@unidhp.uni-c.dk http://www.GeoCities.com/SunsetStrip/1093/
** No response? Try: http://www.NetBy.NerdScan.dk/Centrum/Nordre/Andrew/

Remember Tylenol. Anyone who is interested in mucking around can get software from anywhere, including Egghead and all other channels of distribution that are public and "two way", tamper with the product and replace it.

By "two way" I mean the ability to take something off a shelf and replace it on the shelf. This has proven by way of product tampering history to be effective.

By tampering, I mean taking advantage of the low cost of pressing CD-ROMs, coupled to any exploit in security that is known including massive opportunity for viral spread among mass consumer populations who will not be sophisticated enough to defend themselves against an attack like this.

Consider taking an operating system as the product, having a run of CDs pressed within the low budget required to do so. The purchase of shrink wrapped product to obtain OEM packaging is much better than counterfeiting if part of the purpose is to attack the OEM as well as create chaos and damage. Make a copy of the commercial CD. Add your bit of anarchy to it and publish. Replace in the OEM package and shrink it. Put it on shelves in various locations, and...

How many products have a security checksum (or whatever) compiled in the product to protect against such an effort?

What my point in this dialog boils down to is that whether an exploit is possible in Active-X, VB or C, the security solutions need to be brainstormed on lists like this one so that folks who are empowered and listening (like Paul Leach) can take advantage of the enormous brain trust represented here. What clever ideas are out there that we can give to the NT developers to improve the product relative to the potential for Active-X exploits?

Jan Nelson

Great point. I'd go a step further and suggest that the firewall is a
perimeter defense, only. Therefore, it's important to layer your
defenses, implement protection at the (protected) server level as well,
and organize your management of the various layers from a central point
of view (that is, managed as if they're part of the same organization
(one security policy).)


> Carsten Goebels wrote:
> >
> > Hello all :)
> >
> > Does anyone know a good and quite cheap firewall ?
> > If so please tell me :)
> > Thanks.
> >
> > Carsten
>
>
> Jens-Uwe Schmidt wrote:
> >
> >A Firewall is _not_ a single Product, it's a philosophy how to
> combine
> >certain boxes with different jobs in the right manner.
> >
>

Christopher:

 I am in the same boat. I really didn't want our remote Exchange 4.0 server
dialing directly into the internet via ISDN. See my comments below.

----------
> From: Christopher G. Waters 
> To: 'WinNT Security List (E-mail)' 
> Subject: [NTSEC] NT, Exchange Server, MS Proxy Server
> Date: Tuesday, August 26, 1997 9:37 PM
> 

 <>

> 
> Option 1) installing MS Proxy Server on the same server as Exchange/DUN
> is on, thereby using the existing connection to the Internet to provide
> web access.
> 
> Questions:
> a) Will this work?

 Probably, but I wouldn't do it. I thought about running this way, but
after looking at how Exchange behaves, I prefer to have the proxy run on a
seperate machine that's strictly a domain member, with nothing else running
on it.

> b) Does the Exchange Server sit 'behind' the proxy server, or at the
> same 'level'?

 It would sit behind. What would happen is that you'd have another 'NIC'
your DUN in this case, in this machine. You'd have to install the WSCLIENT
software which would operate into the first NIC. First NIC is on your local
LAN and the second NIC ( DUN) is out on the internet. The directions are
there in MSP2 on dialup services.


> b1) If behind, are there any "gotchas" to be aware of?

 Don't know yet. Still working on this. Off the top of my head, two IP
addresses, don't use IPX.

> b2) If at the same level, are there any security issues to be aware of?

 The same concerns as connecting any NT server running TCP/IP to the
internet.

> 
> Option 2) installing MS Proxy server on a different server (moving the
> DUN connection to that new server), and somehow have Exchange route
> information to/from the Internet through that different server.


 I don't now which version of Exchange you're running. My Exchange 4.0 box
has the WSCLIENT installed and TCP/IP loaded for our private TCP/IP
network. I'll be working on this over the next week or so.

> 
> Questions:a) Will this work?

 Should -- MSP2 can speak SMTP.

> b) Does NT support routing of data in this way?

 Not sure what you mean here -- IMC in my case plus a dequeue program will
route the mail from ISP to Exchange.


> c) Would they need a second fixed IP address for the Exchange server,
> since the existing fixed IP address would be used for the new server's
> actual connection to the Internet?


 On the surface, it looks like you'd need two -- one from your ISP and
another that's internal to your network. MSP2 can support IPX, but I
haven't tried that except for clients running IE. SMTP on the desktop
appears to behave properly. I get the mail. Be aware that there seems to be
a bug in MSP2 when trying to ftp from wu_ftpd -- routinely returns a
blocking call received error.
> 
> If you have any other suggestions, I'd appreciate hearing them, too!
> Perhaps RRAS and/or MS Proxy Server 2 may provide more/better options. I
> searched TechNet high-and-low, but couldn't find any relevant
> information about this. Thanks!
> 
> - H2Os -

HTH

Mark
Dear Friends.

After my post to the list apologizing to everyone I have got 
enormous amount of grateful responses from all over the world 
(approximately 80+ emails that keep growing) stating that 
I had, actually, made them smile.

I decided to make a poster of all these messages. It will be 
evidence to how the Internet turns the world into a small-unified 
society. I will hang it in my office.


I thank everyone for his or her warm-hearted letter.

Shalom,

Itai Dor-on, MCSE


() ()
 ^
 - -
 - - 
 -
 


P.S.

I am examining an option of extending my activities to the firewall
market.
I would like to discuss some marketing issues (outside the list) with 
resellers & system integrators that have experience in this field. 
Any response would be most appreciated.
I'm not sure, but it sounds like an instance of the following. If you
enable the "File and Object Access" category in the auditing policy,
most low-level accesses to the Registry's user account database (the
"SAM") are audited as object access events, even though audit control
information is not explicitly assigned to these Registry keys. 
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
I agree with Steve that perspective on this issue seems to be skewed.
While ActiveX certainly increases web browser vulnerability, no threat
population has manifested itself yet. E-mail, on the other hand, has
several demonstrated vulnerabilities. I've seen a number of macro
viruses this year and I've recently encountered a trojan horse, all
delivered by e-mail and executed by users.

Why would an administrator let users have access to e-mail, given this
demonstrated threat, but prevent them from using Java or ActiveX, which
have never caused a documented security incident (outside of the
laboratory)? Unlike Java, which has a decent security architecture,
plug-ins have full access to your system. Maybe plug-ins are too hard
to control, so most sites ignore them.

My point is not that mobile code does not introduce new vulnerabilities,
but that many (most?) organizations have a poor understanding of their
risk environment. In general, uncontrolled e-mail represents a bigger
risk. So do fire, earthquake, and employees with automatic weaponry.
More computers have been destroyed by tidal waves than by rogue ActiveX
code. I understand that fire ants sometimes destroy hardware, but I
challenge anyone to show me a case where data was destroyed by a hostile
Java applet..

I'm just not impressed by anyone bragging about disabling Java & ActiveX
unless they can show that they've taken the effort to understand their
total risk enviroment, are aware of the productivity implications of
disabling mobile code, and have also implemented countermeasures against
the more commmon threats.

Steve Boyce wrote:

> IMO some of this stuff about the signing mechanisms not being
> perfect misses the point that they don't have to be perfect
> (which is impossible anyway), they just have to be no less
> bad than the alternative.
>
> For instance, a lot of managers I know get all worried about e-mail
> not being secure, when they've previously been sending faxes that
> have been read by the entire post room. And does anyone
> believe that the physical post is 100% secure?
>
> Similarly, while the Authenticode can be spoofed, so can the box
> that the software comes in when you buy it. And which do you
> trust more: your software dealer selling at low-low prices, or
> Verisign?
>
> This isn't to say that it couldn't all be better; just to say that it
> seems to me I'm in no worse a position than was before: I know
> with reasonable (not 100%) certainty that the software is from
> who it's supposed to be from, and I can make a decision,
> based on my perception of the risk, whether I want to trust
> that person's software on my PC.
>
> One thing that *has* changed is that the risk may be higher than
> it was before, e.g. where a PC has access to online commerce
> facilities, and in that situation it will be necessary to
> be more cautious about trust decisions than previously.
>
> Steve



--
Jay Heiser, 703-847-1703, jay@homecom.com
Homecom Internet Security Services


We presently have a Windows/NT WEB server deployed on the Internet.
 http://www.calibersys.com
It is a standalone server; the only people who login are the WEB Site
development staff.

Soon we will also be deploying a Windows/NT FTP server, and in the
future
possibly other hosts.

What is the advisability of organizing these into a Windows/NT domain
versus
leaving them stadalone servers? (We'd make the FTP server the PDC and
add the web site as a server.)

It sould seem the domain would make administration easier, but there
might
be an increased security risk in that someone who "breaks" the domain
gets
everything instead of only one machine. What considerations have other
people used to decide this?

Thanks,

John A. Jorgensen
Caliber Technology, Inc. (330) 384-9000 Ext 3848
557 E Tallmadge Ave. FAX (330) 258-6066
Akron, Ohio 44310

>My point is not that mobile code does not introduce new vulnerabilities,
>but that many (most?) organizations have a poor understanding of their
>risk environment. 

In some cases, this understanding is downright abysmal--get any of those E-mail bomb scare letters lately?

>I'm just not impressed by anyone bragging about disabling Java & ActiveX
>unless they can show that they've taken the effort to understand their
>total risk enviroment, are aware of the productivity implications of
>disabling mobile code, and have also implemented countermeasures against
>the more commmon threats.

I've seen at least one development effort get scuttled because of such misunderstandings on the part of the intended users' SysAdmins.




Floyd Johnson
Global Securities Information
"Nothing impresses...so much as common sense and plain dealing."
--Ralph Waldo Emerson

At 23:45 8/26/97 -0400, you wrote:
>1) This is funny stuff. I'm laughing out loud at the characters on this
>mailing list.

I'd laugh harder if I hadn't seen the same strawman so many times.

>2) We suggest to our customers to disallow both Java and ActiveX on the
>desktop. I think this is appropriate. ActiveX malware can't hurt you if
>it doesn't work. Turn it off. Giving Fred in First National
>Superconglomerate Bank's marketing department the responsibility of
>deciding how to respond to a "This software is published by.... etc" dialog
>box from SexxPixx that he's gonna breeze through anyway is just a bad idea.
> Isn't this just common sense?

I agree with this. If you have NT, you can allow a little of it - you can
install just the ActiveX controls you deem acceptable, and set the
directory these are installed into to leave off the X bit - that will cause
newly downloaded controls not to execute without manual intervention.

I'd note that we have the same problem with people going out and
downloading screen savers, various shareware/freeware apps, etc.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 16:38 8/26/97 -0700, you wrote:
>Site that shows how Active-X can change IE security level 

This is news? It is an _application_. It can do anything any other app
can. You should see what I can do with setup.exe. Use the same caution
you would in running any other executable.

Really - let's have a "news flash" that an application can erase any file
you have access to, or do anything you can.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 09:14 8/26/97 -0400, you wrote:
>I haven't seen this one here yet, so forwarded from Best Of Security.
>

>1997/Aug/20 Security Alert! MS Exchange Server 5.0 POP3 Service Password
>Caching Problem. 

It turns out that NT's FTP, HTTP, and presumably gopher all do the same
thing. First time I found it, I too thought it was a bug until I found the
registry key that regulates this behavior. Set the cache timeout to 1
minute if you like.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Just thought I'd drop you a heads up! on the following issue:

When creating users using Windows 95 based Server Manager for Domains, and copying a template user with Home Dir: \\SERVER\HOME\%USERNAME%, the user does not get added to the ACL of the directory, but the Administrator does.

Result: users cannot access their homedirs.

Solution: I installed NTW4.0 and that works as it should, users get sole access.

Anybody been there, too?

Magnus Lööf
Unisys Professional Services
http://www.unisys.se
+46-8-4701732
Personal Homepage:
http://hem1.passagen.se/magster

quit ntsecurity

> From: Chandra Sekhar Rentachinthala 
> To: ntsecurity@iss.net
> Subject: [NTSEC] quit
> Date: Wednesday, August 27, 1997 1:01 PM
> 
> quit ntsecurity

Wishful thinking.
>>----------
>>From: Keith Lynch[SMTP:Keith-Lynch@mssc.com]
>>Sent: Wednesday, August 27, 1997 8:35 AM
>>To: ntsecurity@iss.net
>Subject: [NTSEC] Preventing an Account from being locked out
>>I know the administrator's account can not be locked out from repeated 
>>invalid password entries, but is there a way to do this with another 
>>account?
>
>>Thanks,
>>Keith Lynch, NT Sys Admin

If you are running NT4, you can use passprop.exe from the ResKit to
enable locking out of 'Administrator'.

For all other accounts, start User Manager and choose Policies/Account.
On-line help can walk you through the process.

>-------
>David Elliott NT System Administration
>The Boeing Company
>mailto:david.elliott@boeing.com

> ----------
> From: Steve Boyce[SMTP:SteveB@hbs.com]
> Reply To: Steve Boyce
> Sent: Wednesday, August 27, 1997 2:40 AM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Interesting Active-X exploits
> 
> IMO some of this stuff about the signing mechanisms not being
> perfect misses the point that they don't have to be perfect
> (which is impossible anyway), they just have to be no less
> bad than the alternative.
> 
Exactly. That's all I've been saying.

> For instance, a lot of managers I know get all worried about e-mail
> not being secure, when they've previously been sending faxes that
> have been read by the entire post room. And does anyone
> believe that the physical post is 100% secure?
> 
> Similarly, while the Authenticode can be spoofed, so can the box
> that the software comes in when you buy it. And which do you
> trust more: your software dealer selling at low-low prices, or
> Verisign? 
> 
> This isn't to say that it couldn't all be better; just to say that it
> seems to me I'm in no worse a position than was before: I know
> with reasonable (not 100%) certainty that the software is from
> who it's supposed to be from, and I can make a decision,
> based on my perception of the risk, whether I want to trust
> that person's software on my PC.
> 
Exactly right again.

> One thing that *has* changed is that the risk may be higher than
> it was before, e.g. where a PC has access to online commerce
> facilities, and in that situation it will be necessary to
> be more cautious about trust decisions than previously.
> 
True. And in IE4, the zones mechanism, which can be configured by a
corporate administrator and locked down so that users can't change it
(via IE itself), can be used to limit where signed content can be
obtained from, or which software vendors are allowed to be trusted.

So we've tried to address that issue.

Paul



> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> Sent: Wednesday, August 27, 1997 6:12 AM
> To: Paul Leach
> Cc: ntsecurity@iss.net; 'Bill Stout'
> Subject: RE: [NTSEC] Interesting Active-X exploits
> 

 
> > I think you're saying that corporate end users can't be trusted to
> > acquire code, at Egghead or off the net, to run on their machines.
> If
> > so, I'd agree that that's an internally consistent position. But not
> the
> 
> That's certainly the "negative way" of looking at our position. (and
> a 
> fairly factual representation) Which is why we have approved
> software,
> approved vendors, and all that.
> 
So, in IE4 there will be a way for the MIS department to specify which
software vendor's signed code it is willing to trust, and from which
sites code can be obtained (maybe only internal ones), and make it hard
for users to get any other code (signed or unsigned).

Are we getting closer?

Paul



On Wed, 27 Aug 1997, Paul Leach wrote:

> So, in IE4 there will be a way for the MIS department to specify which
> software vendor's signed code it is willing to trust, and from which
> sites code can be obtained (maybe only internal ones), and make it hard
> for users to get any other code (signed or unsigned).
> 
> Are we getting closer?

If it's implemented in such a way that a new dowload doesn't negate it,
and it doesn't create six new positions for Windows Desktop Certified
Proffessionals [sic]. I will say that I'm _much_ happier about the
general directions Microsoft is going in than I was for the first few
iterations. 

I haven't looked even cursorarily at the MS Proxy stuff yet, but
hopefully, this will be combined with some sort of verifyable user-agent
checking during access attempts as you move forward if it isn't already
there. Personally, I'm leaning towards access certificates for
certificate verification, or some similar scheme to be a good trend.

The whole chicken and egg issue has to be addressed in the near future,
and it would be nice to see it become a desktop standard. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

| You can call RpcServerUseProtseqEp to set the port number to use before
| initializing OLE, and the server will use that port, just like your
| TPC/IP server specifies the port. Then set the firewall just like the
| TCP application.

You still need to leave RPC port 135 open for class activation, OXID 
resolution, etc... Note that NT clients and servers by default will try to use 
UDP first -- you can disable this by removing everything except for 
NCACN_IP_TCP from HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc, DCOM Protocols on 
both ends. If you don't, you will get a 30 second delay while the client 
attempts to use UDP.

| > In other words, how can I lock down Windows NT so it only serves my
| > ActiveX code, and no other code that can be reached via ActiveX/RPC?

Make sure you configure the default launch and access permissions properly on 
the machine so that they permit no one. Then, explicitly configure the AppID 
for the DCOM server for the users whom you want to allow. Disable the Guest 
account. Use NT authentication. If the clients who connect to you will be 
using NT authentication (I hope they will), enable "Secure Reference Counting" 
in DCOMCNFG. Set the default security level to Packet Encryption (or set it 
per-application with CoInitializeSecurity()) (this also requires NT 
authentication).

-mike