At 08:42 AM 6/17/97 +0000, Martin Bernreuther allegedly wrote:

>Hello,
>
>I like to lock the floppy drives to prevent users to load programms
>(viruses)... I know there's a small utility in the RESKIT to do this.
>But this utility locks the drive completely. What I would prefer is
>to allow users to load data files but no executables! Is there a
>way to do this? How can this be achived? Is there a commercial utility
>or a Readme how to programm it (preferable with C++)?
>
>Thanks
> Martin
>
>------------------------------------------------------------------------
>Dipl.-Ing. Martin Bernreuther University of Stuttgart
>Pfaffenwaldring 7 Informationsverarbeitung im
>70569 Stuttgart konstruktiven Ingenieurbau
>Germany
> E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
> http://www.uni-stuttgart.de/iv-kib/
>------------------------------------------------------------------------

It appears to me that the original problem to be solved was preventing 
virii on NT systems and that locking the floppy is one way of attempting 
to solve that problem. (BTW, never underestimate the ability of users to
bypass workarounds). 

Why not just use a NT anti-virus scanner? I know it takes the latest 
s/w products a while to get to Germany (having worked in Muenchen & 
Leinfelden), but an NT Anti-Virus Scanner should be available by now. 
This seems to be the most robust approach as well as the easiest to 
implement on a long-term basis. (Even better, the solution will be
supported). 8^)

MfG,


Frank

The opinions of the author of this mail may not necessarily be 
representative of the opinions of Fortifed Networks, Inc.

Fortified Networks, Inc. - http://www.fortified.com/
Expert (vendor-neutral) Computer and Network Security Consulting
Phone: (317) 573-0800 Fax: (317) 573-0817
The protocol didn't change. We just stopped accepting plaintext
passwords, unless specifically configured to do so -- as _frequently_
requested in this list and others.

Furthermore, the readme for SP3 clearly documented it. RTFR.

> ----------
> From: János Zöldi-Kovács (János Zö
> ldi-Kovács)[SMTP:ZKJ@APPL.SYSTREND.hu]
> Reply To: János Zöldi-Kovács (János Zö ldi-Kovács)
> Sent: Tuesday, June 17, 1997 9:39 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] NT4+SP3 Securety vs Compatibility -Reply
> 
> Certainly yes; if you have samba on the linux, the symptom is the
> same.
> You can find a solution on the page lake.canberra.edu.au address on
> the
> samba pages (search for the SP3). It works with the WfW3.11 clients.
> 
> The reason is Microsoft's newest, regular undocumented change in the
> SMB protocol.
> 
> Janos Zoldi-Kovacs
> 
> >>> "Pedro Ribeiro" 05/31/97 12:19pm >>>
> Securety vs Compatibility
> 
> Since i installed SP3 in our NT's, the wfw3.11 people can't log in the
> domain
> Is this happening to anyone alse ?
> 
> Tks for any help.
> 
> []-----------------------------------------------------------------[]
> Pedro Ribeiro 
> Online: http://www.cc.isel.pt/Pessoais/PedroRibeiro 
> e-Mail: Personal: pribeiro@cc.isel.pt
> Admin: admin@isel.pt 
> []-----------------------------------------------------------------[]
> 
At 09:52 AM 6/18/97 -0400, Tim Dodd wrote:
>Dan,
>
>I use NetUserEnum without difficulty. Levels 0 and 10 will get you
minimal information,
>but you don't have to be an admin to use them. What level are you trying,
and what are
>your return codes?

NetQueryDisplayInformation/ works against the host machine and the domain
it is logged on to, but returns ERROR_ACCESS_DENIED for the trusted domain.
NetUserEnum at level 0 again works for the host and domain, but returns
ERROR_LOGON_FAILURE for the trusted domain.

If I am just logged on to the local machine, I get the same results when I
try to enumerate the local domain as I do with the trusted domain. If I log
into the trusted domain under any user account, I can see everything I need
on the local machine and on both domains. 

>
>good luck,
>
>tim
>
>----------
>From: Dan Barrett
>Sent: Tuesday, June 17, 1997 11:07 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] enumerating users/groups in a trusted domain
>
>Does anyone know how to enumerate the users and groups in a trusted domain?
>
>I know that it can be done, since I can see them in the user manager, but I
>am unable to access this information from my own code. The NetxxxEnum
>functions don't appear to have the appropriate rights.
>
>thanks
>dan
>
>------------------------------------------------------------
>Dan Barrett dbarrett@aventail.com
>NT Server Development Lead www.aventail.com
>Aventail 206.777.5609
>
>
>Attachment Converted: "c:\eudora\attach\RE [NTSEC] enumerating usersg"
>
------------------------------------------------------------
Dan Barrett dbarrett@aventail.com
NT Server Development Lead www.aventail.com
Aventail 206.777.5609
At 09:03 PM 6/16/97 -0500, David Tyree wrote:
>My definition of what a "firewall" should do includes:
>
>1. Prevent unauthorized access to your private network.
>2. Enable secure access for authorized users to your private
>network.
>3. Detect and report unauthorized attempts to access your private
>network or servers on the public network.

Although you sort of included this in #3, I'd add "Full logging of all
actions, both permitted and denied" which the MS Proxy also doesn't do, at
least not for inbound services that are blocked or not enabled.

>I usually setup the proxy with 2 NIC's, one on the private network, and
>one on the public network. You can use any IP addressing scheme for

I'd agree that if one is planning to use the proxy as a "poor man's
firewall" then 2 NICs is an absolute must. Hardening the NT server itself
is also a must.

>I would be interested in knowing what advantages a Firewall/NAT
>configuration has over a proxy for outbound access. Anybody?

Once again, it all depends on the definition of firewall :-). A "real"
firewall, while allowing outbound access, will also log any inbound
attempts, protect against inbound attacks and (ideally) allow you more
control over which subfunctions a user has access to. By that I mean one
might want to allow FTP "get" commands, but not "put" commands for example.

The main problem one runs into these days with firewalls is that the term
covers everything from black boxes with flashing lights and filters to high
end $30K managed proxy solutions and everything in between. As usual in
the technology industry, there's more hype than reality so it's hard to get
a good picture of what's really going on. As usual, a large dose of caveat
emptor (let the buyer beware) applies in this market...

My $0.02,
Ian

PS. Any bets on which firewall vendor Microsoft will buy to get a real
"Microsoft Firewall"? Maybe I should start a pool.


-----
Ian Poynter ian@jerboa.com
Jerboa, Inc. +1-617-492-8084
PO Box 382648, Cambridge, MA 02238 http://www.jerboa.com
Providing unbiased Internet consulting for businesses.
PGP Fingerprint: BA 0C 82 C5 F2 03 3D 95 7C CE FD D3 57 4E 15 73

Paul J. Ste. Marie wrote:
> 
> Joel W. Barrett wrote:
> >
> > ...
> > In essence, proxy servers are not designed to do NAT (Network
> address
> > translation). NAT is more a router or firewall process. NAT on a
> large network
> > is fairly CPU intensive because each and every packet the firewall
> or router
> > receives must be translated to a different IP address or tossed out
> or
> > rerouted.
> 
> Hmm? That's precisely what the MS Proxy server does--it filters
> packets
> and readdresses them so that they all appear to be coming from the
> proxy
> server.
> 
You could make a very definate distinction between NAT done by a 
router and what is done by a proxy.

NAT, as done by a router, will go through every packet and rewrite
the source and destination addresses of every packet going through 
it. Some devices will support a one to many translation, but other
only support one to one, with a table. 

A proxy doesn't rewrite the addresses in a packet in the same fashion.
A client will make a request for a connection to a proxy server. The
proxy server will then make this connection for the client, returning
the data. If you were to look through documentation for Microsoft's 
proxy, somewhere it would show an example of the client send a url of
http://proxy http://web.page.that.the.client.wants
the proxy server will then go get the page and bring it back.
No packets are actually sent directly from the client to the outside
server. All packet to the outside server are sent from the proxy 
server, all packets to the client are sent from the proxy server.
There are two connections taking place here.

This is not what a router doing NAT does. IT routes the packet, 
rewriting the addresses in the header.

> >
> > A proxy server merely allows or disallows external IP addresses to
> access your
> > network and allows or disallows internal IP addresses to access
> external
> > resources.
> 
> And, in the case of the MS product, logs access and provides
> permissions
> on a per-user basis.
> 
Various different proxies are built with various different abilities.
The Raptor firewall is built upon the technology of proxying all 
connection between networks. This is what the term Application 
Gateway refers to. Many other firewalls are designed the same way.
And they have much more functionality than stated above.

A proxy could easily be written to examine the contents of the
data in packets that it is sending. Many proxies used in firewalling
do this. As an example, an FTP proxy could all "gets" and prohibit
"puts", a SMTP proxy could prohibit EXPN, VRFY or WIZ commands from
reaching a mail server. 

Some firewall are designed to do packet fitering, and some routers
have this capability. Packet filtering looks at the source and
destination IP addresses and ports, and then decides whether or not 
to pass them through it. This is not what a proxy does. A proxy
will recieve the packet, and then decide whether or not to make the
requested connection.
> > -----Original Message-----
> > From: Darr Emery, Connie [SMTP:cedar@fgcu.edu]
> > Sent: Monday, June 16, 1997 12:34 PM
> > To: 'Joel W. Barrett'
> > Subject: RE: [NTSEC] MS Proxy Server
> >
> > Can you use MS Proxy server to do address translation from a set of
> 4
> > class "C" addresss (externally) to internal class "B" addresses?
> 
> Well, you'd normally just have a single external IP address, but
> otherwise the answer is yes.
All packets sent to the Internet would come directly from the proxy
server. The destination server would never see the address of the 
original client.
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
Wouldn't it just be easier to run scanprot.dot and then turn off the
macros? As long as you have normal.dot set to read only, none of those
nasties can autolaunch.

Al Castanoli | afcasta@texas.net | afn22800@afn.org
 | ah446@rgfn.epcc.edu | 
 "Computers save time like kudzu prevents soil erosion."

On Wed, 18 Jun 1997, Leonard Timmons wrote:

> I use Microsoft Word Viewer to prevent Word macro viruses
> from infecting my system. However, I cannot save a file
> using the viewer. I can, however, select the entire 
> document, copy it, and paste it into a new Microsoft Word
> document. Did I loose the viruses with this little
> maneuver?
> 
> -leonard
> 

Frank Knobbe wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On 16 Jun 97 at 23:17, Joel W. Barrett wrote about: RE: [NTSEC] MS
> Proxy Server
> 
> > In my opinion, since MS Proxy is most likely going to be installed
> > on a NT Server, I would prefer to see it inside the firewall and
> > also inside the network protected from the Internet by a Cisco
> > router. This is because NT has so many security problems that I
> > wouldn't trust anything running NT between my network router(s) and
> > the Internet. I would implement something like this depending on how
> > large the installation:
> 
> With the exception that we know more about NT security holes, and how
> to fix them, than Unix. Almost all CERT advisories reference to some
> kind of Unix. Having only one (ignoring Citrix) flavor of NT makes the
> platform more secure. But, hey, this is just my opinion anyway... so
> hold back the torch. I know where you coming from, I like Cisco too,
> but a router is a router. I can filter on a Bay router as well as on
> a Cisco, so brand name should be imperative.
>
Do you really think so ? That we know more about NT security holes ? I
for on do not. Every time a security hole is found in NT we have to
turn to M$ to fix it. We really have no clue what exactly is going on
in the system. Unless you have sold your soul to M$ for the NT source
code you really have no chance of truely understanding the security of
NT. You also need to look at the history of computer security. In the
begining computer security was to keep your systems in a physcally
secured area. As time when by time sharing systems were designed. UNIX
for example was not origionally intended to be a multi-user OS. And
when you take the history of UNIX and security, you are looking at how
computer security has thus far evolved. Yes there are more known
vulnerabilities in UNIX. But that is really a jadded view. There is
only one true UNIX. That is made by AT&T. SunOS, HPUX, AIX, Linux,
BSD, etc are all different flavors of UNIX and are by no means the same
OS. Just as VMS and NT are different even though NT is based largly on
VMS. When you say we as the security community know how to fix NT
security holes, you must truely be joking. With a few exceptional holes
such as the RedButton bug wich we could solve with permission/ownership
changes, we really have no control over patching NT security holes. 
Last week I had obtained a new vulnerability in UNIX's print spooler
program, lpr. I had it patched in less than 5 min. UNIX has evolved, 
been studied, and been attacked for over 20 years now. Of course there
will be more vulnerabilities. Now you look at NT, and it, over the
course of a year it has had more newly discovered security
vulnerabilities than most flavors of UNIX. You must also take into
consideration that this is being done with no available source code. We
dont know what it guts really look like. Then there is also the
extreamly large factor that it has not been scrutinized by hackers
nearly as much as UNIX. Right now the vast majority of the hacker
community has no clue how to use NT much more attack it. But this trend
has begun to change in the last year. They are starting to gain intrest
in the new game known as Windows NT. So as for more secure ? I think
you have been reading M$ sales pitches for far too long.

0x486578
> FTP would seem to provide a good mix between allowing students to access
> their files on one hand, but not being able to use or pirate
> applications from the lab servers from the comfort of their dorm rooms.

 Wait a second.. Am I missing something here (and the original message)
or why normal SMB sharing is not an option? Give the students access
only to their home directories - then they will not use any software
from the server. If students need some of the programs (with no fear of
exceeding licenses) give them access accordingly. Then give those people
who may use the licensed programs access to them as you see fit. If
there is a problem with number of used licenses, just limit the number
of users per share to equal the number of licenses the program under the
share has.

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
"Frank Knobbe" writes:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On 16 Jun 97 at 23:17, Joel W. Barrett wrote about: RE: [NTSEC] MS
> Proxy Server
> 
> > In my opinion, since MS Proxy is most likely going to be installed
> > on a NT Server, I would prefer to see it inside the firewall and
> > also inside the network protected from the Internet by a Cisco
> > router. This is because NT has so many security problems that I
> > wouldn't trust anything running NT between my network router(s)
> > and the Internet. I would implement something like this depending
> > on how large the installation:
> 
> With the exception that we know more about NT security holes, and
> how to fix them, than Unix.

Well... I suppose we could use some humour on this list for once. Or
maybe you're being serious.

> Almost all CERT advisories reference to some kind of Unix.

Mainly because CERT don't tend to issue advisories 'til they've been
fixed in a verifiable manner. I'm not even sure that their terms of
reference extend to NT.

> Having only one (ignoring Citrix) flavor of NT makes the platform
> more secure.

The number of flavours of an OS have the square root of fsck all to do
with said OS's security -- each OS is a separate entity. Ferinstance I
would never consider running IRIX on my firewall machine -- there are
too many documented holes, and those holes that I know about seem to
speak of a deeper malaise with the system as a whole -- so many
exploits for IRIX tend to use the same old techniques that have been
known about since forever. However, I would consider running something
like Solaris or Linux on the system -- Solaris because it has a good
reputation, Linux because it is the OS with which I am most familiar.
I can build a stripped down Linux installation in which I know what
every file and program does and what permissions it should have so
that when it gets hacked (however unlikely it may be you have to plan
for it happening) I should be able to spot what has happened, and
possibly catch it as it does happen (especially if I've gone the extra
mile to turn on logging of terminal sessions and the like captured to
another, inside the firewall, box).

NT on the other hand is /not/ well understood. Leaving the aside, for
the moment, the issue of source code availability, we have a problem
in that there is a vast amount of stuff in the WINNT directory and it
would be trivial to hide some extra stuff in there -- taking stuff out
of WINNT is not an easy option either, because you can never be
entirely certain what foo.dll does. Another point that worries me
greatly is Microsoft's attitude to security issues -- it seems to me
that, whenever a bug is found in one of the applications, or, more
seriously, the OS itself, the attitude seems to be to characterise the
people who found, and reported, the bug as no good hackers. This is
/not/ the way to win friends and influence people, nor is it the way
to get Internet security people to look upon your products with
anything other than an extremely jaundiced eye. The recent dropped
ball with the bugfix that wasn't didn't help in this respect.

Lack of source availability is definately my biggest bugbear
though. In a UNIX environment even if you don't have the source to the
particular applications that you have to deal with there are free
alternatives available for most of the standard utilities which are of
an astonishingly high standard and which come with source code so if a
security hole is discovered it is possible for you to patch and fix
that hole before your vendor gets its finger out. This is /very/ good
indeed. Current work on the bugtraq list includes work on making a
`wrapper' for any SUID program (The biggest risk on a UNIX based OS)
that will trap `dangerous' input before it has a chance to do
damage. On another front, people have been working on modifying the
Linux kernel so that, even if someone manages to induce a buffer run,
the results cannot be executed. This is important work, and I can't
help but think that it will be a cold night in hell before anyone
(except possibly for Microsoft) manages to do something similar for
NT.

> But, hey, this is just my opinion anyway... so hold back the
> torch.

Too late. 

> I know where you coming from, I like Cisco too, but a router
> is a router. I can filter on a Bay router as well as on a Cisco, so
> brand name should be imperative.

It's been said before and will be said again, but packet filtering is
only half a step towards an effective firewall. Let your router do the
basic filtering, your firewall should be using application
gateways. Sure it's a little more awkward but it's a /great/ deal more
secure.

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
Casey Roberts writes:

> Greetings, does anyone know of patches or quick fixes for NTS/W 4.0 ? 
> Thanks.

Insert the RedHat Boot floppy and CD-ROM. Reboot your system and
follow the instructions.

Or did you want to still have NT on your system when you'd finished?

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
Hi all,

>To those of you who are familiar with the book called "Windows NT
>Security Handbook, Everything You Need to Know to Protect Your
>Network.", by Tom Sheldon I have a question about chapter 18, section
>"Windows NT Home-grown Firewalls" page 489, the author discusses the
RAS method of connection your LAN to the internet. Basically routing
will be turned off on the dual-homed system and inbound connections can
>be controlled by using TCP/IP advanced security (i.e permitting access
>at the port level).
>
>This is the security method we'll like to use as we dial-up to our ISP.
>Unfortunately, this security feature only applies to physical adapters
>(our system obviously only has one network adapter) and you can't
>select the Remote Access WAN Wrapper adapter which relates to the
dial-up. Whereas the book seems to suggest that you can stop inbound
connection from the Internet over a dial-up connection. Therefore with a
>dial-up connection to the internet how can we provide this level of
>security??

To following on from this, as routing will be turned off we'll use the
>MS proxy server for internal access to the internet. Reading the proxy
documents it mentions that you can restrict inbound connection. Below is
>a newsgroups article, confirming this:

Subject: Re: Does proxy disable my web server?
From: "Mike Derrberry" 
Date: 1997/05/15
Message-Id: <01bc6141$0da99f80$6c36369d@stumpjumper2>
Newsgroups: microsoft.public.proxy
[More Headers]

MS Proxy 1.0, by default, turns off access to inbound connections
(Internet
connections). To enable your web server (must be on the same box as
proxy),
from within Web Proxy service properties\Services Tab. Turn on "Enable
Internet Publishing". This will open port 80 so that Internet clients
can
hit your website.
-- 
Mike Derrberry
Microsoft Corporation
mikeder@microsoft.com

Brent Pranger wrote in article
<#dMm8LIY8GA.141@uppssnewspub04.moswest.msn.net>...
> Does proxy server disable my webserver to the outside world? I have it
> running on our office's server. The proxy works, the intranet works, but
> when I try to access the WWW server on the proxy machine from the
internet,
> I get "The Server Returned an Invalid or Unrecognized Response"
> 
> Any ideas?
> 
> Thanks,
> Brent

Does anybody know exactly what this mean? Is it that the restrict of
inbound connections is at the service/application level (not the TCP/IP
level)? Is it that no connection is established due to the fact that no
program is listening on the various ports??

Sorry for the long post but if anybody can help I'd appreciated it very
much. The idea situation is if we could restrict access at the protocol
level, so that we can deny all and then turn on access to specific
port/applications.


Thanks for any replies or emails

Michael Dunphy


>


Not sure where to find a list of what your looking for, but you may
learn something from these sites:

http://www.emf.net/~ddonahue/NThacks/ntexploits.htm
http://www.ilinks.net/~486578/hack_NT/hacknt.html
http://www.ers.ibm.com/security-links/seclinks-lst.html
http://www.ntsecurity.com/
http://www.ntsecurity.net/ - which as a great list of URL's on bottom left
side frame

Kelly

On Thu, 19 Jun 1997, Peter Eckhardt wrote:

> 
> Hello,
> 
> i am coming from the "Unix World" and I don't have really deep
> knowledge about NT. Don't flame if my question sounds silly ....
> 
> 
> We recently changed all our PC clients (around 50) from
> DOS, Win3.11 and Win95 to NT4 SP3 to make Administration easier.
> (NT Server and SMS will be installed, too). Everything works
> really nice now. Interaction with our Unix servers is terrfic.
> Support calls are mostly eliminated, no more crashed Windows ...
> 
> 
> There is only one problem. Unix systems usually come with restricted
> access on system files so the Joe User can not delete, overwrite
> or change them accidentially. NT comes with completely open permissions.
> 
> I would like to prevent our Users from accidentially damaging their
> workstations but don't have the knowledge which permissions to
> give on the various dlls and exes in the system directories.
> 
> Did anyone compile a list of how to set access permissions on the system
> files that accidential destruction of the workstation is difficult ?
> 
> Any pointers are greatly appreciated.
> 
> Thanks
> 
> Peter
> 
> (Even if I love my Unix servers, I love my NT clients, too ....) Peter
> Eckhardt Tel. +49 6071 925130
> RGW Express Airfreight GmbH Fax +49 6071 925140
> Gebaeude 638 Mail dbadm@rgw-express.de
> Cargo City Sued
> D-60549 Frankfurt Main Flughafen
> 

At 07:51 PM 6/18/97 -0500, you wrote:
>Greetings, does anyone know of patches or quick fixes for NTS/W 4.0 ? 

Hey, check out http://www.secant.net for WinNT instructions.


>Casey Roberts

Ken Harris
Automatic configuration of WINS replication...

New feature in 4.0

Eric

At 04:43 PM 6/18/97 -0600, Frostie Sprout wrote:
>What security issues surround the NT multicast group 224.0.1.24? I see it
>leaving an NT network onto the MBONE - even when nothing is participating
>in a group. For now, I'm stopping it - but what is it for? What security
>holes does it leave?
>
>Frostie
>--
>Frostie Sprout Frostie@wyoming.com Voice: 307.856.4220
>System Engineer, wyoming.com LLC FAX: 307.856.1499
> Wyoming's Leading Internet Service Provider
>Opinions are mine and do not necessarily reflect those of wyoming.com
>A. Einstein--"God might be subtle, but He is never malicious."
> "Albert! Stop telling God what to do!"--E. Fermi
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
>> From: "Gina M. Wheeler" 
>> Subject: Re: [NTSEC] controlling access to shared resources with MSWNT
 4.0+

>> 
>> Am I missing something? I thought that the original message asked if there is
>> a way to keep people from accessing NT servers UNLESS they were at certain 
>> designated systems. I know that UNIX can do this. Is there a way that NT can
>> do this? I also want to keep the students in their DORM rooms from getting
>> access
>> to servers that they have access to from a designated lab.

No, you're not missing something. Your restatement of the question is
correct. My initial message was apparently unclear. I'll restate:

* I want to install software on lab servers so that I don't have to install
 it on every machine in the lab.

* I want my students to be able to access software on the lab file servers
 when the students are using machines in the lab.

* I want to allow system staff to access the filesystems of the lab file
 servers from a handful of admin machines (i.e., I want to install stuff
 from the client in my office for use by clients in the lab).
 
* I do *not* want anyone on a machine that is not in the lab (or on the
 handful of admin machines) to be able to access the software.

* the lab file servers do not provide home directory service so access
 to home directories is not relevant to this particular question. The
 lab servers are domain controllers and, if I can figure out how to do
 this legally, software package servers.

* I"d *like* to do this with stuff that is a part of the MSWNT v4.0 
 distribution but ...
 
* I suspect that I will need some sort of firewall or proxy software to
 accomplish my goal, which is why I ask this question on the NT Security
 list
 
Does anyone have a solution to share or suggestions of the appropriate
software to investigate?

 David
-- 
David Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
Box 3241, Station B |Disclaimer: I have no authority
Nashville, TN, USA 37235 |to speak for anyone but myself.
 "Export crypto, not jobs." - Daniel Lynch
 http://www.vuse.vanderbilt.edu/~drl

 
Joel,

On Sat, 14 Jun 1997, Joel W. Barrett wrote:

> found a parameter in Proxy of RAS Dial-up which will disconnect after a 
> predefined period of time of inactivity. I will find something soon though. The 
...
> I agree that there are many products out there for dial-up proxy use that are 
> currently viable alternatives to MS Proxy. I was using WebEtc until it expired 
> about a week ago.

Something that doesn't look like it will expire (prices are mentioned in
any_currency): 

linux with or w/o masquerading in its kernel : 0
squid : 0
diald : 0

Beware though: this is quite general, there is a latency between the
moment someone asks for a not-yet-cached page when the modemlink is "down"
and actually getting the page through. At least 30 seconds you should
take, for handshaking with the other modem.

Take ISDN and you won't be able to tell whether it was from the line or
from the Net.

kr=
 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)





On Fri, 13 Jun 1997, Patrick Sanger wrote:

> that wouldn't be a netscape security hole that would be a winnt hole. 
> the netscape process is running on behalf of the user that started it, 
> so just like any other program it would have the same access rights as 
> the user running it. this doesn't lessen the risk because most of us are 
> logged on as Administrator anyway.
> 
> Patrick

Most of us aren't so foolish. You should not use an admin/root account
unless it is necessary, and never for things like web browsing. This is
not NT-specific; no good UNIX sysadmin logs in as root for non-root
activities either; this is fairly standard as a security practice.

Set up a standard user account for yourself, and only use admin
privileged accounts when you must. 

-r.w.

The timeout setting is controlled from within RAS, not the Proxy Server.
Go to Dialup Networking | More | User Preferences to set a timeout.

If you are using ISDN, I suggest using an Ascend Pipeline (with the
Secure Access Firewall) instead of an ISDN modem since it is more secure
and just works better. I have found that RAS gets broken very easily
and is therefore not as reliable. You will need an account with an ISP
that can give you 2 IP addresses, one for the Pipeline and one for the
Proxy Server. We resell fully configured units for about $1,300 if
anyone is interested.

Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
 Sent: Saturday, June 14, 1997 4:05 AM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server


 Ok, here is one question for you! :)

 On one location, I setted up MS Proxy, the same way you did.
Small group
 of NT stations go to internet trought dial up proxy machine. I
even
 enabled that auto connect thingie inside ms proxy. The problem
is.... when
 someone from the group want's to access some website, he
contacts ms
 proxy, ms proxy then dials internet, and there you have it. You
are on
 internet. BUT, I haven't been able to DISCONNECT it automaticaly
eather
 (eg. after 5 minutes of inactivity). Is this like but withing NT
or MS
 Proxy?

 I used similar (crippled) software for same purpose: Wingate. It
worked
 like a dream. And it didn't cost so much. ;)


 Thanx in advance
 Neven

To use the Winsock Proxy, the workstation must be using a Microsoft
Client and be logged in to the MS domain because it needs access to the
\\proxy\mspclnt share on the Proxy Server. A workstation can still use
the Web Proxy without using the MS Client. You can test this by
removing access rights to Users or Everyone and trying to use a Winsock
application as a Domain User, then try it as a Domain Administrator. I
discovered this by accident and confirmed it with MS tech support.
Sorry for the wrong answer!


Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Nick Keenan [SMTP:nick@gsionline.com]
 Sent: Friday, June 13, 1997 11:28 AM
 To: ntsecurity@iss.net
 Subject: [NTSEC] MS Proxy server and mapped links/plugs

 [This is a rephrasing of an earlier question that got no
responses] 

 I have a client who is using MS Proxy server, and wants to use
non-Windows
 clients. Is it possible to set up MS Proxy server so that you
don't need
 to use the ms-proxy client -- i.e. to use SOCKS or mapped links?

 Any clues are appreciated.

 Thanks


Okay...here's a good one. I recently took an abbreviated Proxy course
and one thing that was unclear to all present was....since MS Proxy is
NOT a firewall, it will in most case work in line with a firewall.
 
Question: Should the proxy server be on the outside of the firewall? 
If so, does it affect the ability of a firewall that does Network
Address Translation. In this case the firewall is passing to the Proxy
server a single IP (I presume). Is it able to keep the individual
sessions separate?

The same sort of question also exists if you put the proxy server on the
inside of the firewall. If the proxy server is passing off (the
presumed) single IP, how does the firewall keep track of the sessions of
the (800) internal clients on our network?


Noone at the session (including the instructor) had a good grasp of how
the MS Proxy fits within a traditional "Outer DMZ" architecture. If you
have any input on this, I'd be interested.....


Jack LeGrand
jackl@infi.net


****************************************

Joel W. Barrett wrote:
> 
> I installed MS Proxy Server last night and will eventually take the MS test for
> it. I need to learn as much about it as possible so if anyone has questions
> about it I'd be happy to figure out the answer for you.
> 
> I am currently using it as a network address translation (NAT) and dial-up
> solution for a small home network with limited Internet accounts. It seems to
> work very well. It did require MS IIS to be installed prior to its installation
> but that was not a major hassle.
> 
> I can now do an internal FTP site, Intranet Web services, and a Gopher server
> if I wanted.
> 
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!

-- 
Jack LeGrand
TeleGrand Technologies
jack.legrand@telegrand.com
A Strategic Business Partner of Blue Ridge Interactive
This may not apply but with RAS you can set the inactivity timer (I
believe - I am not at the server right now) under Control Panel-Modem.

jack

Joel W. Barrett wrote:
> 
> I am working on an answer for the exact same question you posed. I haven't yet
> found a parameter in Proxy of RAS Dial-up which will disconnect after a
> predefined period of time of inactivity. I will find something soon though. The
> problem is that Proxy is so new that there aren't many things written about it
> yet.
> 
> I agree that there are many products out there for dial-up proxy use that are
> currently viable alternatives to MS Proxy. I was using WebEtc until it expired
> about a week ago.
> 
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!
> 
> -----Original Message-----
> From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
> Sent: Saturday, June 14, 1997 5:05 AM
> To: Joel W. Barrett
> Cc: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA MCSE Study
> Group (E-mail)
> Subject: Re: [NTSEC] MS Proxy Server
> 
> On Fri, 13 Jun 1997, Joel W. Barrett wrote:
> 
> > I installed MS Proxy Server last night and will eventually take the MS test
> for
> > it. I need to learn as much about it as possible so if anyone has questions
> > about it I'd be happy to figure out the answer for you.
> >
> > I am currently using it as a network address translation (NAT) and dial-up
> > solution for a small home network with limited Internet accounts. It seems to
> > work very well. It did require MS IIS to be installed prior to its
> installation
> > but that was not a major hassle.
> >
> > I can now do an internal FTP site, Intranet Web services, and a Gopher server
> > if I wanted.
> 
> Ok, here is one question for you! :)
> 
> On one location, I setted up MS Proxy, the same way you did. Small group
> of NT stations go to internet trought dial up proxy machine. I even
> enabled that auto connect thingie inside ms proxy. The problem is.... when
> someone from the group want's to access some website, he contacts ms
> proxy, ms proxy then dials internet, and there you have it. You are on
> internet. BUT, I haven't been able to DISCONNECT it automaticaly eather
> (eg. after 5 minutes of inactivity). Is this like but withing NT or MS
> Proxy?
> 
> I used similar (crippled) software for same purpose: Wingate. It worked
> like a dream. And it didn't cost so much. ;)
> 
> Thanx in advance
> Neven
> 
> >From owner-bsdi-users@lists.firehouse.net Sat Jun 14 12:33:33 1997

-- 
Jack LeGrand
TeleGrand Technologies
jack.legrand@telegrand.com
A Strategic Business Partner of Blue Ridge Interactive


----------
From: owner-ntsecurity@iss.net on behalf of Paul D. Robertson
Sent: Saturday, June 14, 1997 5:42 AM
To: James Strompolis
Cc: Meka Egwuekwe; ntsecurity@iss.net
Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug

On Sat, 14 Jun 1997, James Strompolis wrote:

> They said they wanted money. Can't say I blame them. Probably costing 
> Netscape $10,000s to find it if they can. They should have coughed up the 
> dough.

That's akin to saying that if you spot a bomb in a train station you 
should be able to collect money for warning the authorities from all of 
the potential victims families. After all, they'd certainly pay well for 
the privilige of living, and it would cost the govenrment quite a lot to 
search all the train stations within fifteen minutes.

It's simply mercenary extortion, and Netscape shouldn't "cough up". The 
logical offshoot of this is someone charging companies to protect them 
from every single buglet in every single application under NDA, so the 
vendor never learns of the vulnerability. This is *not* a good trend.

As much as I hate to see Netscape with potential holes, I applaud them for
standing their ground.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280


Thanks for the suggestion. I did find the Idle Seconds before Hanging Up 
selection. I set mine to 480 secs (8 mins). I'll have to see how that works and 
adjust it up or down depending on convenience.

As far as the Ascend Pipeline ISDN router goes... I still have to get ISDN 
first and then I would probably implement a Cisco ISDN Router over the Ascend 
due to personal preferences. I really like how you slipped that plug in there 
for your company... not.

Joel

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: David Tyree [SMTP:davetyree@youngtree.com]
Sent: Saturday, June 14, 1997 4:50 PM
To: 'Neven Jacmenovic'
Cc: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] MS Proxy Server (RAS not disconnecting)

The timeout setting is controlled from within RAS, not the Proxy Server.
Go to Dialup Networking | More | User Preferences to set a timeout.

If you are using ISDN, I suggest using an Ascend Pipeline (with the
Secure Access Firewall) instead of an ISDN modem since it is more secure
and just works better. I have found that RAS gets broken very easily
and is therefore not as reliable. You will need an account with an ISP
that can give you 2 IP addresses, one for the Pipeline and one for the
Proxy Server. We resell fully configured units for about $1,300 if
anyone is interested.

Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
 Sent: Saturday, June 14, 1997 4:05 AM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server


 Ok, here is one question for you! :)

 On one location, I setted up MS Proxy, the same way you did.
Small group
 of NT stations go to internet trought dial up proxy machine. I
even
 enabled that auto connect thingie inside ms proxy. The problem
is.... when
 someone from the group want's to access some website, he
contacts ms
 proxy, ms proxy then dials internet, and there you have it. You
are on
 internet. BUT, I haven't been able to DISCONNECT it automaticaly
eather
 (eg. after 5 minutes of inactivity). Is this like but withing NT
or MS
 Proxy?

 I used similar (crippled) software for same purpose: Wingate. It
worked
 like a dream. And it didn't cost so much. ;)


 Thanx in advance
 Neven

On Sat, 14 Jun 1997, David Tyree wrote:

> The timeout setting is controlled from within RAS, not the Proxy Server.
> Go to Dialup Networking | More | User Preferences to set a timeout.

heh, this is where the problem is. i can enter *ANYTHING* there, but my
modem just won't hangup damn connection... what would happen if my modem
wouldn't be extern modem so I couldn't see those little flashing lights? I
would have to connect with ras administrator every not and then?

I checked my modem settings, and everything is allright... it just seems,
like proxy just won't IDLE... I haven't sniff any packets, but I supose
that is the next logical step to do... Any help STILL needed :)

Thanx in advance
Neven

On Sat, 14 Jun 1997, Kevin Manderson wrote:

> Query:
> 
> If a server is running Bind V4.9.4 P1 can it be set to non recursive
> responses to fix the problem?
Yes. But you may do it only on root servers...
:)

 Best wishes, Eugeny Kuzakov
 Laboratory 321 ( Omsk, Russia )
 kev@lab321.ru

 Is there some reason the set-up of the initial TCP packet (Syn-Ack)
can not include an Initial Sequence Number (ISN) which is varied by some
random or pseudo-random incriment from the previous ISN?

 An unpredicable ISN would obviously foil "blind" (non-sniffing)
sequence number attacks -- and all other attacks which presume the
incrimental change in the ISN is predictable. (The PRN generator might
also be constrained by some formula that minimizes the potential for
simultaneous sessions using packets with identical ISNs.)

 Comments, pedantic or otherwise, would be welcome.

 A friend of Curious George,

 _Vin
-------------
David LeBlanc wrote:

>I had previously stated that NT was TCP sequence predictable. In response
>to a question, I did a bit of research on our network and found the following:
>
>This is largely fixed in SP3. Instead of being from 15-85% predictable, it
>is now from 5% to ~20% predictable. This is fairly reasonable.
>
>For comparison, IRIX, HP-UX, SunOS, and AIX are all _extremely_ predictable
>- 50% or better on a consistent basis. BSD is typically very predictable.
>
>However, Linux and Solaris are best at this, and are consistently 5%
>predictable or less. I would like to see NT join this group, but SP3 shows
>a substantial improvement.


 Vin McLellan + The Privacy Guild + 
 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548
 -- <@><@> --


Is it possible that the card send physical a lots of interrupts ?

-----Original Message-----
From: Paul Robichaux [SMTP:paul@ljl.com]
Sent: Freitag, 13. Juni 1997 23:20
To: Nash, Jason X
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] New RPC 100% CPU Bug?

>We have some computers showing 99-100% CPU utilization on the RPC
>service again. These are NT 4.0 w/ Service Pack 3. Anyone know of any
>new exploits on this? I haven't heard of anything.

I had this problem when I booted an NTW 4/SP3 machine with a specialty PC
card in its reader. The card didn't have a driver installed. WHAM! As soon
as I logged in, RPC started using 100% of CPU. If I logged in without the
card, no problem. Once I installed the driver, everything was normal.

The machine was a Dell Optiplex with their SMC internal card cage, running
NT4 1381 with SP3 and no hotfixes. Beats me why it was doing that; I'm just
glad it stopped.

Cheers,
-Paul

--
Paul Robichaux | LJL Enterprises, Inc.
paul@ljl.com | We didn't invent e-mail; we just make it secure.
 |
Author, _Windows NT Server 4 Administrator's Guide_, ISBN 0761507515 (Prima)

There is no need to test this bug, as all versions of netscape are
vulnerable. What you need to do is make sure that when you are browsing
the web that you use a user with very little permissions, I would also
suggest that when creating this user you give it its own group. One of
the huge problems is that most admins browse the web logged in as
Administrator so once they run Netscape it then inherits thier
permissions and becomes god of that computer, thus allowing the attacker
at www.evil.org to grab virtually any file off browserbox.victim.com. 

0x486578


Eigenheer Patrik, EIP wrote:
> 
> Hi I have here some users they running a Netscape version of browser,
> do u know how I can "test" these bug ?
> Somebody say u have to be a administrator to do that, why ?
> If these hole really exist, I think it's better to move to ie :-( !?!?
> 
> Tnx, hand have a nice day
> Patrik
> 
> -----Original Message-----
> From: Patrick Sanger [SMTP:pcslist@hotmail.com]
> Sent: Samstag, 14. Juni 1997 02:02
> To: ntsecurity@iss.net
> Cc: mcdermott@itd.nrl.navy.mil
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> that wouldn't be a netscape security hole that would be a winnt hole.
> the netscape process is running on behalf of the user that started it,
> so just like any other program it would have the same access rights as
> the user running it. this doesn't lessen the risk because most of us are
> logged on as Administrator anyway.
> 
> Patrick
>
I dont know if the proxy software itself has security holes. Any
software misconfigured has the potential to do so. The problem with any
proxy, is not so much in the proxy software of choice but in the
security of the security of the system as a whole. If I can hack into
your proxy server with a filesharing hole then your proxy is useless. 
Also I could be wrong on this (But most likely not), but a proxy will
not safeguard you against most web browser attacks. I personally use a
proxy on my local system for HTTP. This proxy allows me to stop people
from obtaining information from my browser such as what browser it is
what OS i am using and where I am comming from. This proxy, and many
others as well, is also designed to stop others from tracking you
through the use of cookies. This however, can and is overcome by many
cleaver web developers who have found other ways of sending you cookies
which are not as easy to filter. As with the recient Internet Explorer
and Netscape bugs, these can be even more difficult to stop. For
example the IE password grabbing scemes you can stop them by preventing
traffic through ports 137-139 (SMB over TCP). Now with the newly
discovered Netscape hole the problem gets even more tricky. For the
moment we are missing most all key technical details, but we do know
that the problem exhists in clever usage of RAW HTML, which would defeat
the security mechinisms of any known proxy. This will be filterable but
by the time anyone knows what to filter out, netscape will be patched.
So in closing, you really dont have to worry about your current proxy
for there really isnt a feasable solution to many of these problems
other than to sit and wait for the patches to come out.

0x486578

Ken Anthony wrote:
> 
> Has anyone ever heard anything bad about this proxy server?
> ( like ways to break into a system using it? )
> WinProxy http://www.lanprojekt.cz/winproxy/
> 
> I've been using it at home for about 6 months, and it works great, but with
> the
> recent 'Netscape' discoveries, my company feels a more well known
> (ie: more expensive and harder to configure) proxy / firewall would be a
> safer choice.
> 
> We would use Microsoft's proxy if it had a POP/SMTP gateway.
> As far as I know, you have to install exchange server to get mail to work,
> and really don't need exchange server.
> 
> Thanks..
> Ken Anthony
You don't need to goto IE because the bug. In security, there is no one
who can claim he is safe :-) Just make sure you don't have any impact
>from this bug.

Just follow netscape instruction to disable this bug. Not really disable,
but at least to know when someone try to get anything from your computer.

This is the URL:
http://home.netscape.com/misc/security_update.html

 The bug in Netscape is purported to rely on HTML... which gets through any 
proxy/firewall that is configured to allow web browsing and doesn't use any 
special filtering of HTML content.

 Assuming you're using NT, we've used WinGate (www.deerfield.com) and MS 
Proxy on various client's systems and have found both to be reliable and as 
safe as we so far know. Can't speak from any experience regarding WinProxy. 
We haven't logged any confirmed penetrations... yet. Definitely block access 
to ports 137-139 with some type of filtering router in front of the NT box and 
most of the serious problems found so far will be blocked. I'd block access 
to everything but HTTP, FTP and SMTP to start and then open things up as you 
hear complaints, assuming they're justifiable relating to security and 
business use of your network. Block source routing and block incoming (from 
the net) packets that claim to be from your internal subnet. The router is a 
better place to spend your company's money if you don't yet have one and then 
get it properly configured by someone that has experience with that particular 
brand of equipment. Your ISP may be of some help there. Just my opinion.

----------
From: owner-ntsecurity@iss.net on behalf of Ken Anthony
Sent: Monday, June 16, 1997 1:22 AM
To: ntsecurity@iss.net
Subject: [NTSEC] *Safe* Proxy server?


Has anyone ever heard anything bad about this proxy server?
( like ways to break into a system using it? )
WinProxy http://www.lanprojekt.cz/winproxy/

I've been using it at home for about 6 months, and it works great, but with
the 
recent 'Netscape' discoveries, my company feels a more well known 
(ie: more expensive and harder to configure) proxy / firewall would be a
safer choice.

We would use Microsoft's proxy if it had a POP/SMTP gateway.
As far as I know, you have to install exchange server to get mail to work,
and really don't need exchange server.

Thanks..
Ken Anthony

On Fri, 13 Jun 1997, Bryan K. Fite wrote:

> I have been actively looking for some verification of this exploit. I'm
> not saying it doesn't exist. But it is very strange the way it was
> handled. If I were the paranoid type, I would be very concerned by the
> motivation behind the story. Why tell the press and not Netscape?


Apparently, the firm which claims to have found the bug thought 
netscape's standing offer of $1000 and a t-shirt to be too small. When 
netscape refused to up the price, the information was withheld.



 ----------------------------------------------------------
 Life may not be fair, but root access sure makes it easier
 Malachi Kenney kfringe@infi-pos.com

I too think that it is quite strange the way this was handled. And I
have a slew of questions. Perhaps that Danish company was trying to get
it's name out there? Perhaps they want to embarass Netscape for some
reason? Since the details of the bug are not being released yet, how
can it be verified? So why go to the press instead of a forum like this
one? Surely there was some motive.

Meka Egwuekwe



Bryan K. Fite wrote:
> 
> I have been actively looking for some verification of this exploit. I'm not saying it doesn't exist. But it is very strange the way it was handled. If I were the paranoid type, I would be very concerned by the motivation behind the story. Why tell the press and not Netscape? If indeed it effects all previous versions, we have been very slow to catch it (too preoccupied with M$?). Is this how information of this nature will be handled in the future? It's great that security is finally getting so
> 
> Thanks,
> Bryan K. Fite
> www.secure-it.net


> ----------
> From: Matt Simmons[SMTP:simmonmt@cs.purdue.edu]
> Reply To: Matt Simmons
> Sent: Thursday, June 12, 1997 2:41 PM
> To: Steve Sutton
> Cc: Paul Leach; ntsecurity@iss.net; 'Allan Bourdius'
> Subject: Re: [NTSEC] Installing programs on NT Workstation
> 
> Steve Sutton writes:
> > Ture. And frightening. The point is that once a malicious program
> runs
> > in an administrative session there are (at last count) 19,367 ways
> it
> > can completely subvert that computer's and perhaps the network's
> > security (can you say "session hijacking"). PASSFILT is certainly
> one of
> > the easier ways to do so. This is not, BTW, an indictment of Windows
> NT.
> > It's as security-sound as any commercial operating is likely to be
> in
> > our lifetimes. The problem is that it's very, very easy to download
> a
> > Trojan Horse in today's seamless, transparent, world-wide-webbed
> > community. Without a "sandbox" for the horse's activities, these
> kinds
> > of attacks are "easy pickin's."
> 
> This should be an indictment of Windows NT. (Yes, this is an flame).
> It's ridiculous to require administrator priviliges for most software
> installs. This, AFAIK, is brought about by the apparent preference in
> 
> the Windows world for leaving droppings everywhere. There is no
> reason why programs shouldn't be able to put themselves in a single
> (user-defined) directory. This would allow Joe User to install his
> own programs in his home directory, as himself, without having any of
> these security concerns.
> 
If it were true that applications for Windows were like UNIX "ls" or
"awk" or "grep", then what you say would be correct. And to the extent
that they are, it is possible in NT to install them so that they are
"per-user", and it might be acceptable to let random users install them
(see the last paragraph below).

But Windows apps are not monolithic statically linked single executable
files; they are collections of dynamically linked libraries (DLLs),
called from a main executable. Some of these DLLs can be shared. For
example, there is a library of common C++ classes that some but not all
apps use, a library of APIs to support HTTP and FTP, a library for SSL,
one for sockets, one for OLE, and one for common UI elelments, like the
file open dialog. Apps want them to be shared for a variety of reasons:
save space, or because they fix bugs, or because they are a way to ship
enhanced functionality in a system service needed by the application.

Apps install these in a shared place, and these are the ones that have
the potential to be a trojan horse. So, only trusted people should be
allowed to install them.

One other point -- if Joe User has the right to install programs in his
own directory, and nowhere else, then he can't trojan an admin who logs
into his machine, but he can still be trojaned by stuff he downloads
from the net.

Paul
Most things are shareware as opposed to Freeware but give the following a try :>

Port Scanners : Try Network Toolbox which has one built in as well as finger,
ping etc. Excellent. www.jriver.com. Also
there is portscan pro and fastscan.
Packet Sniffers : Session Wall is excellent www.abirnet.com. Very good filters
an excellent GUI. Others are etherpeek and netxray (shareware only gets first 5
packets).

regards,



Mark Curphey


On Fri, 13 Jun 1997, Bryan Swann wrote:

> I run the port scanners from a UNIX box. The web site www.rootshell.com
> has lots of good tools. Actually, I don't have a need for a sniffer just
> yet, but I there are several free ones available for UNIX systems. If you
> are on a budget, download Linux and load it on a PC with at least a
> pentium processor and 16MB of RAM.
> 
> I'm unawre of any sniffers for NT. Since you can get source code for
> sniffers, I'm sure they could be ported to NT. There are propably
> sniffers already available. Hopefully someone else will comment on these.
> 
> __________________________________________________________________________
> | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> | Eagan McAllister Associates, Inc. |
> | |
> | "Everything must be working perfectly, cause I don't smell any smoke" |
> --------------------------------------------------------------------------
> 
> On Fri, 13 Jun 1997, Ron Schreiner wrote:
> 
> > What port scanners and sniffers do you have? Are they freeware? Where can
> > I get them? I deperately need them myself. Help, please.....
> > 
> > On Thu, 12 Jun 1997, Bryan Swann wrote:
> > 
> > > I'm involved in evaluating the security of several networks. Being
> > > experienced with UNIX, I have several FREE tools that I use to test a
> > > range of IP addresses over the network. I have seen a few FREE tools for
> > > NT, but they either run only on the machine that they reside or they have
> > > a GUI interface that forces you to access each machine individually. Are
> > > there FREE tools for doing some basic checks on NT boxes? Where can I
> > > find them? I don't mind writing a little code to help automate the
> > > process of using a tool, as long as it has a command line interface.
> > > 
> > > I already have port scanners and sniffers, so I'm not interested in these.
> > > 
> > > TIA
> > > 
> > > __________________________________________________________________________
> > > | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> > > | Eagan McAllister Associates, Inc. |
> > > | |
> > > | "Everything must be working perfectly, cause I don't smell any smoke" |
> > > --------------------------------------------------------------------------
> > > 
> > 
> > 
> 

I run the port scanners from a UNIX box. The web site www.rootshell.com
has lots of good tools. Actually, I don't have a need for a sniffer just
yet, but I there are several free ones available for UNIX systems. If you
are on a budget, download Linux and load it on a PC with at least a
pentium processor and 16MB of RAM.

I'm unawre of any sniffers for NT. Since you can get source code for
sniffers, I'm sure they could be ported to NT. There are propably
sniffers already available. Hopefully someone else will comment on these.

 __________________________________________________________________________
| Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
| Eagan McAllister Associates, Inc. |
| |
| "Everything must be working perfectly, cause I don't smell any smoke" |
 --------------------------------------------------------------------------

On Fri, 13 Jun 1997, Ron Schreiner wrote:

> What port scanners and sniffers do you have? Are they freeware? Where can
> I get them? I deperately need them myself. Help, please.....
> 
> On Thu, 12 Jun 1997, Bryan Swann wrote:
> 
> > I'm involved in evaluating the security of several networks. Being
> > experienced with UNIX, I have several FREE tools that I use to test a
> > range of IP addresses over the network. I have seen a few FREE tools for
> > NT, but they either run only on the machine that they reside or they have
> > a GUI interface that forces you to access each machine individually. Are
> > there FREE tools for doing some basic checks on NT boxes? Where can I
> > find them? I don't mind writing a little code to help automate the
> > process of using a tool, as long as it has a command line interface.
> > 
> > I already have port scanners and sniffers, so I'm not interested in these.
> > 
> > TIA
> > 
> > __________________________________________________________________________
> > | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> > | Eagan McAllister Associates, Inc. |
> > | |
> > | "Everything must be working perfectly, cause I don't smell any smoke" |
> > --------------------------------------------------------------------------
> > 
> 
> 

>We have some computers showing 99-100% CPU utilization on the RPC
>service again. These are NT 4.0 w/ Service Pack 3. Anyone know of any
>new exploits on this? I haven't heard of anything.

I had this problem when I booted an NTW 4/SP3 machine with a specialty PC
card in its reader. The card didn't have a driver installed. WHAM! As soon
as I logged in, RPC started using 100% of CPU. If I logged in without the
card, no problem. Once I installed the driver, everything was normal.

The machine was a Dell Optiplex with their SMC internal card cage, running
NT4 1381 with SP3 and no hotfixes. Beats me why it was doing that; I'm just
glad it stopped.

Cheers,
-Paul

--
Paul Robichaux | LJL Enterprises, Inc.
paul@ljl.com | We didn't invent e-mail; we just make it secure.
 |
Author, _Windows NT Server 4 Administrator's Guide_, ISBN 0761507515 (Prima)


> >I have been actively looking for some verification of this exploit.
> >I'm not saying it doesn't exist. But it is very strange the way it
> >was handled.
> 
> I was able to find links from the CNN home page http://cnn.com and
> Netscape's home page... There seems to be something there worth
> looking
> closer... how much remains to be seen. Here are the articles I found
> (URLs
> may have a very short life)...
> 
> Netscape Security Update:
> http://home.netscape.com/misc/security_update.html
> 
> CNNfn: Netscape bug uncovered: Danish software firm finds flaw that
> could
> let sites see data stored on PCs
> http://cnnfn.com/digitaljam/9706/12/netscape_pkg/
> 
> PC Magazine Online: Netscape Security Flaw: A bug lets curious
> webmasters
> read files from your hard disk when you surf with Navigator.
> http://www8.zdnet.com/pcmag/news/trends/t970612b.htm
> 
> 
> ps. It may be tradition that firms rush to market with often buggy
> products, to maximize their profits, and their customers hassle with
> (and
> pay for) the impact of the bugs. My heart goes out to anybody who says
> "hey-wait a minute!"

There seems to be another link that I have found that mentions this,
It is from Mercury Center, however I'm not sure what Mercury Center is
http://www.sjmercury.com/business/netscape061297.htm

It tends to put the story is a slightly different light that the others
from PC Magazine and CNN.

By the way, has anyone considered the possibility of the javascript
"mailto:" function attaching a file without any user input?
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
They said they wanted money. Can't say I blame them. Probably costing 
Netscape $10,000s to find it if they can. They should have coughed up the 
dough.

----------
From: owner-ntsecurity@iss.net on behalf of Meka Egwuekwe
Sent: Friday, June 13, 1997 10:25 AM
To: Bryan K. Fite
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

I too think that it is quite strange the way this was handled. And I
have a slew of questions. Perhaps that Danish company was trying to get
it's name out there? Perhaps they want to embarass Netscape for some
reason? Since the details of the bug are not being released yet, how
can it be verified? So why go to the press instead of a forum like this
one? Surely there was some motive.

Meka Egwuekwe



Bryan K. Fite wrote:
> 
> I have been actively looking for some verification of this exploit. I'm not 
saying it doesn't exist. But it is very strange the way it was handled. If I 
were the paranoid type, I would be very concerned by the motivation behind the 
story. Why tell the press and not Netscape? If indeed it effects all previous 
versions, we have been very slow to catch it (too preoccupied with M$?). Is 
this how information of this nature will be handled in the future? It's great 
that security is finally getting so
> 
> Thanks,
> Bryan K. Fite
> www.secure-it.net

This is the information that I have on 
the Netscape story. It seems that they do not want to let him talk to the 
person that is in charge of the Bug Reward that Netscape has...

MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1997 
JUN 13 (NB) -- By Patrick McKenna. "Let me talk to the guy with the 
checkbook," wrote an unnamed Danish programmer who created a non-public 
World Wide Web site which allows the site operator to copy files from the hard 
disk of any user of Netscape's [NASDAQ:NSCP 
] Web browser Navigator accessing the site. He contacted Netscape through e-mail 
earlier this week, but refused to divulge his Navigator bug-find for a customary 
Netscape fee of $1,000.
"We want all Navigator users to know that we take all bug reports 
seriously and our engineers are working on this problem right now," began 
Netscape spokesperson, Jennifer O'Mahoney. "At this time, there are no 
reported incidents of this reported bug affecting any Navigator user accessing 
public or intranet Web sites. The probability of it affecting these users is 
very low. "

According to Netscape, communication with the programmer has been limited to 
e-mail. After refusing to put him in touch with the "guy with the 
checkbook," Netscape was warned the information would be revealed to the 
media. Cable News Network (CNN) was contacted by the programmer and given a 
demonstration of the bug through a non-public Web site designed by the 
programmer. The bug was confirmed by PC Magazine.

Although Netscape has not been able to internally examine and confirm the 
"briber bug," the Internet/intranet software developer has assumed the 
CNN demonstration was successfully completed.

According to reports, from the programmer and CNN, a navigator user visiting 
the site in question opens his or her hard disk to the operator. The site 
operator, however, must know specific file names to access any information on a 
user's hard disk. Which version or versions of Navigator are susceptible to the 
bug are currently unknown, but one report says the Dane claims version 2.0 and 
all later versions contain the programming flaw.

The Dane chose to pressure Netscape during the company's developer conference 
in San Jose, California. In spite of the timing, Netscape remained adamant in 
its response. "We will not be blackmailed or allow an individual or group 
to hold us hostage," added O'Mahoney.

She also told Newsbytes, "We will keep everyone posted of this situation 
throughout the today and following days on our Web site (http://home.netscape.com )." Once on 
Netscape's home page click on "Flash Items." No discussions of 
specific amounts of money have occurred between the unnamed programmer and 
Netscape.

(19970612/Press Contact: Jennifer O'Mahoney, Netscape, tel 415-528- 2619; 
Reported by Newsbytes News Network: http://www.newsbytes.com 
/NETSCAPELOGO/PHOTO)

"The Pulse of the Information Age" Newsbytes News Network http://www.newsbytes.com 24-hour computer, 
telecom and online news

© 1997 Newsbytes

Jeffrey Fry
CNA, A+ Certified Technician
chec@itw.com
fry@mapeaston.com
http://www.itw.com/~chec

----
From: Meka Egwuekwe <meka@issl.atl.hp.com>
To: Bryan K. Fite <bryanf@secureitinc.com>
Cc: ntsecurity@iss.net
Date: Friday, June 13, 1997 22:31
Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

I too think that it is quite strange the way this was 
handled.  And I
have a slew of questions.  Perhaps that Danish company was trying to 
get
it's name out there?  Perhaps they want to embarass Netscape for some
reason?  Since the details of the bug are not being released yet, how
can it be verified?  So why go to the press instead of a forum like 
this
one?  Surely there was some motive.

Meka Egwuekwe

Bryan K. Fite wrote:
>
> I have been actively looking for some verification of this exploit. I'm not 
saying it doesn't exist. But it is very strange the way it was handled. If I 
were the paranoid type, I would be very concerned by the motivation behind the 
story. Why tell the press and not Netscape?  If indeed it effects all 
previous versions, we have been very slow to catch it (too preoccupied with 
M$?). Is this how information of this nature will be handled in the future? It's 
great that security is finally getting so
>
> Thanks,
> Bryan K. Fite
> www.secure-it.net

http://www.newsbytes.com/3.html
Full story at that address, also http://home.netscape.com/misc/security_update.html 
is where the information that Netscape has provided on the subject is 
posted.
It is said to affect Netscapes version 
2.0 and above.

Jeffrey Fry
CNA, A+ Certified Technician
chec@itw.com
fry@mapeaston.com
http://www.itw.com/~chec

----
From: Meka Egwuekwe <meka@issl.atl.hp.com>
To: Bryan K. Fite <bryanf@secureitinc.com>
Cc: ntsecurity@iss.net
Date: Friday, June 13, 1997 22:31
Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

I too think that it is quite strange the way this was 
handled.  And I
have a slew of questions.  Perhaps that Danish company was trying to 
get
it's name out there?  Perhaps they want to embarass Netscape for some
reason?  Since the details of the bug are not being released yet, how
can it be verified?  So why go to the press instead of a forum like 
this
one?  Surely there was some motive.

Meka Egwuekwe

Bryan K. Fite wrote:
>
> I have been actively looking for some verification of this exploit. I'm not 
saying it doesn't exist. But it is very strange the way it was handled. If I 
were the paranoid type, I would be very concerned by the motivation behind the 
story. Why tell the press and not Netscape?  If indeed it effects all 
previous versions, we have been very slow to catch it (too preoccupied with 
M$?). Is this how information of this nature will be handled in the future? It's 
great that security is finally getting so
>
> Thanks,
> Bryan K. Fite
> www.secure-it.net

It all comes down to money. I would suggest going to www.zdnet.com and
looking at what they have to say about the whole thing. They were one
of the entities involved in trying to substantiate that the problem was
real. They also have an ongoing discussion that you can
read/participate
in.

0x486578

James Strompolis wrote:
> 
> They said they wanted money. Can't say I blame them. Probably costing
> Netscape $10,000s to find it if they can. They should have coughed up the
> dough.
> 
> ----------
> From: owner-ntsecurity@iss.net on behalf of Meka Egwuekwe
> Sent: Friday, June 13, 1997 10:25 AM
> To: Bryan K. Fite
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> I too think that it is quite strange the way this was handled. And I
> have a slew of questions. Perhaps that Danish company was trying to get
> it's name out there? Perhaps they want to embarass Netscape for some
> reason? Since the details of the bug are not being released yet, how
> can it be verified? So why go to the press instead of a forum like this
> one? Surely there was some motive.
> 
> Meka Egwuekwe
> 
> Bryan K. Fite wrote:
> >
> > I have been actively looking for some verification of this exploit. I'm not
> saying it doesn't exist. But it is very strange the way it was handled. If I
> were the paranoid type, I would be very concerned by the motivation behind the
> story. Why tell the press and not Netscape? If indeed it effects all previous
> versions, we have been very slow to catch it (too preoccupied with M$?). Is
> this how information of this nature will be handled in the future? It's great
> that security is finally getting so
> >
> > Thanks,
> > Bryan K. Fite
> > www.secure-it.net


On Fri, 13 Jun 1997, Joel W. Barrett wrote:

> I installed MS Proxy Server last night and will eventually take the MS test for 
> it. I need to learn as much about it as possible so if anyone has questions 
> about it I'd be happy to figure out the answer for you.
> 
> I am currently using it as a network address translation (NAT) and dial-up 
> solution for a small home network with limited Internet accounts. It seems to 
> work very well. It did require MS IIS to be installed prior to its installation 
> but that was not a major hassle.
> 
> I can now do an internal FTP site, Intranet Web services, and a Gopher server 
> if I wanted.

Ok, here is one question for you! :)

On one location, I setted up MS Proxy, the same way you did. Small group
of NT stations go to internet trought dial up proxy machine. I even
enabled that auto connect thingie inside ms proxy. The problem is.... when
someone from the group want's to access some website, he contacts ms
proxy, ms proxy then dials internet, and there you have it. You are on
internet. BUT, I haven't been able to DISCONNECT it automaticaly eather
(eg. after 5 minutes of inactivity). Is this like but withing NT or MS
Proxy?

I used similar (crippled) software for same purpose: Wingate. It worked
like a dream. And it didn't cost so much. ;)


Thanx in advance
Neven

On Sat, 14 Jun 1997, James Strompolis wrote:

> They said they wanted money. Can't say I blame them. Probably costing 
> Netscape $10,000s to find it if they can. They should have coughed up the 
> dough.

That's akin to saying that if you spot a bomb in a train station you 
should be able to collect money for warning the authorities from all of 
the potential victims families. After all, they'd certainly pay well for 
the privilige of living, and it would cost the govenrment quite a lot to 
search all the train stations within fifteen minutes.

It's simply mercenary extortion, and Netscape shouldn't "cough up". The 
logical offshoot of this is someone charging companies to protect them 
from every single buglet in every single application under NDA, so the 
vendor never learns of the vulnerability. This is *not* a good trend.

As much as I hate to see Netscape with potential holes, I applaud them for
standing their ground.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

On Sat, 14 Jun 1997, N. Werner Mortensen wrote:

> Hello all,
> 
> Normally I am proud to be danish and very pleased with our reputation in
> the IT industry. But the recent incident and the behaviour of one of my
> countrymen makes me feel ashamed.

I don't think it reflects on Denmark as it does on the company 
concerned. I'll certainly ensure that any company I work for knows about 
their ethics. That won't affect how I view other Danish companies 
however. 

The fact that this is limited to Netscape 2.0 and higher means that it 
almost certainly must be a bug in the HTTP upload code, and hopefully it 
won't take Netscape or someone else too long to figure out and fix this 
problem. If I can find the time I'll certainly be modifying my HTTP 
upload CGIs next week to see if I can reproduce the bug. 

I am actually surprised that this is the first such incident, as the 
Microsoft bug-upon-bug fest a couple of months ago would have been a 
perfect target for someone to attempt this ploy. I'm more surprised that 
it wasn't one of my countrymen, as I'd wondered about this type of 
incident when the second MS IE bug hit. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Interesting because it was painted such a convincing picture of evil
"blackmailers" who are constantly plaguing big corporations with
revelations of flaws in their software? It is curious how a programmer
who discovered a security flaw is guilty of "extortion" and "blackmailing"
according to this reporter who obviously got all of his information from
Netscape security notices. How has the information that this programmer
discovered become the property of Netscape or anyone else that wishes to
know what the bug is? If this was true blackmail, he/she would be
threatening to post the full details of how to exploit the bug to the
public. Instead, all I have seen so far is a request for adequate
compensation for his/her work. Or a person-to-person meeting with a
Netscape representative.

PD
Whatever SOD did, it certainly didnt "plea" for a job from HP. More like
demand all expense paid ski trips with Heinekin babes.. I dont think SOD
intended those as demands.. more like a joke about the lengths the company
might go to to keep the easily discovered flaws in its software secret...

-vermont@gate.net

On Sat, 14 Jun 1997, Ivor Rankin wrote:

> There's another interesting (non-technical) article about this at the following URL:
> 
> http://www.sjmercury.com/business/netscape061297.htm
> 
> Regards.
> 

I am working on an answer for the exact same question you posed. I haven't yet 
found a parameter in Proxy of RAS Dial-up which will disconnect after a 
predefined period of time of inactivity. I will find something soon though. The 
problem is that Proxy is so new that there aren't many things written about it 
yet.

I agree that there are many products out there for dial-up proxy use that are 
currently viable alternatives to MS Proxy. I was using WebEtc until it expired 
about a week ago.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
Sent: Saturday, June 14, 1997 5:05 AM
To: Joel W. Barrett
Cc: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA MCSE Study 
Group (E-mail)
Subject: Re: [NTSEC] MS Proxy Server



On Fri, 13 Jun 1997, Joel W. Barrett wrote:

> I installed MS Proxy Server last night and will eventually take the MS test 
for
> it. I need to learn as much about it as possible so if anyone has questions
> about it I'd be happy to figure out the answer for you.
>
> I am currently using it as a network address translation (NAT) and dial-up
> solution for a small home network with limited Internet accounts. It seems to 
> work very well. It did require MS IIS to be installed prior to its 
installation
> but that was not a major hassle.
>
> I can now do an internal FTP site, Intranet Web services, and a Gopher server 
> if I wanted.

Ok, here is one question for you! :)

On one location, I setted up MS Proxy, the same way you did. Small group
of NT stations go to internet trought dial up proxy machine. I even
enabled that auto connect thingie inside ms proxy. The problem is.... when
someone from the group want's to access some website, he contacts ms
proxy, ms proxy then dials internet, and there you have it. You are on
internet. BUT, I haven't been able to DISCONNECT it automaticaly eather
(eg. after 5 minutes of inactivity). Is this like but withing NT or MS
Proxy?

I used similar (crippled) software for same purpose: Wingate. It worked
like a dream. And it didn't cost so much. ;)


Thanx in advance
Neven
What firewall are you using? Do you know anything about EAGLE NT
Raptor?
ConnieDarr Emery
Email/Network Administrator
Florida Gulf Coast University
cedar@fgcu.edu

 -----Original Message-----
 From: Jack LeGrand [SMTP:jackl@infi.net]
 Sent: Saturday, June 14, 1997 5:54 PM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server

 Okay...here's a good one. I recently took an abbreviated Proxy
course
 and one thing that was unclear to all present was....since MS
Proxy is
 NOT a firewall, it will in most case work in line with a
firewall.
 
 Question: Should the proxy server be on the outside of the
firewall? 
 If so, does it affect the ability of a firewall that does
Network
 Address Translation. In this case the firewall is passing to
the Proxy
 server a single IP (I presume). Is it able to keep the
individual
 sessions separate?

 The same sort of question also exists if you put the proxy
server on the
 inside of the firewall. If the proxy server is passing off (the
 presumed) single IP, how does the firewall keep track of the
sessions of
 the (800) internal clients on our network?


 Noone at the session (including the instructor) had a good grasp
of how
 the MS Proxy fits within a traditional "Outer DMZ" architecture.
If you
 have any input on this, I'd be interested.....


 Jack LeGrand
 jackl@infi.net


 ****************************************

 Joel W. Barrett wrote:
 > 
 > I installed MS Proxy Server last night and will eventually
take the MS test for
 > it. I need to learn as much about it as possible so if anyone
has questions
 > about it I'd be happy to figure out the answer for you.
 > 
 > I am currently using it as a network address translation (NAT)
and dial-up
 > solution for a small home network with limited Internet
accounts. It seems to
 > work very well. It did require MS IIS to be installed prior to
its installation
 > but that was not a major hassle.
 > 
 > I can now do an internal FTP site, Intranet Web services, and
a Gopher server
 > if I wanted.
 > 
 > --
 > Joel W. Barrett, Internetworking Consultant
 > RPM Associates, Inc. http://www.rpm.com
 > email: jbarrett@rpm.com, pager: 888-602-4566
 > http://www.mindspring.com/~cnebody (12/17/96)
 > Do Something Digital!

 -- 
 Jack LeGrand
 TeleGrand Technologies
 jack.legrand@telegrand.com
 A Strategic Business Partner of Blue Ridge Interactive
































































































































































































































































































































































































































































































































































































































































































































































































































I dont know if the proxy software itself has security holes. Any
software misconfigured has the potential to do so. The problem with any
proxy, is not so much in the proxy software of choice but in the
security of the security of the system as a whole. If I can hack into
your proxy server with a filesharing hole then your proxy is useless.
Also I could be wrong on this (But most likely not), but a proxy will
not safeguard you against most web browser attacks. I personally use a
proxy on my local system for HTTP. This proxy allows me to stop people
from obtaining information from my browser such as what browser it is
what OS i am using and where I am comming from. This proxy, and many
others as well, is also designed to stop others from tracking you
through the use of cookies. This however, can and is overcome by many
cleaver web developers who have found other ways of sending you cookies
which are not as easy to filter. As with the recient Internet Explorer
and Netscape bugs, these can be even more difficult to stop. For
example the IE password grabbing scemes you can stop them by preventing
traffic through ports 137-139 (SMB over TCP). Now with the newly
discovered Netscape hole the problem gets even more tricky. For the
moment we are missing most all key technical details, but we do know
that the problem exhists in clever usage of RAW HTML, which would defeat
the security mechinisms of any known proxy. This will be filterable but
by the time anyone knows what to filter out, netscape will be patched.
So in closing, you really dont have to worry about your current proxy
for there really isnt a feasable solution to many of these problems
other than to sit and wait for the patches to come out.
0x486578
Ken Anthony wrote:
>
> Has anyone ever heard anything bad about this proxy server?
> ( like ways to break into a system using it? )
> WinProxy http://www.lanprojekt.cz/winproxy/
>
> I've been using it at home for about 6 months, and it works great, but
with
> the
> recent 'Netscape' discoveries, my company feels a more well known
> (ie: more expensive and harder to configure) proxy / firewall would be a
> safer choice.
>
> We would use Microsoft's proxy if it had a POP/SMTP gateway.
> As far as I know, you have to install exchange server to get mail to
work,
> and really don't need exchange server.
>
> Thanks..
> Ken Anthony









































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































I dont know if the proxy software itself has security holes. Any
software misconfigured has the potential to do so. The problem with any
proxy, is not so much in the proxy software of choice but in the
security of the security of the system as a whole. If I can hack into
your proxy server with a filesharing hole then your proxy is useless.
Also I could be wrong on this (But most likely not), but a proxy will
not safeguard you against most web browser attacks. I personally use a
proxy on my local system for HTTP. This proxy allows me to stop people
from obtaining information from my browser such as what browser it is
what OS i am using and where I am comming from. This proxy, and many
others as well, is also designed to stop others from tracking you
through the use of cookies. This however, can and is overcome by many
cleaver web developers who have found other ways of sending you cookies
which are not as easy to filter. As with the recient Internet Explorer
and Netscape bugs, these can be even more difficult to stop. For
example the IE password grabbing scemes you can stop them by preventing
traffic through ports 137-139 (SMB over TCP). Now with the newly
discovered Netscape hole the problem gets even more tricky. For the
moment we are missing most all key technical details, but we do know
that the problem exhists in clever usage of RAW HTML, which would defeat
the security mechinisms of any known proxy. This will be filterable but
by the time anyone knows what to filter out, netscape will be patched.
So in closing, you really dont have to worry about your current proxy
for there really isnt a feasable solution to many of these problems
other than to sit and wait for the patches to come out.
0x486578
Ken Anthony wrote:
>
> Has anyone ever heard anything bad about this proxy server?
> ( like ways to break into a system using it? )
> WinProxy http://www.lanprojekt.cz/winproxy/
>
> I've been using it at home for about 6 months, and it works great, but
with
> the
> recent 'Netscape' discoveries, my company feels a more well known
> (ie: more expensive and harder to configure) proxy / firewall would be a
> safer choice.
>
> We would use Microsoft's proxy if it had a POP/SMTP gateway.
> As far as I know, you have to install exchange server to get mail to
work,
> and really don't need exchange server.
>
> Thanks..
> Ken Anthony









































































































































































































All good points, Paul. DLL's are far too valuable to deny them to
regular users.

I guess the point that I'd add is that security features in any
operating system are not enough. There need to be certain (let me use
the trite phrase) "metaphors" (i.e., accepted practices, procedures,
etc.) for how the features are used. These are much harder to implement
and enforce because a security design team like NT's has little control
over how the far-flung arms of the mightly MS and their legions of 3rd
party suppliers use the features.

Like most people seem to be, I'm uncomfortable about the great
intermingling of highly sensitive files and the "chaff" that seems to
clutter SYSTEM32 and its neighborhood. (Although I grant that the WINNT
directory does have a degree of security organization). For example, I
recently noted a "readme" file that my C++ compiler install placed in
SYSTEM32. (Why it was not happy putting it in the program's main
directory is a mystery to me!) 

I'm doing a bit of programming these days myself, and I really wish MSDN
had a document (maybe it does!) that explains each subdirectory in WINNT
vis-a-vis its security purpose, propa' protection, etc. A nice little
"this is how you should organize 3rd party stuff" from someone who
understands how it should be done (within MS's original design intent)
would be wonderful. While not all 3rd party apps will follow it, it
would be a good start.

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/

My definition of what a "firewall" should do includes:

1. Prevent unauthorized access to your private network.
2. Enable secure access for authorized users to your private
network.
3. Detect and report unauthorized attempts to access your private
network or servers on the public network.

The MS Proxy will do #1, but cannot do #2 or #3 (It will do a better job
with good filters programmed on the router). Because the purpose of the
Proxy Server is to allow outbound access (and close inbound holes), it
does not conflict with the functions of a "firewall". I would put the
proxy on the outside of the firewall, with your web server, DNS server
and SMTP server.

I usually setup the proxy with 2 NIC's, one on the private network, and
one on the public network. You can use any IP addressing scheme for
your internal clients that you want, just be sure to include them in the
LAT, or you will lose any Winsock functionality. I don't know if this
is in conflict with your NAT scheme, but I think it makes it
unnecessary. With a proxy, clients on your private network can have
full outbound functionality without going through your firewall.

I have been looking a one product that is both a proxy and firewall -
you can check it out at www.i-planet.com. I am sure there are others.

I would be interested in knowing what advantages a Firewall/NAT
configuration has over a proxy for outbound access. Anybody?

Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Jack LeGrand [SMTP:jackl@infi.net]
 Sent: Saturday, June 14, 1997 4:54 PM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server

 Okay...here's a good one. I recently took an abbreviated Proxy
course
 and one thing that was unclear to all present was....since MS
Proxy is
 NOT a firewall, it will in most case work in line with a
firewall.
 
 Question: Should the proxy server be on the outside of the
firewall? 
 If so, does it affect the ability of a firewall that does
Network
 Address Translation. In this case the firewall is passing to
the Proxy
 server a single IP (I presume). Is it able to keep the
individual
 sessions separate?

 The same sort of question also exists if you put the proxy
server on the
 inside of the firewall. If the proxy server is passing off (the
 presumed) single IP, how does the firewall keep track of the
sessions of
 the (800) internal clients on our network?


 Noone at the session (including the instructor) had a good grasp
of how
 the MS Proxy fits within a traditional "Outer DMZ" architecture.
If you
 have any input on this, I'd be interested.....


 Jack LeGrand
 jackl@infi.net

Or simply disable the guest account, as it is on all domains anyways...

Eric


At 12:44 PM 6/16/97 -0700, Sean Mathias wrote:
>This is not a bug at all. It is behaving exactly as it is configured to.
If the 'Everyone' group has permissions on the share and the filesystem (if
using NTFS), then access will be granted to absolutely anyone who tries to
connect to the resource. The best method of disabling this is to block
TCP/UDP ports 137-139 at your Internet gateway/router. Beyond that, some
degree of security should be in place. For starters, when granting
permissions on objects, if you are inclined to use the 'Everyone' group,
don't. Instead use the 'Domain Users' group (making sure all users belong
to that group), or, on NT 4 SP3 or later, use the 'Authenticated Users'
group. This will close this particular hole, but there may be many more
you are unaware of...
>
>Sean Mathias, MCSE
>President, Prosolve Technical Solutions Group
>Vice President of Technology, BackOffice Professionals Association
>Director or Network Services, Online Interactive
>seanm@prosolve.com
>0 1 206 362 6398 (GMT -8:00)
>
>
>-----Original Message-----
>From: Charles R. Derk, Jr [SMTP:charlie@eaki.net]
>Sent: Monday, June 16, 1997 9:37 AM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] Shared Folders Across Internet
>
>Hey all...
>
>Just joined the list this morning because of a question that I had. This
may or may not have been addressed before, but as I said, I'm new here.
>
>Anyway, last week a friend of mine called me and asked for my IP address
of my machine. 10 minutes later, one of my shared folders had been
renamed, and a bunch of bogus files dumped in to it. He told me that it is
possible, using NT, to map a network drive by just using the IP address,
and gain access to any shared folders that do not have passwords. Correct
me if I am wrong, but don't a lot of businesses created shared directories,
and eliminate the password, just so everyone inside the LAN can get to it
effortlessly? Is there anyway to get around this "bug" if it is indeed a
bug. I really do not want people outside my LAN gaining access, or even
just looking at the drives on our machines here.
>
>Thanx!
>Charlie
>
>-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
> 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
> Phone: (610) 746-0807 Fax: (610) 746-3688
>
>If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
>the doors?
>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
In my opinion, since MS Proxy is most likely going to be installed on a NT 
Server, I would prefer to see it inside the firewall and also inside the 
network protected from the Internet by a Cisco router. This is because NT has 
so many security problems that I wouldn't trust anything running NT between my 
network router(s) and the Internet. I would implement something like this 
depending on how large the installation:

 Internet-----router (if required)-----Unix-based firewall or Cisco 
Pix-----router----Proxy server (if required)----network

Having a firewall, router, and proxy server may be redundant depending on the 
firewall or router. I know that Cisco routers running version 11.2(5) can 
perform NAT if they have the proper memory. The problem is there aren't many 
Cisco routers running 11.2 yet.

In either case, the hardware is going to do only what it is programmed to do 
and it will process only the packets it receives. If packets are filtered or 
translated before they get to it then the product (router, firewall, proxy 
server) can only perform transactions based on those packets. Do you see what 
I'm getting at?

The easiest way to figure this out is to draw what you intend to do then 
implement it on the drawing. Make several drawings, each with separate 
implementations so you can see where redundancy occurs. These drawings will 
most probably answer your questions.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Jack LeGrand [SMTP:jackl@infi.net]
Sent: Saturday, June 14, 1997 5:54 PM
To: Joel W. Barrett
Cc: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA MCSE Study 
Group (E-mail)
Subject: Re: [NTSEC] MS Proxy Server

Okay...here's a good one. I recently took an abbreviated Proxy course
and one thing that was unclear to all present was....since MS Proxy is
NOT a firewall, it will in most case work in line with a firewall.

Question: Should the proxy server be on the outside of the firewall?
If so, does it affect the ability of a firewall that does Network
Address Translation. In this case the firewall is passing to the Proxy
server a single IP (I presume). Is it able to keep the individual
sessions separate?

The same sort of question also exists if you put the proxy server on the
inside of the firewall. If the proxy server is passing off (the
presumed) single IP, how does the firewall keep track of the sessions of
the (800) internal clients on our network?


Noone at the session (including the instructor) had a good grasp of how
the MS Proxy fits within a traditional "Outer DMZ" architecture. If you
have any input on this, I'd be interested.....


Jack LeGrand
jackl@infi.net


****************************************

Joel W. Barrett wrote:
>
> I installed MS Proxy Server last night and will eventually take the MS test 
for
> it. I need to learn as much about it as possible so if anyone has questions
> about it I'd be happy to figure out the answer for you.
>
> I am currently using it as a network address translation (NAT) and dial-up
> solution for a small home network with limited Internet accounts. It seems to
> work very well. It did require MS IIS to be installed prior to its 
installation
> but that was not a major hassle.
>
> I can now do an internal FTP site, Intranet Web services, and a Gopher server
> if I wanted.
>
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!

--
Jack LeGrand
TeleGrand Technologies
jack.legrand@telegrand.com
A Strategic Business Partner of Blue Ridge Interactive

If I understand your question correctly, you want to implement multiple MS 
Proxy Servers. I don't know if this is possible and can only see where multiple 
Proxy Servers are required when redundant/backup servers are needed (which is 
quite often). If that is the situation you propose then that is a good 
question.

I guess you would implement multiple Proxy servers the same way multiple DHCP 
servers are implemented. Windows NT DHCP servers cannot currently share IP 
address ranges. The addresses must be split between the servers so that if one 
server crashes the other will pick up and issue new DHCP IP addresses to 
workstations.

I am still learning MS Proxy Server and presently can only guess at how Proxy 
Server would react in a multi-server installation.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Eigenheer Patrik, EIP [SMTP:Patrik.Eigenheer@cantrade.ch]
Sent: Monday, June 16, 1997 1:18 AM
To: 'Joel W. Barrett'
Subject: RE: [NTSEC] MS Proxy Server

HI

I have also a questen, did u see if is possible to cascading the MS
Proxy ?
So is means, if the MS Proxy can "ask" an other Proxy, so to build a
Proxy hierarchy :-) do u know what I'm looking for ?

Tnx
Patrik



-----Original Message-----
From: Joel W. Barrett [SMTP:cnebody@mindspring.com]
Sent: Freitag, 13. Juni 1997 18:17
To: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA
MCSE Study Group (E-mail)
Subject: [NTSEC] MS Proxy Server

I installed MS Proxy Server last night and will eventually take the MS
test for
it. I need to learn as much about it as possible so if anyone has
questions
about it I'd be happy to figure out the answer for you.

I am currently using it as a network address translation (NAT) and
dial-up
solution for a small home network with limited Internet accounts. It
seems to
work very well. It did require MS IIS to be installed prior to its
installation
but that was not a major hassle.

I can now do an internal FTP site, Intranet Web services, and a Gopher
server
if I wanted.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!




Well to answer your question you first must know what a proxy server is and 
what it does. Here is M$'s definition:


A proxy server is a server configured to act on behalf of assigned clients.

When a client application makes a request for an object on the Internet, a 
proxy server on the private network responds by translating the request and 
passing it to the Internet. When a computer on the Internet responds, the proxy 
server passes that response back to the client application on the computer that 
made the request. The proxy server is a gateway between the private network and 
the Internet.

A gateway is special software, or a computer running special software, that 
enables two different networks to communicate.

A proxy server provides a gateway between your private network to the Internet. 
You configure a proxy server to enable your workstations to communicate with 
remote services on the Internet. You select the appropriate hardware for a 
gateway computer, adequate bandwidth for the Internet connection, and choose 
the level of security for protecting your private network.

The gateway acts as a barrier that allows you to make requests to the Internet 
and receive information, but does not allow access to your network by 
unauthorized users.


In essence, proxy servers are not designed to do NAT (Network address 
translation). NAT is more a router or firewall process. NAT on a large network 
is fairly CPU intensive because each and every packet the firewall or router 
receives must be translated to a different IP address or tossed out or 
rerouted.

A proxy server merely allows or disallows external IP addresses to access your 
network and allows or disallows internal IP addresses to access external 
resources.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Darr Emery, Connie [SMTP:cedar@fgcu.edu]
Sent: Monday, June 16, 1997 12:34 PM
To: 'Joel W. Barrett'
Subject: RE: [NTSEC] MS Proxy Server

Can you use MS Proxy server to do address translation from a set of 4
class "C" addresss (externally) to internal class "B" addresses?
Connie Darr Emery
Email/Network Administrator
Florida Gulf Coast University
cedar@fgcu.edu


Actually, disabling the guest account does not necessarily prohibit this sort of access. The Everyone group, as we have seen in recent months, is all enclusive and it may be possible to be mapped to some other account (user, IUSR_computername, SQL account, etc.). As a rule, I never use the Everyone group for file system permissions which eliminates much of these issues, but not all. Following are the general guidelines I use, arguments/comments/opinions for or against any of these recommendations is welcomed bearing in mind that this is only my experience and these are general suggestions...

1. Disable the guest account

2. Format all disks (other than RISC boot partitions) with NTFS

3. Use the 'Domain Users' group in place of the 'Everyone' group for file system permissions (remove the Everyone group entirely using cacls or equivalent) Be sure that all of your users belong to the Domain Users group (you may also want to do a text dump of permissions before making changes as a precaution.

4. When creating shares, the default permissions are 'Everyone:Full Control' , remove this and change it to Domain Users:Full Control. This removes the Everyone group again and by specifying Domain Users:Full Control, you can effectively only maintain the file system permissions to acheive the desired result as they will override the share permissions (say only Accounting has file system permissions, this will override the share permissions)

Beyond this I can go on, but it is late and many others on this list have written excellent FAQ's and whitepapers. You can also have a look at a white paper from the BackOffice Professionals Association which provides a bit more information 

http://www.bopa.org/sigs/nt/winntsec.doc

Good luck,

Sean Mathias, MCSE
President, Prosolve Technical Solutions Group
Vice President of Technology, BackOffice Professionals Association
Director or Network Services, Online Interactive
seanm@prosolve.com
0 1 206 362 6398 (GMT -8:00)


-----Original Message-----
From: Eric Germann [SMTP:ekgermann@cctec.com]
Sent: Monday, June 16, 1997 8:26 PM
To: Sean Mathias
Cc: 'Charles R. Derk, Jr'; 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Shared Folders Across Internet

Or simply disable the guest account, as it is on all domains anyways...

Eric


At 12:44 PM 6/16/97 -0700, Sean Mathias wrote:
>This is not a bug at all. It is behaving exactly as it is configured to.
If the 'Everyone' group has permissions on the share and the filesystem (if
using NTFS), then access will be granted to absolutely anyone who tries to
connect to the resource. The best method of disabling this is to block
TCP/UDP ports 137-139 at your Internet gateway/router. Beyond that, some
degree of security should be in place. For starters, when granting
permissions on objects, if you are inclined to use the 'Everyone' group,
don't. Instead use the 'Domain Users' group (making sure all users belong
to that group), or, on NT 4 SP3 or later, use the 'Authenticated Users'
group. This will close this particular hole, but there may be many more
you are unaware of...
>
>Sean Mathias, MCSE
>President, Prosolve Technical Solutions Group
>Vice President of Technology, BackOffice Professionals Association
>Director or Network Services, Online Interactive
>seanm@prosolve.com
>0 1 206 362 6398 (GMT -8:00)
>
>
>-----Original Message-----
>From: Charles R. Derk, Jr [SMTP:charlie@eaki.net]
>Sent: Monday, June 16, 1997 9:37 AM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] Shared Folders Across Internet
>
>Hey all...
>
>Just joined the list this morning because of a question that I had. This
may or may not have been addressed before, but as I said, I'm new here.
>
>Anyway, last week a friend of mine called me and asked for my IP address
of my machine. 10 minutes later, one of my shared folders had been
renamed, and a bunch of bogus files dumped in to it. He told me that it is
possible, using NT, to map a network drive by just using the IP address,
and gain access to any shared folders that do not have passwords. Correct
me if I am wrong, but don't a lot of businesses created shared directories,
and eliminate the password, just so everyone inside the LAN can get to it
effortlessly? Is there anyway to get around this "bug" if it is indeed a
bug. I really do not want people outside my LAN gaining access, or even
just looking at the drives on our machines here.
>
>Thanx!
>Charlie
>
>-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
> 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
> Phone: (610) 746-0807 Fax: (610) 746-3688
>
>If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
>the doors?
>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 

Yes it works although I thought it was somewhat flaky at first... I believe it 
was operator error though and think I have it working well now. Here's some 
things I discovered along the way:

You must first install IIS 2.0 or above. Then you can install MS Proxy Server. 
I do not know how this affects SP on NT 4.0 yet but I would assume that you 
would probably want to reinstall SP3 and all hotfixes after installing IIS and 
Proxy.

You can use the basic default configuration with no filters and it works just 
fine. I have done some tweaking on my system and added filters so that only my 
Internet IP address is granted access to the system. My ISP Internet address is 
static and I got the address in NT by running IPCONFIG in a DOS shell. IPCONFIG 
shows both the NIC and Modem IP addresses but you must choose the modem IP 
address to filter on (this I know by experience).

You also want to install the client side of Proxy at each workstation which 
accesses the Proxy server for dial-up. This includes the server if you also use 
the server as a client.

Other things to do:
- Set the Idle Seconds before disconnect in the user settings of the Dial-Up 
Networking app.
- Download and install MS Index Server so you can search for things in the 
Proxy Server documentation which is only available in HTTP format.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Gunnar Bredow [SMTP:gbredow@comtech.com.au]
Sent: Monday, June 16, 1997 11:14 PM
To: Joel W. Barrett
Subject: Re: [NTSEC] MS Proxy Server

Ok - a question asked many times in the exam in many forms was whether you
could use MS proxy as a dialup solution for small business. Does it work
and if so how do you set it up ? (I guess I just answered the first
question with the second).

regards

Gunnar

----------
> From: Joel W. Barrett 
> To: RPM Engineers (E-mail) ; NT Security List Service
(E-mail) ; NPA MCSE Study Group (E-mail)

> Subject: [NTSEC] MS Proxy Server
> Date: Saturday, 14 June 1997 0:16
>
> I installed MS Proxy Server last night and will eventually take the MS
test for
> it. I need to learn as much about it as possible so if anyone has
questions
> about it I'd be happy to figure out the answer for you.
>
> I am currently using it as a network address translation (NAT) and
dial-up
> solution for a small home network with limited Internet accounts. It
seems to
> work very well. It did require MS IIS to be installed prior to its
installation
> but that was not a major hassle.
>
> I can now do an internal FTP site, Intranet Web services, and a Gopher
server
> if I wanted.
>
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!
>
>

Perhaps because all of the DOS, Win 3.x, and Win95 users
are all essentially always logged in as "admin"?

 Ryan

---------- Previous Message ----------
To: ntsecurity
cc: 
From: dgpeters@its.cse.dnd.ca ("Peters, Donald G.") @ smtp
Date: 06/16/97 04:10:14 PM
Subject: [NTSEC] Browsers Should Warn Users

More than one person wrote:

>DON'T BROWSE WHEN YOU'RE LOGGED IN AS ADMIN!
>DON'T BROWSE WHEN YOU HAVE READ/WRITE ACCESS TO SENSITIVE FILES!

My question is, has anyone asked the browser companies to have their
browsers check with the operating system (eg, Windows NT) if you are
running as ADMIN or in some other privileged mode and at least WARN you
that you are taking an additional risk? I was not even aware of this
warning until today, though it makes perfect sense now. (But in my case
I don't have Admin privileges, fortunately ;-).)

Why haven't I seen this discussed anywhere before? Isn't this a simple,
useful security feature that can be added to browsers?

Don
dgpeters@cse.dnd.ca

P.S. I won't charge any of the browser companies over $1000 for this
security-related bugfix. (Though US$1000 is actually over CAN$1000. ;-)




First you can start the service with the administrator account, 
and you must choose in the box for the schedule service "log on as System
account",
so you can use AT command in the dos window.

Gossiaux O.

At 10:05 AM 6/11/97 -0500, you wrote:
>
>I am still trying to use the AT scheduler to do remote shutdowns on NT
>machines across the network. I am the domain admin and also have start the
>scheduler as myself. Whenever I run my shutdown.exe routine from the
>scheduler, I get an access denied, though I can run it from the command
>line.
>
>Any thoughts...
>
>Brian D. Frost
>
>
>
>
Steve Sutton writes:
> Ture. And frightening. The point is that once a malicious program runs
> in an administrative session there are (at last count) 19,367 ways it
> can completely subvert that computer's and perhaps the network's
> security (can you say "session hijacking"). PASSFILT is certainly one of
> the easier ways to do so. This is not, BTW, an indictment of Windows NT.
> It's as security-sound as any commercial operating is likely to be in
> our lifetimes. The problem is that it's very, very easy to download a
> Trojan Horse in today's seamless, transparent, world-wide-webbed
> community. Without a "sandbox" for the horse's activities, these kinds
> of attacks are "easy pickin's."

This should be an indictment of Windows NT. (Yes, this is an flame).
It's ridiculous to require administrator priviliges for most software
installs. This, AFAIK, is brought about by the apparent preference in 
the Windows world for leaving droppings everywhere. There is no
reason why programs shouldn't be able to put themselves in a single
(user-defined) directory. This would allow Joe User to install his
own programs in his home directory, as himself, without having any of
these security concerns.


-- 
The difference between a bug and | 
a feature is documentation. | Matt Simmons
 -- Ben Duncan | simmonmt@acm.org
 bend@ali.intop.net |
HI

These sound not very bad :-(

So how do I see if I have a hacked logon service ?!? or is it 
impossible :-(
...or does anyone know one of these www sides.
I im interested what is possible now on nt 4.0, I have to secure some 
NT Domains here :-) !

Tnx folks
Patrik

> All very nice and convenient, but just keep in mind:
>
> If you let "J. Random User" (JRU) install software on his/her 
machine,
> then you better be careful to make sure that "L. Powerful 
Administrator"
> (LPA) never logs into that machine, because JRU could have installed 
a
> password filter to steal LPA's password.
>
> (JRU may not have even been aware that they installed the password
> filter -- they might have been cruising the web and downloaded some
> program that did the dirty deed...)
>
> Paul

Ture. And frightening. The point is that once a malicious program 
runs
in an administrative session there are (at last count) 19,367 ways it
can completely subvert that computer's and perhaps the network's
security (can you say "session hijacking"). PASSFILT is certainly one 
of
the easier ways to do so. This is not, BTW, an indictment of Windows 
NT.
It's as security-sound as any commercial operating is likely to be in
our lifetimes. The problem is that it's very, very easy to download a
Trojan Horse in today's seamless, transparent, world-wide-webbed
community. Without a "sandbox" for the horse's activities, these 
kinds
of attacks are "easy pickin's."

--
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com
 WWW: http://www.TrustedSystems.com/

I think you are right in that there are a lot of manufacturers that
although they have ported their apps to be 32bit have not embrassed the
multiuserdesktop idea and tend to try and put things in the wrong place
on the PC and the registry. These leads to no end of problems when you
try to manage the environment. I think a lot of manufacturers are trying
to keep their 16 and 32 bit products in line which can't always be the
case.

As for allowing users to do their own installs etc I must admit that I
would be very careful about that as you cannot enure a production
bulletproof environment if the users can play too much. There is an
important balance to be made on this topic

Steve


Matt Simmons wrote:
> 
> Steve Sutton writes:
> > Ture. And frightening. The point is that once a malicious program runs
> > in an administrative session there are (at last count) 19,367 ways it
> > can completely subvert that computer's and perhaps the network's
> > security (can you say "session hijacking"). PASSFILT is certainly one of
> > the easier ways to do so. This is not, BTW, an indictment of Windows NT.
> > It's as security-sound as any commercial operating is likely to be in
> > our lifetimes. The problem is that it's very, very easy to download a
> > Trojan Horse in today's seamless, transparent, world-wide-webbed
> > community. Without a "sandbox" for the horse's activities, these kinds
> > of attacks are "easy pickin's."
> 
> This should be an indictment of Windows NT. (Yes, this is an flame).
> It's ridiculous to require administrator priviliges for most software
> installs. This, AFAIK, is brought about by the apparent preference in
> the Windows world for leaving droppings everywhere. There is no
> reason why programs shouldn't be able to put themselves in a single
> (user-defined) directory. This would allow Joe User to install his
> own programs in his home directory, as himself, without having any of
> these security concerns.
> 
> --
> The difference between a bug and |
> a feature is documentation. | Matt Simmons
> -- Ben Duncan | simmonmt@acm.org
> bend@ali.intop.net |

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
--------------------------------------------------------------------
> This should be an indictment of Windows NT. (Yes, this is an flame).
> reason why programs shouldn't be able to put themselves in a single
> (user-defined) directory. This would allow Joe User to install his
> own programs in his home directory, as himself, without having any of
> these security concerns.

 And what exactly does this have to do with NT? Nothing at all. It is
the program developers who develop programs that use static
directories, not NT (in that case at least). No program that is properly
coded should need to copy anything into %systemroot%\system32
-directory. If the setup program does not give you any control over this
(as they usually don't) it is most inconvenient and requires an admin to
install the program (assuming only admins can write to
%systemroot%\system32 and registry). Any program, how ever, should run
with its files (mainly dll's) in any directory IN THE PATH - in NT the
directory . is always in the path (I may be in error?) - unlike unixes -
thus by placing the dll's and executables in the same directory should
always work. As usual (in windows-world), there are some bad coders who
do not search the path for dll's or who use static directories for
references rather than environment variables and relative paths.

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------




Use the following command: "route -p add [network] mask [netmask]
[gateway]".
This will add a persistent route and will be stored in the registry. You
will not have to change these after the very first time you use them. Get
rid of the batch files after you do this. Good luck.






arturo@intac.com on 06/13/97 07:39:26 AM

Please respond to arturo@intac.com

To: ntsecurity@iss.net
cc: (bcc: Andy S Bolin/Mott)
Subject: [NTSEC] adding routes at startup or permanently




I need to add routes at startup or permanently for all users. I have
created a batch file with the "route add" command, but this only works
if you have admin rights. BTW, this is a great group. I joined a few
months ago & this is my 1st question. 8-)








Dave,

On the server, start the User Manager for Domains.

Select Policies/Audit and make sure that auditing is not turned off. I
would recommend checking all the boxes in the "Failure" column and all
the ones in the "Success" column EXCEPT: "Use of User Rights" and
"Process Tracking".

You also MUST enable auditing at the file/directory level for those
files and/or directories that you wish to track.

Good luck!

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
drbivens@agst.com


-----Original Message-----
From: Dave Claypole [SMTP:davec@powinv.co.uk]
Sent: Friday, June 13, 1997 09:27
To: ntsecurity@iss.net
Subject: [NTSEC] Security log

Hello All

i have recently setup a standalone NT3.51 Server as a Workgroup and
enabled RAS on the box. When i check the event log - security there are
no entries for either logging on at the console or from the RAS logon.

Can anyone expand on why this should be ? 



What port scanners and sniffers do you have? Are they freeware? Where can
I get them? I deperately need them myself. Help, please.....

On Thu, 12 Jun 1997, Bryan Swann wrote:

> I'm involved in evaluating the security of several networks. Being
> experienced with UNIX, I have several FREE tools that I use to test a
> range of IP addresses over the network. I have seen a few FREE tools for
> NT, but they either run only on the machine that they reside or they have
> a GUI interface that forces you to access each machine individually. Are
> there FREE tools for doing some basic checks on NT boxes? Where can I
> find them? I don't mind writing a little code to help automate the
> process of using a tool, as long as it has a command line interface.
> 
> I already have port scanners and sniffers, so I'm not interested in these.
> 
> TIA
> 
> __________________________________________________________________________
> | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> | Eagan McAllister Associates, Inc. |
> | |
> | "Everything must be working perfectly, cause I don't smell any smoke" |
> --------------------------------------------------------------------------
> 

At 09:18 13/6/97 -0400, Bryan K. Fite wrote:
>I have been actively looking for some verification of this exploit. 
>I'm not saying it doesn't exist. But it is very strange the way it 
>was handled.

I was able to find links from the CNN home page http://cnn.com and
Netscape's home page... There seems to be something there worth looking
closer... how much remains to be seen. Here are the articles I found (URLs
may have a very short life)...

Netscape Security Update:
 http://home.netscape.com/misc/security_update.html

CNNfn: Netscape bug uncovered: Danish software firm finds flaw that could
let sites see data stored on PCs 
 http://cnnfn.com/digitaljam/9706/12/netscape_pkg/

PC Magazine Online: Netscape Security Flaw: A bug lets curious webmasters
read files from your hard disk when you surf with Navigator.
 http://www8.zdnet.com/pcmag/news/trends/t970612b.htm

The reports I've seen are that the Danish firm told Netscape they could
visit them on Monday to get the details for free, or compensate them
reasonably for the several weeks of work they've invested in investigating
the matter. If it is true that Netscape offered only their $1,000 bugs
bounty and a t-shirt, would you blame them for telling Netscape to take a
hike... all the way to their office on Monday?

/Harold

ps. It may be tradition that firms rush to market with often buggy
products, to maximize their profits, and their customers hassle with (and
pay for) the impact of the bugs. My heart goes out to anybody who says
"hey-wait a minute!"

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Harold A. Driscoll mailto:harold@driscoll.chi.il.us
#include http://homepage.interaccess.com/~driscoll/
On Jun 9, Paul Christian Nelis wrote:
> Windows 95 and NT 4.0 Registry & Customization Handbook
>
> It's a Que book, by Jerry Honeycutt. Pretty good. Talks about using inf
> and reg files to do batch updates and modification to the registry. It
> also talks about regedt32 vs regedit, Policy Editor, etc.

There's an O'Reilly book about the Win95 registry. 
Perhaps NT's will be the subject of the next book.


-- 
Ng Pheng Siong * Pacific Internet Pte Ltd * Singapore
PGP: send mail with subject "send pgp key" * http://darkwing.pacific.net.sg

Fast. Secure. Cheap. Pick two.
How about you post it all on a web page for all to see and contribute
to. You might find a more find more interactive feedback

Steve


Elias Karakoulakis wrote:
> 
> Hello All,
> 
> I am compiling a list of common registry keys that are useful to be
> manipulated via login scripts or the System Policies. For example,
> trying to lock down %systemroot% hard, requires me to change the
> Internet Explorer's cache, cookies and history folders (to be
> pointing e.g. to c:\temp). For that, I've made an addition to the
> (shell) policy in winnt.adm (poledit template)
> Could you be so kind to help me with all the keys you've found
> noteworthy, I would be grateful.
> 
> p.s. Mail me too if you want any login scripts, PolEdit templates and
> administration scripts that I've made.
> 
> Elias Karakoulakis
> Undergraduate student at the National Technical University of Athens
> ekarak@softlab.ece.ntua.gr

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
--------------------------------------------------------------------
> I've ether-sniffed my ssh connections and observed a handful of bytes
> per 1 byte keypress... perhaps 4-6 bytes created when I'm in triple
> DES mode. I love the program, the security is military grade point

 Try Blowfish - it should be both faster and lighter and harder to
break. The DES has been around for ages and its S-boxes are solid
against all known forms of attacks - that much is certain - but no
weakness is known to exist in Blowfish either. (I do not consider
brute-force-search an attack as any cryptosystem will fail to that.)

> to point, and the only thing more you'd need is tempest equipment
> and storage encryption for icing on the cake. Now if they would
> just do the same for FTP.

 This issue has been discussed with DataFellows in detail and they
admit that the current implementation of SSH cannot forward ftp (except
PERHAPS in passive mode). They have promised to "look into it" for the
next release. I am not too optimistic about this anyway - I do not
appreciate datafellows at all. The original SSH program developed by
Taty Ylönen was a GNU software (as the unix version still is thanks to
Tatu), but DF charges unimaginable sums for the other OS versions of
SSH. Second example is F-PROT, an icelandic anti-virus software, is
excellent and used to be shareware until DF took over... Both programs
are excellent as other DF programs seem to be also (forgetting the fact
that there is no 32-bit windows SSH client).

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
For both NT 4.0 Server and Workstation.

1) Go into Programs->Administrative Tools (Common)->User Manager.
Selection Options->Auditing. Then select the kinds of events you want to
audit.

2) Go into Programs->Administrative Tools (Common)->Event Viewer and then
select the security log. This will list all of the people who have logged
in/out of your system (plus whatever else you selected).

At 09:58 AM 6/10/97 -0400, cmbalodimos-barry@bkb.com wrote:
>
> How can I get the last login date and time for users without any third
> party packages (e.g., NO Somar dumpacl)?
>
> Please let me know!
>
> Thanks!
>
> Connie
>
>
If you have access to the NT Server Resource Kit you can use a Microsoft utility:

Excerpt from Knowledge base article Q158388
 Usrstat.exe Displays username, fullname, and last login date and time for
 each user account across all domain controllers.

I hope this helps.

 Michael Gillespie

-----Original Message-----
From: cmbalodimos-barry@bkb.com [SMTP:cmbalodimos-barry@bkb.com]
Sent: Tuesday, June 10, 1997 8:59 AM
To: ntsecurity(a)iss.net
Subject: [NTSEC] Last Login Date/Time


 How can I get the last login date and time for users without any third
 party packages (e.g., NO Somar dumpacl)?

 Please let me know!

 Thanks!

 Connie

There's a new one out from Wiley Interscience as well, but I left the
specs on it at home. I just got the flyer last night in the mail.

>----------
>From: ngps@pacific.net.sg[SMTP:ngps@pacific.net.sg]
>Sent: Monday, June 09, 1997 22:53
>To: nelis@wfg.com
>Cc: phac105@julia.ma.rhbnc.ac.uk; ntsecurity@iss.net
>Subject: Re: [NTSEC] NT Registry Books
>
>On Jun 9, Paul Christian Nelis wrote:
>> Windows 95 and NT 4.0 Registry & Customization Handbook
>>
>> It's a Que book, by Jerry Honeycutt. Pretty good. Talks about using inf
>> and reg files to do batch updates and modification to the registry. It
>> also talks about regedt32 vs regedit, Policy Editor, etc.
>
>There's an O'Reilly book about the Win95 registry. 
>Perhaps NT's will be the subject of the next book.
>
>
>-- 
>Ng Pheng Siong * Pacific Internet Pte Ltd *
>Singapore
>PGP: send mail with subject "send pgp key" *
>http://darkwing.pacific.net.sg
>
>Fast. Secure. Cheap. Pick two.
>
On Tue, 10 Jun 1997, Julie A Swindell wrote:

> Name: Chris Larsen
> City, State: Copenhagen, Denmark
> Phone: +45 33 33 93 38 (from 18.00-24.00 CET) or +45 38 27 37 95 (from 
09.00 - 16.00 CET)
> Fax: -
> E-Mail: vader@babel.dk, vader@inet.uni-c.dk
> Job Title: System Manager
> Company Name: Struers A/S (main employee), Babel: Internet Cafe 
(leisure time employment)
> Company's Industry: Struers: Metallographic equipemnt manufacturing and 
consuambles for this machinery. Babel: Well.. Internet access, 
surveillance, network monitoring, security audits, web publishing, 
techinical support, inet related education.
> Company's approximate # of employees: Struers: ~130, Babel: ~10

> 1. Are you, or have you ever been employed by IBM?
> ____ Currently employed by IBM
> ____ Previously employed by IBM
> _X__ Never employed by IBM
> 
> 2. Check all of the following that describe you:
> _X__ I have responsibility for managing or maintaining IT Security 
products/systems for my company.
> _X__ I have responsibility for formulating and managing my company's IT
> Security policy.
> ____ I manage part of my company's business where the supporting IT 
Security > system plays a very important part.
> _X__ I make or influence the purchase decision for IT Security 
products, technologies or services for my company.
> _X__ I have a strong business need for information about IT Security 
products, technologies, services, trends, issues, etc.
> 
> 3. Please describe any additional job responsibilities you have regarding IT
> or other security:
Internal security auditing, break in intrusion detection and evaluation. 
Logging and documenting of break ins for later use in court of law or 
other pursuits.

> 4. Which of the following describes your use of the internet to gain job
> related information?
> ____ Never use the World Wide Web
> ____ Occasionally use the World Wide Web
> ____ Never use the World Wide Web
Excuse me for adding my own:
 _X__ Always use the world wide web.

>
> 5. In which of the following research activities are you interested in being a
> participant? (Check all that apply)
> ____ Day focus groups (6 to 8 hours)
> _X__ Evening focus groups (3 to 4 hours)
> ____ US Mail Surveys
> _X__ E-Mail Surveys
> _X__ WWW Surveys
> _X__ Product Evaluations (4 to 6 hours)

> 6. Would you be willing/ able to travel to our site at Research Triangle Park,
> NC at our expense if an activity required it?
> _X__ Yes
> ____ No
> 
> Julie Swindell
> Web Externals Design & Development
> (919) 254-6061
> jaswinde@us.ibm.com
> 

Also refer to my previous email :-)



Chris Larsen | We learn from history, 
vader@inet.uni-c.dk | that we do not learn from history...
System Manager |
Struers A/S | All opinions expressed herein are my own
 | and _not_ those of my employers !!.

Frank Knobbe wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
>
> Does anyone know if there are organisations that certify someone on
> computer security? I'm not looking for products like the ISS stuff
> or
> Cisco's PIX and the like, but rather for a general security
> certification, something that can qualify one as a computer security
>
> specialist.
>
> Please let me know if you know about such a thing, preferably with
> URL.
>
> Thanks,
> Frank
>
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
>
> iQCVAwUBM5r2bcZP3ocmY5AlAQHLhgP/UFhNJnyrxAyEEZ7pgqeMBLs1qwhbxegf
> aR56WbTwexWewGiQ2uFVXy9kL4VGJaFUNm5ubaQvvDndFDumoDy/5HaxLALkyRUY
> UdCAB1Xb9BZHY8gbEfQgWpknjELWNIkemmTdeZsfCgo02FIArcCVaPRTsNhYj/1C
> uAlzXnE0a1A=
> =q06q
> -----END PGP SIGNATURE-----
> -----BEGIN SPAM WARNING-----
>
> WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
> AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
> THIS WILL DISABLE FURTHER CORRESPONDENCE.
> PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> EMAIL LIST.
>
> -----END SPAM WARNING-----

Try InfoSecurity News magazine at http://www.infosecnews.com
There was an article run on certifications for info security in the May
or April 97 issue.
The e-mail is ISN@misti.ccmail.compuserve.com

-Andre



On Thu, 22 May 1997, LR LeVally wrote:

> > From: "Joel W. Barrett" 
> 
> > You'll need to create an access list and then apply that access list to an 
> > interface on the router.
> > 
> > access-list 100 deny udp any {ip subnet} {subnet mask} eq 139
> > 
> > interface serial 0
> > ip access-group 100 in
> 
> Suppose I wanted to allow tcp access to port 139 for specific
> subnets only, i.e., deny the world, permit selected subnet?

Permit the selected, THEN deny the world. Least restrictive first, 
catch-alls last.

> 
> Can this be done on a Cisco 2501?
> 

Yes.

When replying to surveys sent to mailing lists, try to remember that 
"reply to all recipients" will include the list ... 

On Tue, 10 Jun 1997, Chris Larsen wrote:

> On Tue, 10 Jun 1997, Julie A Swindell wrote:
> 
> > Name: Chris Larsen
> > City, State: Copenhagen, Denmark
> I suppose that you can make the installation program run as an interactive service. This way, the installation will have system rights.
> 
> 
> ----------
> De: Dan Bryntze[SMTP:d92-dbr@nada.kth.se]
> Enviado: miercoles 11 de junio de 1997 13:08
> Para: ntsecurity
> Asunto: [NTSEC] Installing programs on NT Workstation
> 
> Hi!
> 
> I'm looking for a way to distribute programs to NT Workstations. The
> problem is that my users runs with User rights and some programs
> requires higher rights when installing the program (for example
> Administrator rights). What I'd like to do is to distribute programs so
> that users could install it even if it requires Administrator rights
> during installation (make the installation programs to run with
> Administrator rights during installation). Are there any
> programs/systems that could do this?
> (Microsoft SMS??)

Here we use McAfee's SaberLan and that seems to deal with most 
installation and software distribution options we want, not only for 
NT but also Novell. It also deals with application licenses etc.

Rgds, Mike.
--
Michael Roy Collins - Network Engineer - Tel: +44 (0)1983 526631 ext. 252
 The Isle of Wight College. Newport, Isle of Wight. PO30 5TA
Email: (work) Mike@iwightc.ac.uk (home) Mike@tiwc.demon.co.uk
> Administrator rights). What I'd like to do is to distribute programs so
> that users could install it even if it requires Administrator rights
> during installation (make the installation programs to run with
> Administrator rights during installation). Are there any

 You might want to try to accomplish this with the SU.EXE -program
included in the NT Resource Kit. It is similar to unix SU-programs and
it gives temporary administrator priviledges.

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
On Wed, 11 Jun 1997 bdfrost@centralplastics.com wrote:

> I am still trying to use the AT scheduler to do remote shutdowns on NT
> machines across the network. I am the domain admin and also have start the
> scheduler as myself. Whenever I run my shutdown.exe routine from the
> scheduler, I get an access denied, though I can run it from the command
> line.

What user is the schedule service running as? You'd have to be
administrator to run the shutdown, so make sure the account you use for
the scheduler is a member of admins... Don't use the LSA.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "Boy meets beer. Boy drinks Beer, |./|\.
..\|/..|sunder@sundernet.com| Boy gets another beer!" |/\|/\
<--*-->| ------------------ | |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

At 03:43 PM 6/11/97 +0300, Juha Jäykkä wrote:
>> Administrator rights). What I'd like to do is to distribute programs so
>> that users could install it even if it requires Administrator rights
>> during installation (make the installation programs to run with
>> Administrator rights during installation). Are there any
>
> You might want to try to accomplish this with the SU.EXE -program
>included in the NT Resource Kit. It is similar to unix SU-programs and
>it gives temporary administrator priviledges.

No, it does not give the user temporary administrator privileges, because
inorder to use SU.EXE the user must actually have more privileges
(SE_TCB_NAME) than the standard administrator account! I believe there is a
SU implementation out there that uses a service to encapsulate the
extensive privileges that are necessary to logon a user. The actaul command
run by the user feeds the username and password to the service by some IPC
mechanism and the service gets a token for the target user. This is a much
better implementation, for your users don't need to have excessive
privileges and potentially the service could implement some authorization
scheme to limit which users can attempt to SU.

Dominique

>
>-- 
> ---------------------------------------
> | Juha Jäykkä, juolja@utu.fi |
> | Turun yliopisto, ATK-keskus |
> | University of Turku, Computer Centre |
> | työ/office: +358 2 333 5961 |
> ---------------------------------------
>
>
Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
take a look at the Win-eXpose-Registry SHAREWARE 
you can download it from http://www.shetef.com
enjoy
Ziv
--- On Mon, 2 Jun 1997 09:21:16 -0500 Mark Hellel wrote:
> 
> 
> There are a couple of tools already out there that do this. Have a look at 
> regmon from O'reilly associates and have a look at sunbelt tools INC who do a 
> lot of third party utils.
> 
> 
> 
> Marky_Mark
> 
> You can lead a horse to water but a pencil must be lead!
> ______________________________ Reply Separator _________________________________
> Subject: Re: [NTSEC] Tool for monitoring changes in NT
> Author: Steve Toomey at Internet
> Date: 02/06/97 08:25
> 
> 
> You can use SYSDIFF (res kit) or 3rd party tools like Wininstall to take 
> snapshots of a registry and compare them 
> 
> Steve
> 
> 
> Jonn Martell wrote:
> > 
> > We are looking for a tool to monitor any changes done to the registry and 
> > to certain (system) directories.
> > 
> > We've looked for some time but can't find a good tool that can do this 
> > simple task. Without such a tool, administering NT properly in almost 
> > impossible.
> > 
> > One of the basic fundamentals in security is to monitor changes. One needs 
> > to easy find out when some registry keys have been changed and how. It's 
> > also important to know when certain files have been changed (through CRC
> > check?). It would be even nicer if the tool could monitor the file system 
> > changes as they happen and perform a file backup to a special mirror
> > directory (but I'll stop dreaming...). 
> > 
> > Having to reinstall NT because an SP failed is a joke - a good tool should 
> > be able to "perform an SP uninstall" and protect from other "trojan-like" 
> > nightmares :-)
> > 
> > If you know of any product, please email me directly and I'll summarize to 
> > this list in 7 days.
> > 
> > .................................................................. 
> > Jonn Martell, Network Analyst
> > University of British Columbia
> > "The more I work with NT, the more I like [the other system]...."
> 
> -- 
> ----------------------------------------------------------------------- 
> Steve Toomey | Internet Address : toomeys@dircon.co.uk 
> London, UK | Home page :
> Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys 
> -----------------------------------------------------------------------

---------------End of Original Message-----------------


 /~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
 | A B I R N E T Active Network Protection | 
 \~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/
 \========== Get an EVALUATION COPY at ===========/

Frank;

In addition to the ones already identified to you, The American Society for
Industrial Security (ASIS) (the largest security organization) has a
certification called the Certified Protection Professional (CPP)

They have a large national as well as international membership (over 25,000)

Overall they are more focused on the physical security issues but are very
diverse and do have a Computer Security emphasis. Of the more than 30
Standing Committees/Councils, roughly half are concerned with security
problems affecting businesses such as banking and financial institutions,
educational institutions, health care facilities, public utilities, and
retail establishments. The other half address general security problems
such as terrorism, physical security, computer security, privacy and
information management, investigations, white collar crime, fire prevention
and safety. Members of these committees/councils prepare special reports and
other publications, conduct security studies, and develop educational
programs which focus on specific security topics.

Check out their site for additional information:

http://www.asisonline.org/

Hope this helps,

Aaron


At 01:14 PM 6/8/97 -0600, you wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>Does anyone know if there are organisations that certify someone on
>computer security? I'm not looking for products like the ISS stuff or
>Cisco's PIX and the like, but rather for a general security
>certification, something that can qualify one as a computer security
>specialist.
>
>Please let me know if you know about such a thing, preferably with
>URL.
>
>
>Thanks,
>Frank
>
>
>
>
>-----BEGIN PGP SIGNATURE-----
>Version: 2.6.2
>
>iQCVAwUBM5r2bcZP3ocmY5AlAQHLhgP/UFhNJnyrxAyEEZ7pgqeMBLs1qwhbxegf
>aR56WbTwexWewGiQ2uFVXy9kL4VGJaFUNm5ubaQvvDndFDumoDy/5HaxLALkyRUY
>UdCAB1Xb9BZHY8gbEfQgWpknjELWNIkemmTdeZsfCgo02FIArcCVaPRTsNhYj/1C
>uAlzXnE0a1A=
>=q06q
>-----END PGP SIGNATURE-----
>-----BEGIN SPAM WARNING-----
>
>WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
>VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
>AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
>THIS WILL DISABLE FURTHER CORRESPONDENCE.
>PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
>THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
>EMAIL LIST.
>
>-----END SPAM WARNING-----
>
>

 / Aaron Kramer
 ____/ ____/ ___ / ____/ 10 West Broad St.
 ____ / ____ / /__/ / ____ / Suite 1660
 _______/ _______/ _______/ _______/ Columbus, OH 43215
 business driven technology solutions. 
 1-800-924-7737 ext.28
E-mail: aaron.kramer@ssds.com (614)221-0008 ext.28
Web Site: http://www.ssds.com (614)221-0010 fax

Gomberg, Jeff wrote:
> 
> Which proxies are noticeably absent?
> 
> Jeff
The telnet proxy and the generic service passer most noticeably.
The real audio proxy is also not there (although the real audio
people are working on streaming there stuff through port 80/tcp).

It is designed to give people access to HTTP, FTP, and SMTP/POP,
and it will handle on site mail server or server at the ISP.

The only incoming connection allowed is SMTP. No Telnet, http,
ftp.
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
On Jun 10, Bill Kastner wrote:
> Try WarFTPD. I've found it one of the best FTP Servers available, and it's
> shareware. The authors site is www.jgaa.com

Freeware, I think. It looks very feature-rich, and since this is the
nt_security_ list, you'd want to consider that and the associated
code complexity.

-- 
Ng Pheng Siong * Pacific Internet Pte Ltd * Singapore
PGP: send mail with subject "send pgp key" * http://darkwing.pacific.net.sg

Fast. Secure. Cheap. Pick two.
>> You might want to try to accomplish this with the SU.EXE -program
>>included in the NT Resource Kit. It is similar to unix SU-programs and
>>it gives temporary administrator priviledges.
> No, it does not give the user temporary administrator privileges, because
> inorder to use SU.EXE the user must actually have more privileges
> (SE_TCB_NAME) than the standard administrator account! I believe there is a

 Oops... noticed that immediately after sending the mail. But never the
less SU.EXE would do it!-) By the way, what does the
SeIncreaseQuotaPrivilege actually mean?

> SU implementation out there that uses a service to encapsulate the
> extensive privileges that are necessary to logon a user. The actaul command
> run by the user feeds the username and password to the service by some IPC
> mechanism and the service gets a token for the target user. This is a much

 And the service is run with SYSTEM privileges? Sounds excellent. Which
brings me to another point: the VDESK-program in the reskit allows up to
ten users to have their programs run on the same computer, on different
desktops. 
I have three questions, how ever:
 1) Any security problems around with VDESK? (Not too good an idea to
share
 workstations this way, I know.)

*** WARNING NON-SECURITY ISSUE COMING ***

 2) When user A is logged on and desktop 2 is switched on, user B
"logs"
 on and tries to start a program, they usually exit with different
error
 levels; EXPLORER, for example, cannot run if B is not the same as
A. Is
 there any way to fix this?
 3) If I lock the workstation, it is always locked by the first user
who has
 logged on (i.e. user A), not the user who "owns" the current
desktop.
 Can this be fixed?

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
I would definitely say, *do not* use this product as a external product. As soon as you let a session attach to your workstation the external user has your rights on your box. We are however, looking at this product to do some limited remote administration (i.e. Task Mgr.), the price is right for the product. 
-
Rick Bertoncin
Server Development Group
Ford System Integration Center
rbertonc@ford.com


-----Original Message-----
From: Bill Casti, CQA [SMTP:quire@casti.com]
Sent: Wednesday, June 11, 1997 10:26 PM
To: NT Security List
Subject: [NTSEC] re: NetMeeting


Anyone have any feelings about the security implications of NetMeeting on 
a firewalled environment? We know that there is currently no way to proxy 
NetMeeting session on TIS Gauntlet, because it uses both TCP and UDP 
packets with dynamic addressing. So, it's not feasible as an 
internal-to-external technology.

But, anyone heard or know of any substantive security risks using it as 
an internal-only or external-only program??

The only ones seemingly saying anything about NetMeeting seems to be 
Microsoft. I'd like to hear from any third-parties, too... :)

Thanks.
Bill

==============================================================================
 Bill Casti, CQA Email: bill@casti.com
 Pager: +1 800 604 6149 Fax: 703 834 8209
==============================================================================


Agreed. Wholeheartedly! Been there, seen that and suffered from those
who've done it. Our 'power user' group includes software development
engineers and 'professionally' qualified people. It's an undisciplined,
possibly lazy, way to discharge any networking / security
responsibilities we may have. 
I.T. cannot and should not IMHO, loosen up their approach to software /
hardware issues and standards and practices. Already a lot of
credibility has been lost through treating software systems and their
installation / control as something like adding a plug to a household
appliance. 
Microsoft and other desktop type system suppliers have done great work
in moving computing power to the user, but have also have created a
problem insofar as we spend more time and Money, company wide, on
teaching people to use this software, than on training for the job they
do. We also lose focus on the degree to which I.T. staff are trained as
well as the breadth that the training should have. Compared with 'old
mainframe' days, we have replaced the 'expensive' systems programmer
type with thousands of cheaper people, who cost hundred times more! The
company that moved towards PC based information systems in a NOS
environment has changed it's spending pattern, rather than save money or
increase job specific productivity! 
Integration of user / computer is a vexed issue made uglier by handing
over to the user that which should be handled within I.T.

Regards
Kevin Sizer
Information Security

> ----------
> From: Paul Leach[SMTP:paulle@microsoft.com]
> Reply To: Paul Leach
> Sent: Wednesday, June 11, 1997 11:37 PM
> To: ntsecurity@iss.net; 'Allan Bourdius'
> Subject: RE: [NTSEC] Installing programs on NT Workstation
> 
> All very nice and convenient, but just keep in mind:
> 
> If you let "J. Random User" (JRU) install software on his/her machine,
> then you better be careful to make sure that "L. Powerful
> Administrator"
> (LPA) never logs into that machine, because JRU could have installed a
> password filter to steal LPA's password.
> 
> (JRU may not have even been aware that they installed the password
> filter -- they might have been cruising the web and downloaded some
> program that did the dirty deed...)
> 
> Paul
> > ----------
> > From: Allan Bourdius[SMTP:abourdiu@fore.com]
> > Reply To: Allan Bourdius
> > Sent: Wednesday, June 11, 1997 11:00 AM
> > To: ntsecurity@iss.net
> > Subject: Re: [NTSEC] Installing programs on NT Workstation
> > 
> > Assuming that you are in a NT domain environment, the easiest way to
> > allow
> > users the ability to have full or partial full control of their
> > workstations is to use the "Administrators" or "Power Users"
> built-in
> > local
> > groups.
> > 
> > Placing the domainname\Domain Users group in the localmachine\Power
> > Users
> > group will give users most of the software and device loading
> > functionality
> > that they need.
> > 
> > If you put the domainname\Domain Users group in the
> > localmachine\Administrators group, all domain users will have
> > administrator
> > right to the local workstation.
> > 
> > Alternatively, you can put individual domain user accounts in the
> > local
> > groups.
> > 
> > This works very well, and has solved a great deal of our problems...
> > 
> > Allan
> > 
> > 
> > At 10:05 AM 6/11/97 -0500, Pradeep Tapadiya wrote:
> > >>From: egb@austin.ibm.com
> > >...
> > >>
> > >> Just to lessen my ignorance, why does a program need
> > >> administrative rights to install? There must be a list of
> > >> reasons, but I can't think of any good ones. Please educate
> > >> me?
> > >>
> > >> Here is a short list of possible reasons:
> > >> 1) Program needs a user id to operate under.
> > >> 2) Program wants to install something in
> > >> \winnt\system32 directory.
> > >> (Why? won't the %LIB% path search the application's
> > >> directory for the same library?)
> > >> 3) Installation can't get past certain nodes in the
> > >> registry due to incorrect ACL settings.
> > >> 4) ... there are probably a number of other reasons.
> > >>
> > >> The only useful item in this list is #1. All the rest of the
> > >> installation could be done as the newly created "ordinary"
> > >> user. Am I missing something?
> > >>
> > >> Thanks.
> > >> Ed
> > >>
> > >
> > >5. Installing a service.
> > >6. Modifying registry.
> > >
> > >Pradeep
> > >pradeep@nuview.com
> > >
> > >
> > >
> > -------------------------------------------------------------------
> > All new computing problems must be reported to the Help Desk.
> > -------------------------------------------------------------------
> > Allan Bourdius Help Desk: (412) 772-8700
> > System Administrator (NT Servers) Direct: (412) 772-5807
> > Information Systems & Services Main: (412) 772-6600
> > FORE Systems, Inc. Fax: (412) 772-6500
> > 174 Thorn Hill Road Email: abourdiu@fore.com
> > Warrendale, PA 15086 URL:
> http://www.fore.com
> > "At the FOREfront of ATM internetworking - The ATM Experts."
> > Personal URL: http://www.geocities.com/CapitolHill/8260/
> > 
> 
Charles Deling wrote:
> 
> I keep a log of accesses of my web server and someone tried to connect to
> ports 1351, 1352 and 1353. What are these ports? I cant find any
> documentation of them.
> 
> Thank you!

ESM, a security audit tool by Axent Technologies uses these ports when
the agents communicate with the security manager. If you or your
company has run this lately, you may have received a hit or two from
this product.

Just a thought.

Pat Hayden
> 
> All very nice and convenient, but just keep in mind:
> 
> If you let "J. Random User" (JRU) install software on his/her machine,
> then you better be careful to make sure that "L. Powerful Administrator"
> (LPA) never logs into that machine, because JRU could have installed a
> password filter to steal LPA's password.
> 
> (JRU may not have even been aware that they installed the password
> filter -- they might have been cruising the web and downloaded some
> program that did the dirty deed...)
> 
> Paul

Ture. And frightening. The point is that once a malicious program runs
in an administrative session there are (at last count) 19,367 ways it
can completely subvert that computer's and perhaps the network's
security (can you say "session hijacking"). PASSFILT is certainly one of
the easier ways to do so. This is not, BTW, an indictment of Windows NT.
It's as security-sound as any commercial operating is likely to be in
our lifetimes. The problem is that it's very, very easy to download a
Trojan Horse in today's seamless, transparent, world-wide-webbed
community. Without a "sandbox" for the horse's activities, these kinds
of attacks are "easy pickin's."

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/

At 02:56 PM 6/7/97 +0200, Kris Carlier wrote:
>Is it true that, in order to use pptp, you need "servers" at both sides,
>i.e. your IAP will need to support PPTP too.
>

No. MS has a SW driver for NT and a beta for '95

>Is it true that PPTP runs on top of TCP ? 

Port 1723, right?

>
>Is there a definitive answer about the portnumber pptp runs on ?
>
>kr=
> \\\___///
> \\ - - //
> ( @ @ )
> +---------------oOOo-(_)-oOOo-------------+
> | kris carlier - carlier@iguana.be |
> | Hiroshima 45, Tsjernobyl 86, Windows 95 |
> | Linux, the choice of a GNU gener8ion |
> | SMS: +32-75-61.43.05 |
> +------------------------Oooo-------------+
> oooO ( )
> ( ) ) /
> \ ( (_/
> \_)
>
>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
PPTP uses 40/128 bit encription, depending on US/Canada or rest of the 
world. Third party plug ins are available for non-North American 
continents.

Regards

Ben Thomas
BA(Th), MCT, MCSE, MCSD

mailto://bthomas@pro.co.nz
http://www.pro.co.nz

Ph: Intl+64 (4) 577 3771
Fx: Intl+64 (4) 577 3772
Mobile: 025-59 59 59


-----Original Message-----
From: Ryan Anderson [SMTP:ryan@michonline.com]
Sent: Sunday, June 08, 1997 9:42 AM
To: Kris Carlier
Cc: vojin; NT Security List
Subject: Re: [NTSEC] Secure Telnet!

On Sat, 7 Jun 1997, Kris Carlier wrote:

> > If we were to use PPTP would'nt all communications, regardless of the 
port
> > in use, be secure.
> > Assuming that this is correct, ssh equivalents would then probably be
> > redundant.
[...]
> b) pptp is secure enough

PPTP uses encryption?

-----------------------------------------------------------------------
Ryan Anderson - "Who knows, even the horse might sing"
Wayne State University - CULMA "May you live in interesting times.."
ryan@michonline.com Ohio = VYI of the USA
PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9
-----------------------------------------------------------------------

Hi Eric,

On Sat, 7 Jun 1997, Eric Germann wrote:

> >Is it true that, in order to use pptp, you need "servers" at both sides,
> >i.e. your IAP will need to support PPTP too.
> 
> No. MS has a SW driver for NT and a beta for '95

In that case, I have a (too) old version of the MS 687C course
(Supporting MS NT4.0 Core technologies). On page 339 (Module 12: Remote
Access Service), I read the following:

"Calling an ISP
When using an ISP with PPTP, the only difference is that the client must
first call an ISP to gain access to the Internet. PPTP must also be
supported at the ISP's POP. Therefore, the client first calls the ISP, and
after establishing a connection to the ISP, calls the WNT RAS server
through that connection to extablish the PPTP tunnel."
 
To be precise, when I write IAP: Internet ACCESS Provider, I guess I mean
the same as MS who speaks about the more general term I Service P.

Is this a new feature in the PPTP stuff that I didn't see ? if so, where
can I get the update ?

> >Is it true that PPTP runs on top of TCP ? 
> 
> Port 1723, right?

> >Is there a definitive answer about the portnumber pptp runs on ?

I am wondering why you need PPTP when you can do IP-IP (e.g. using
linux), without the need for the IAP to do something special for you. If
you want it to be encrypted, pipe it through a SSH-connection ? What's
wrong with that scenario ?

kr=

 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)



On Sun, 8 Jun 1997, Kris Carlier wrote:

> In that case, I have a (too) old version of the MS 687C course
> (Supporting MS NT4.0 Core technologies). On page 339 (Module 12: Remote
> Access Service), I read the following:
> 
> "Calling an ISP
> When using an ISP with PPTP, the only difference is that the client must
> first call an ISP to gain access to the Internet. PPTP must also be
> supported at the ISP's POP. Therefore, the client first calls the ISP, and
> after establishing a connection to the ISP, calls the WNT RAS server
> through that connection to extablish the PPTP tunnel."
> 
> To be precise, when I write IAP: Internet ACCESS Provider, I guess I mean
> the same as MS who speaks about the more general term I Service P.
> 
> Is this a new feature in the PPTP stuff that I didn't see ? if so, where
> can I get the update ?

Your documentation is very old. PPTP started life as a protocol to be
implemented at the terminal server level. A bunch of terminal server
companies like ascend and 3com implemented it. Microsoft has since
extented it to do end-to-end tunneling. Check the Microsoft web site for
an update.

> I am wondering why you need PPTP when you can do IP-IP (e.g. using
> linux), without the need for the IAP to do something special for you. If
> you want it to be encrypted, pipe it through a SSH-connection ? What's
> wrong with that scenario ?

Because PPTP not only allows you to encapsulate IP, it also encapsulates
IPX and NetBUI. PPTP is really just PPP over GRE with a control TCP
connection. BTW, PPTP doesnt really do encryption. PPP does the
encription. Encryption and authentication are negociated by PPP over GRE
not the PPTP control connection.

> kr=
> 
> \\\___///
> \\ - - //
> ( @ @ )
> +---------------oOOo-(_)-oOOo-------------+
> | kris carlier - carlier@iguana.be |
> | Hiroshima 45, Tsjernobyl 86, Windows 95 |
> | Linux, the choice of a GNU gener8ion |
> | SMS: +32-75-61.43.05 |
> +------------------------Oooo-------------+
> oooO ( )
> ( ) ) /
> \ ( (_/
> \_)
> 
> 
> 

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 


Does anyone know if there are organisations that certify someone on
computer security? 

Thanks,
Frank

You may want to look at :http://www.isc2.org - they offer certification exams leading to the CISSP qualification - the exams are based on a CBK (Common Body Of Knowledge) covering ten different areas relating to security.

If anyone else knows of anything similar - please let me know.

Best Regards - Ivor

Bob Tinsley wrote:
> Unfortunately, the code-base is huge (ssh is all-singing, all-dancing) and
> there have been occasional complaints in comp.security.unix that it has never
> been properly audited. 

ssh has been audited this spring at a Network Security Seminar at 
Helsinki University of Technology. I think there is going to be
published 
a paper by the auditors.

> Don't get me wrong; ssh is an excellent piece of software, but I _would_
> object to claiming it offers `military grade security' until it achieves
> at _least_ an E4 rating.

I do agree that this is the case for the freeware/shareware version.
However I do believe that they (http://www.ssh.fi) are at the
moment fixing the security holes found from ssh for the commercial
version.

--
Pauli Wihuri, pauli@wihuri.pp.fi, +358 50 62344

You can do this. The service called Scheduler is the NT equivalent of
Cron. Use Server Manager (or net commands) to make sure that the server
service is running automatically on all machines. Then you may schedule
batch jobs to occur whenever you like with the AT command. Here's the
command-line syntax taken from AT /?.

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
 [ /EVERY:date[,...] | /NEXT:date[,...]] "command"

\\computername Specifies a remote computer. Commands are scheduled on the
 local computer if this parameter is omitted.
id Is an identification number assigned to a scheduled
 command.
/delete Cancels a scheduled command. If id is omitted, all the
 scheduled commands on the computer are canceled.
/yes Used with cancel all jobs command when no further
 confirmation is desired.
time Specifies the time when command is to run.
/interactive Allows the job to interact with the desktop of the user
 who is logged on at the time the job runs.
/every:date[,...] Runs the command on each specified day(s) of the week or
 month. If date is omitted, the current day of the month
 is assumed.
/next:date[,...] Runs the specified command on the next occurrence of the
 day (for example, next Thursday). If date is omitted, the
 current day of the month is assumed.
"command" Is the Windows NT command, or batch program to be run.

Note that you may schedule jobs *for* other machines as long as you have
privilege on that machine.

There are also 3rd party tools such as QMaster, or SQL Server that do a
more robust job of scheduling, but the AT command is free.

 --Paul




At 08:39 PM 6/6/97 -0400, you wrote:
>Just a thought, it is a pain to have to go around
>to workstations and routinely update the ERDs. It
>would be nice if an event scheduler (equivalent of 
>crontab in Unix) would be implemented so that a 
>reminder or prompt for a ERD update were displayed 
>on each workstation and server.
>
>-Jeff
>
>
> http://www.sitta.uwstout.edu/gerberje/
>
+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*
Paul Christian Nelis | "There is nothing so inefficient as 
Citadel Investment Group. | efficiently doing that which should
nelis@wfg.com | never have been done at all."

On Fri, 6 Jun 1997, Kelly E. Gibbs wrote:

> 
> Also you can change registery entries from the command line, so if you
> require say two very different configurations, a batch file can alter the
> params and reboot. Is there any interest in this batch file, please let me
> know and I'll post what I have or is everyone aware of how to do this?

Love to have that too. :)

And some way to restore a whole tape to the drives by booting off a floppy
and CD (drivers and all that have to be on there, etc.) Otherwise, your
drive crashes, you have to sit there and reinstall NT from scratch and
then restore it from tape... :( I'd rather just stick a tape in, boot off
the CD and tell it "restore it all while I go out for a few hours..."

I wish we could get rid of the annoying 3 floppy boot. I'm sure a single
floppy that has drivers for various CDROMS and code to just boot off the
CDROM would be more convenient too... After all there are some machines
that can boot right off the floppy, so all we need is a small tiny program
to boot off a CDROM... :( Most of the newer BIOSes have that feature
anyway...

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "Boy meets beer. Boy drinks Beer, |./|\.
..\|/..|sunder@sundernet.com| Boy gets another beer!" |/\|/\
<--*-->| ------------------ | |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

I'm just sending this message to test the waters. I occasionally have to
recruit people to come in and take a look at some new IBM security software, or
the web pages that are associated with it. IBM does pay people for their time
and it gives users a chance for a sneak preview at some of our newest
technology. The reason I chose this group is because we are working on our
Firewall as well as SecureWay, Internet Connection Server and eNetwork
products. If it would not annoy or offend anyone to have this posted here,
please let me know.

Thanks in advance.

Julie Swindell
Web Externals Design & Development
(919) 254-6061
jaswinde@us.ibm.com
On Mon, 9 Jun 1997, Jan Braeuer wrote:
> hallo,
> 
> i am looking for a product (firewall) that can handle a ip address
> translation, where the schema for translation depends on the target ip
> address for the traffic
> for example internal net 192.168.10.0 and traffic for network 172.16.x.x
> should be translated to 172.17.x.x and traffic for 192.168.100.0 should be
> translated to 192.168.101.x .

If you have a spare machine, Linux with masquerading is a free/easy solution.
Spend 39.95 for the CD though. FTPing a couple hundred meg is no fun. 

www.redhat.com

 -al
____________________________________________________________
Alexander N. Spitzer *** cyways, inc. *** Internet Solutions
------------------------------------------------------------
MailTo:aspitzer@cyways.com Web :http://www.cyways.com
Phone :(800) 5-cyways Fax :(617) 926-8440
Pager :aspitzer-pager@cyways.com (first 80 chars of message)
------------------------------------------------------------
 My address MAY NOT be used for UNSOLICITED email.
------------------------------------------------------------


Windows 95 and NT 4.0 Registry & Customization Handbook

It's a Que book, by Jerry Honeycutt. Pretty good. Talks about using inf
and reg files to do batch updates and modification to the registry. It
also talks about regedt32 vs regedit, Policy Editor, etc.

 --Paul

At 04:10 PM 6/9/97 +0100, Mark Curphey wrote:
>Can anyone recomend a specific NT registry text book ? Something more
technical
>than "Windows NT registry Troubleshooting" by Rob Tidrow that I can really
get
>down to the security concerns with. 
>
>Regards,
>
>
>Mark Curphey
>
>
+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*
Paul Christian Nelis | "There is nothing so inefficient as 
Citadel Investment Group. | efficiently doing that which should
nelis@wfg.com | never have been done at all."

Gunther,
We also could not reproduce the problem after applying the Post-SP3 OOB
fix. Bug closed.
Thanks,
Paul

> -----Original Message-----
> From: Gunnar Bredow [SMTP:gbredow@comtech.com.au]
> Sent: Sunday, June 08, 1997 5:56 PM
> To: Paul Bronowski (Volt Comp)
> Subject: Re: 86687: Ping with packet size of 65510 takes down NT
> 4.0 +SP3 (notyet verified).
> 
> Hi, Thanks for the prompt response. Appologies if this may have caused
> an
> alarm but this is is the configuration of the NT machine;
> 
> i486, 32M RAM
> Intel Etherexpress Pro/100 v1.04 network card.
> Build 1381
> Service Pack 3
> IIS 3
> TCPIP and IPX/SPX
> Client Services for Netware
> 
> I was on the same segment and from a Win95 machine (Compaq 133
> notebook
> with SMC EtherEZ 10M card) did a 
> "ping -l 65510 xxx.xxx.xxx.xxx"
> 
> anyway - the response was a prompt reboot (ie black screen and the
> whole
> reboot phase. At this the mouse service failed to start. A cold boot
> fixed
> this. (NB I did not do anything to the mouse such as wriggle it etc.)
> I wouldn't believe it so I did it again. Same thing except no services
> failed that time. And again I tried it.
> The end situation was I installed the OOB SP3 postfix and now I can't
> reproduce it which is a good thing.
> 
> If I reinstall SP3 I believe that would remove OOB, correct ?
> Then I could try it again.
> 
> regards, Gunther
> ----------
> > From: Paul Bronowski (Volt Comp) 
> > To: 'gbredow@comtech.com.au'
> > Subject: 86687: Ping with packet size of 65510 takes down NT 4.0
> +SP3
> (notyet verified).
> > Date: Saturday, 7 June 1997 4:00
> > 
> > Gunther,
> > Recently, you submitted a Windows NT bug report as described below.
> We
> > could not reproduce this problem. Please tell me exactly what you
> are
> > doing to cause this failure. What kind of network card does your
> system
> > use? Is this a blue screen failure, or an instantaneous reboot?
> Are
> > you able to reproduce the problem on multiple Windows NT systems?
> What
> > type of system are you pinging from?
> > Thank you for your help,
> > Paul Bronowski
> > Windows NT Test Team : )
> > To learn more about Windows NT please take a moment to visit
> > http://www.microsoft.com/ntworkstation and
> > http://www.microsoft.com/ntserver.
> > 
> >
> ----------------------------------------------------------------------
> --
> > --------
> > From: Gunnar Bredow [SMTP:gbredow@comtech.com.au]
> > Sent: Friday, June 06, 1997 1:19 AM
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] NT and POD
> > 
> > What ever happened to the Ping of Death scare ?
> > I set up a test NT 4 server with SP3 and pinged it with a packet of
> size
> > 65510 - whammo - the whole server reboots with quite ungracefully
> with
> > services failing until it was completely powerd off and restarted.
> Was
> > this
> > not meant to be fixed ? What is the issue when this is done across
> the
> > internet ? I would assume that routers would fragment it so it would
> not
> > be
> > a concern but this still concerns me.
> > 
> > any ideas ?
> > 
> > Gunther
> >
> ----------------------------------------------------------------------
> --
> > --------
I am running 4 Compaq Proliants (2x2000 and 2x 1500) and using SP3 
with no problems at all.

Cheers

David Eddey
IT Manager
Australian National Training Authority

----------
From: Keith.Pyper@berlitz.ie[SMTP:Keith.Pyper@berlitz.ie]
Sent: Saturday, June 07, 1997 8:47 AM
To: ntsecurity@iss.net; Gunnar Bredow
Subject: Re: [NTSEC] NT and POD

 Hi,

 I have a similar problem with a Compaq Proliant server, with SP3
 It just keeps rebooting every few days..?? It seems to shut down 
 safely, because there is no check disk ran on reboot.

 I have Compaq in sight manager on it but there is no hard ware
 problems are reported. As anybody else noticed this?

 Keith,


______________________________ Reply Separator 
_________________________________
Subject: [NTSEC] NT and POD
Author: "Gunnar Bredow" at btsdub-inet
Date: 06/06/97 16:18


What ever happened to the Ping of Death scare ?
I set up a test NT 4 server with SP3 and pinged it with a packet of 
size
65510 - whammo - the whole server reboots with quite ungracefully with 
services failing until it was completely powerd off and restarted. Was 
this
not meant to be fixed ? What is the issue when this is done across the 
internet ? I would assume that routers would fragment it so it would 
not be
a concern but this still concerns me.

any ideas ?

Gunther


Sunbelt Windows NTools[tm] Electronic Newsletter
 Vol. 2, #11 - June 7, 1997
 --- http://www.ntsoftdist.com ---

***************************************************************
Sunbelt Windows NTools E-News is the world's largest E-newsletter
designed for NT System Managers that have the job of getting and
keeping WinNT up & running in a production environment.
Sunbelt launched this electronic newsletter so that we could keep
members of the Windows NT community informed and aware of what is
happening with 3-rd party NT System Management Tools, and to
provide hints and tips that will enable you to better understand
and utilize Windows NT. You'll find general Windows NTools related
and third party news, technical information, and 3-rd party beta
and release information. By subscribing to NTools E-News, you are
also a charter member of the Sunbelt Field Test Bonus Program.
Sunbelt Software is the first and largest distributor worldwide
of Third Party System Management Tools for Windows NT.
****************************************************************

This issue of Windows NTools E-News contains:

1. "EDITORS CORNER" 
 * FIND OUT WHERE YOU WILL BE LIVING NEXT YEAR...

2. "TECH BRIEFING"
 * GET YOUR NT 4.0 MCSE TRAINING VIA SUNBELT
 * HOW TO SET UP NT FOR DATA SECURITY

3. "NT RELATED NEWS"
 * GATES SAYS NT 5.0 TO ENTER BETA THIS FALL
 * WIZARD FOR SMS ANNOUNCED
 * HELP TO SET UP NTWS ON MULTIPLE COMPUTERS
 * BOEING CHOOSES SMS FOR 100,000 MACHINES

4. "THIRD PARTY NEWS"
 * VINCA BEEFS UP NT CLUSTERING EFFORT
 * OCTOPUS STANDARD WITH ALL INTERGRAPH SERVERS
 * USERS SAY: GHOST AN EXCELLENT SOLUTION 
 
5. "HINTS AND TIPS - COUPLA GOOD ONES!"

6. "HOW TO USE THE MAILING LIST"
 Instructions on how to subscribe, sign off
 and change addresses.

**************************************************************

1. "EDITORS CORNER" 

Dear NT-ers,

The old Chinese curse "may you live in interesting times" is
more true than ever with NT. But the curse may also turn out
a blessing (we hope). Times are a'changin at an incredibly 
fast clip. 

Especially NT in it's new 5.0 incarnation will be a massive
change for us all. This NTools E-News issue has the coming 
Microsoft Management Console (MMC) at its focus. OK, what is 
MMC? It's where we all will live in the future!

Microsoft has seen that obviously the current System Administration
environment is not optimal. Tools are scattered, not integrated,
incomplete and at times cumbersome to say the least. Especially
in large shops this becomes a true impediment to full scale
deployment. So what have they done to improve this?

In short, Microsoft has been working on a bunch of technologies
that are now getting ready for prime time. Two good examples
of these technologies are objects and Microsoft's integration
of the Internet. Objects you will be working with in the form
of ActiveX controls, which are already available in Visual
Basic, Internet Explorer, Visual C++. In MMC these ActiveX
controls are fundamental. So, what IS this MMC?

MMC is going to take the central place of the SMS Administrator.
It is essentially best explained as a "container" you see on
the screen. It looks and feels much like the Explorer. It has
a parent frame, and children windows. You can easily add the
exact combination of management controls and links that do
the tasks you need in your environment. These combinations
are called consoles and you can create many of them. Best
of all, you can save them to a file and call them up when
you need them. 

MMC does not manage anything for you, but it provides a common
environment for the controls you add to the container. These 
controls are called snap-ins. Snap-ins will be written by Microsoft 
and independent software vendors (ISV's) MMC provides a seamless
integration for Microsoft and ISV's tools. It also heavily
leverages Internet technologies.

And in case you got worried, you can still use your existing
tools at the same time as one or more instances of MMC, and
use the O/S to switch back and forth. Also you can create
shortcuts in the MMC console to any .exe, script or URL.
The SMS administrator can also be snapped into MMC.

Microsoft has made a 25-page Word document available that goes
into great detail about MMC and we have it for you on our 
welcome page at http://www.ntsoftdist.com under the product
list with the heading: "NT Management Console Overview"
Microsoft has additional information at the following URL:
http://www.microsoft.com/management and it seems they have
posted the beta 2 of MMC last week as well.

I suggest you first download the 25-page guide and have a 
look at where you are going to live in the future, hope you 
like your new home ;-)

Warm regards,

Stu

BTW, we would like to know how you like the NTools E-News you
get. We have created a 1 minute survey on our website where you
can fill out our report card. (A=tops, F=stinks). We appreciate 
your input! http://www.ntsoftdist.com/reprtcrd.htm


***************************************************************

2. "TECH BRIEFING"

 * GET YOUR NT 4.0 MCSE TRAINING VIA SUNBELT
 (U.S-Only unless you can play US video tapes)

All of you are involved with NT in one way or another. Many of you
are looking at becoming an MCSE to increase your skills, job prospects
and pay. Time to get your hands on the Self-Paced Study Bundle for 
MCSE Core Exams.

Sunbelt has as usual scouted the market, and looked at different packages
that allow you to study at your own pace. Being as busy as you are, this
is usually the only way to get through something like this.

After evaluating the existing products, we chose the one we found is the
most tailored toward the actual exams and includes a set of test exams
and a bonus CD: Microsoft Road map to Certification. The set we chose for
you is the ultimate "All You Need To Become An MCSE" combination.

This complete package will take you on a step by step ride into the
all the facets of the NT operating System. Join Heather Osterloh as she
walks you through the video series and lays it out in simple concepts
while still getting you the knowledge and complete understanding you need
for the MCSE core exams. Topics include Windows NT Workstation, NT Server,
NT Enterprise and Networking Essentials. These categories approached in
step-by-step chunks and extremely straightforward. Heather is a leading
expert in the networking industry with more than a decade of experience.
Included in the package are the following excelleNT learning goodies:

28 HOURS of INSTRUCTION via 15 VIDEOS
from Microsoft Certified Trainers.

2,500 PAGES
Microsoft approved Study Guide materials 

4 CD-ROMs 
CD-ROM Interactive Courseware
Microsoft Road map to Certification
Microsoft Personal Exam Prep
MCSE Exam Sampler

FREE MCSE FORUMS
Free Access to Internet MCSE Job Placement and BBS 

FREE JOB PLACEMENT
Free Registration in MCSE Job Placement Services

You can have a look at the full content of all the video's over here:
http://www.ntsoftdist.com/mcse.htm The total price for this package
is only $1,295 which is a $700 savings over retail. You want to get
your hands on this ons. All of us at Sunbelt are going to get thru 
this one ourselves. I have already started, it's good stuff.
---------------------------------------

 * HOW TO SET UP NT FOR DATA SECURITY

One of the most valuable features of the NT File Systems is data
recoverability. However, not all of it is something that just
happens. NTFS Logging is an automatic feature which allows NTFS to
protect the file system data structures. Any I/O operation which 
affects the file system data or the directory structure on the volume 
is recorded in the Log File before the operation is done on the disk. 
Thus, if there is a system crash, any interrupted operations can be 
undone or redone as needed. The first time an NTFS volume is accessed 
after the system is booted, NTFS does a disk recovery. If there is 
little or nothing to do, the procedure is finished very quickly. 

This whole procedure is fully automatic, and is always done on all 
NTFS volumes. It provides safety for the file system and directory 
structure, but does nothing for the actual data. So how can you 
recover lost data?

There is a Windows NT driver called FtDisk (Fault Tolerant Disk 
Driver). It resides between Windows NT and the hard disk drivers.
Its major functions are:

 o Create stripe sets
 o Create volume sets
 o Create mirror sets
 o Create duplex sets
 o Recover lost data

Stripe Sets 

A stripe set consists of several different partitions, all of the same 
size, and each on a different physical disk. It appears as a single 
volume whose size is the sum of the partitions which are part of it. 
When a file is written to a stripe set, the data is written across all 
of the partitions simultaneously, so that writing and later reading of 
the file can be much faster than to a single physical disk. 

FtDisk can make a stripe set into a fault-tolerant volume by adding
parity. In this case, special sections of the stripe set, called
parity stripes, contain data to allow FtDisk to reconstruct any data
that gets lost from the stripe set. You could actually lose one
entire partition from such a stripe set, and still recover all of the
data that was on that partition. 

Volume Sets 

A volume set is a partition whose physical location is several
different disks. Let's say you have 5MB on disk c:, 20 on disk d:,
and 10 on disk e:. You can make a volume set, disk f:, out of these
pieces, and have a 35MB partition. Or, you can take six 500MB
physical disks and make a single 3GB partition of them. A volume set
is not fault-tolerant, though. 

Mirror Sets 

This is a fault-tolerant volume which consists of two partitions of 
the same size on different physical disks. They have the same name. 
When data is written to one of them, it is simultaneously written to 
the other. Thus, the two partitions always contain identical data. 
If you lose one of the disks, or if you lose some data on one of them, 
the data can be reconstructed because you have the other copy.

Duplex Sets 

This is simply a mirror set where the partitions are under different 
controllers. It does not protect data any better than a mirror set, 
but it is a little faster, and it allows you to keep working if one of 
the controllers fails. It is a fault-tolerant volume. 

Recovering Lost Data 

There is a technique called Sector Sparing, in which some sectors of a 
disk are set aside as spares. When a disk sector goes bad, FtDisk can 
automatically replace the bad sector with one of theses spares and, if 
the sector is on a fault-tolerant volume, FtDisk restores the data. 
In other words, it's a complete and transparent recovery. It should 
be noted that not all disks provide spare sectors, but even without 
spares, FtDisk can still recover the data.

On any fault-tolerant volume, when a sector goes bad, FtDisk will 
recover the data. If it's on a SCSI disk with spare sectors, the 
sector will be replaced and the recovered data written to the new 
sector, and that's the end of it. On any other disk, the data is sent 
to NTFS, which maps a new cluster to replace the bad sector, transfers 
the data to the new cluster, and assigns the bad sector to the 
badblock file. 

If the volume is not fault-tolerant, when a sector goes bad, FtDisk 
will report the error to NTFS, which maps a new cluster to replace the 
bad sector and assigns the bad sector to the badblock file. The data 
in the bad sector is not recovered.

Of course, FtDisk must be installed before any of this can be done. 

So, for full data recoverability, you need: 

 o FtDisk installed
 o Stripe sets with parity
 and/or
 o Mirror sets
 and/or
 o Duplex sets

Diskeeper will defragment any of these disk sets. Of course, it's
still a very good idea to maintain full current backups, and a copy of
the backups off-site. After all, NTFS will not protect your data from
a fire. At least, not yet. ;-) Thanks to Exec Software for the write-up.
--------------------------------


3. "NT RELATED NEWS"

 * GATES SAYS "NT 5.0 BETA THIS FALL" & 1 BILLION IN R&D

Bill Gates said on Tuesday at the Comdex in Atlanta that the 5.0 
version of Windows NT would enter beta testing this fall and go to 
final release in the first half on 1998.

"We will be in Beta this fall," said Gates, who noted that copies of the
next-generation operating system software have already been given out to
developers. "Then we'll go to final release of NT in the first half 
of next year."

Gates told an audience of about 3,500 that Windows NT ranked as 
Microsoft's most important product from a strategic standpoint.

Microsoft will invest $1 billion in Windows NT development-- about 
half of the company's R&D budget -- over the coming year,

Editor's Note: Looking a the large changes in V5, I would not be
surprised if this is going to slip into the second half of 1998
---------------------------------

 * WIZARD FOR SMS ANNOUNCED

Microsoft announced SMS Installer, an SMS wizard that automates installing
software applications for SMS. The wizard walks you through the process 
of writing a script that SMS uses to deploy and install the package and 
monitor the process. An interesting features is the one that lets SMS 
update only program files affected by new software patches. SMS Installer 
is free to existing SMS 1.2 customers. You can download SMS Installer from 
the Web at: http://www.microsoft.com/smsmgmt
---------------------------------

 * HELP TO SET UP NTWS ON MULTIPLE COMPUTERS

Microsoft has written a guide that is designed to give IS Professionals 
information, tips, and tricks to help automate the setup process when 
installing Windows NT Workstation or Windows NT Server on multiple 
computers. The guide includes detailed documentation and examples of 
the deployment tools, including SYSDIFF.EXE, shipped with Windows NT. 
You'll find this Deployment Guide at this URL. (recommended)
http://www.microsoft.com/ntworkstation/info/deployguide.htm
-----------------------------------

 * BOEING CHOOSES SMS FOR 100,000 MACHINES

Microsoft came out with the news that The Boeing Company has 
Systems Management Server version 1.2 to manage its Windows(R) 
operating system-based desktop environment. The scalability, 
stability and reliability of Systems Management Server 1.2 in 
enterprise environments were key factors in Boeing's selection.

Boeing selected Systems Management Server to provide desktop
management based on Systems Management Server's ability to scale
to meet the company's needs. Microsoft and Boeing teamed up
to test the software distribution, inventory and help-desk
capabilities of Systems Management Server in a large-enterprise,
multitiered environment of 100,000 users.

"Based on our scalability testing up to 100,000 clients,
we're confident that Systems Management Server is a firm foundation
that meets the needs of The Boeing Company," said Chris Kent,
director, computing and network operations at Boeing.
--------------------------------


*************************************************************************

4. "THIRD PARTY NEWS"

 * VINCA BEEFS UP NT CLUSTERING EFFORT

In the face of Microsoft Corp.'s impending Wolfpack product, Vinca Corp. 
is beefing up its own Windows NT clustering product, which has been 
renamed Co-Standby Server. Vinca officials said they added "co" to the 
product name because the product can now failover in either direction 
in case of a CPU crash.

"We've totally rewritten our mirroring code so it is an active, active
configuration. You no longer have a server just sitting there waiting for a
failure," said Art Deary, product marketing manager for Vinca.

System administrators must configure both servers so they have enough
disk and memory that they can actually take over in case the other server
fails. In addition to the bidirectional failover, Co-StandbyServer for NT
supports ActiveX controls, so VARs in remote locations can access the Vinca
screens through a browser that supports ActiveX.

The product uses any network interface as a connection, although Vinca
does offer its own high-speed interconnect. To further support Windows NT, 
the software moves the correct NT registry information over to the working 
server in case of failover. Vinca will release modules that move BackOffice 
and Lotus Notes Applications over so there is little interruption for users 
in case of failure.

Deary said there will be a migration path to Microsoft's technology if
customers so desire, but Vinca will continue to offer a product that goes
above and beyond the functionality in Wolfpack, which is expected to ship
later this year. The price for Co-StandbyServer for NT is $3,999, with 
availability slated for July.
----------------------------

 * OCTOPUS STANDARD WITH ALL INTERGRAPH HIGH AVAILABILITY SERVERS

Octopus Technologies, a division of Qualix Group, Inc. announced
today that Intergraph Computer Systems is now integrating the Octopus
Server with Super Automatic Switch Over (SASO) mirroring and failover
software with all of its mid-range and high-end InterServe servers.

The high availability servers, InterServe models 635, 645, 650 & 660,
will include the Octopus software at no extra charge through the balance of
1997, providing Intergraph's customers a "cluster-ready" solution for
Windows NT-based networks. The servers will be delivered with these
features bundled under its Mirroring & AutoSwitchOver (IMAS) product name,
and will be supported by Intergraph's customer support organization.

 "By combining our mirroring and high availability software with the
InterServe line of Windows NT-based servers, Intergraph can now provide its
customers with an immediate, complete and robust data and server protection
solution," said Dave Crocker, President of Octopus Technologies. "This
combination will supply mission-critical Windows NT environments with the
highest standards of data fault tolerance, server high availability and
scalability." 
---------------------------


 * USERS SAY: GHOST AN EXCELLENT SOLUTION 

We got some feedback about using Ghost for cloning machines:

"The SID stuff is not a problem as long as you don't hit the 
Domain before you copy it. Install NTW on a machine, standalone, 
install all your apps, then Ghost it. Then connected your clones up 
to the Domain."
 
"I have been looking at Ghostsoft and yes the SID is a problem, we get 
around it by not logging onto the Domain until we have manually fine 
tuned the machine e.g tcp/ip, computer name etc and then the first 
time the pc logs onto the domain, a unique SID is created."

"I have been using Ghost successfully for several months. Just as with 
a 95 machine you can't do an exact clone for machines being placed on 
the network. At a minimum you need a unique computer name. With NT 
the machine I use to ghost from, I give it a generic machine and DNS 
name, set the ip address to use DHCP, and put the computer in a 
workgroup rather than in the domain. When a machine has been ghosted 
it is given the correct computer name and a machine account is created 
in the domain for this machine."

So there you have it: happy users: Go to http://www.ghostsoft.com
There is a freebie fully functional download on their web site
along with an excellent writeup (including a quote where PC Week suggests 
it for deployment of NT). The purchased version has the feature that 
multiple copies can be made at the same time (i.e. to make 10 clones each 
needing 1/2 hour would take over 5 hours with the freebie, or a little 
over 1/2 hour with the purchased version).
--------------------------------


***********************************************************************
5. "HINTS AND TIPS - COUPLA GOOD ONES!"


A SQL Server heads up for potential users that could be impacted. 
Microsoft released and then pulled Service Pack 3 for MS SQL Server within a 
few days of the release of Windows NT 4.0 Service Pack 3. Microsoft pulled it 
because it introduced errors when queries were run against text fields in 
databases and the results inserted into other text fields in the databases. 
There were also some serious replication problems. There is a very high level 
of effort to resolve and re-release Service Pack 3 as soon as possible.
--------------------------------

SOCKETWATCH BY LOCUTUS CODEWARE
SocketWatch is a PC clock synchronizer. It is not only one of the most
accurate clock synchronizers, but by using Locutus Codeware's internet
connection sensing technology, it is also one of the easiest to
use. Once you set it up in transparent mode, you won't even know that
you are running it; just that your PC clock will be keeping accurate
time from now on.
http://www.microsoft.com/ntworkstation/shareware/default.htm
--------------------------------

You may recall that I wrote what could loosely be described
as a "FAQ" on the issues surrounding attacks on NT password
hashes, once they have been extracted from the SAM database.
It is now twice the original size and has been updated to
include the secfix, SP3 and several associated network based
exploits. (Alan Ramsbottom, UK)

Russ Cooper kindly continues to provide a home for a copy
of the document at:

 http://ntbugtraq.rc.on.ca/samfaq.htm
---------------------------------

Sean Bowen sent the following:

I enjoy your receiving newsletters. The most recent however, 
perpetuates a common NT-on-RISC myth that I encountered frequently 
when I was on the NT support team here at Digital. The following 
statement is true, but is misleading:

o If you have a RISC-based system, the system partition must be FAT.

On a Digital Alpha system, the "system" partition is NOT the partition 
containing the operating system (i.e. NTOSKRNL). The "system" 
partition is a small FAT partition containing the programs invoked by 
the system firmware at boot time. One of the programs found in the 
"SYSTEMPARTITION" on a Digital Alpha is OSLOADER.EXE. The 
"OSLOADPARTITION" is the partition that is loaded by the OSLOADER.EXE 
 (OSLOADER.EXE lives in the "SYSTEMPARTITION"). The OSLOADPARTITION 
is where NTOSKRNL.EXE lives. This can and should be a NTFS 
partition.

So in the letter of the law:

On a RISC-based system, the system partition must be FAT

In the spirit of the law:

On a RISC-based system, the system partition is not where the OS 
lives! The OS lives in the OSLOADPARTITION and that partition can 
and should be NTFS.

In practice, many of our customers feel that security and data 
recoverability are important, so NTFS is the common choice for the 
OSLOADPARTITION. Note, there is a choice. If you want, you can 
still have the OSLOADPARTITION set up as a FAT partition.
-------------------------------


**************************************************************
6. "HOW TO USE THE MAILING LIST"
 Instructions on how to subscribe, sign off
 and change addresses

TO SUBSCRIBE TO THE LIST

send the command 'subscribe nt-list firstname lastname'
as the first line of your message to listproc@intnet.net
_____________________________________________________

TO QUIT THE LIST

send the command 'signoff nt-list' or 'unsubscribe nt-list'
as the first line of your message to listproc@intnet.net
_____________________________________________________

TO CHANGE YOUR ADDRESS

First unsubscribe and then resubscribe as per the
procedure above.

*************************************************

FOR MORE INFORMATION

On the World Wide Web point your browser to:

For the newsletter:
http://www.ntnews.com
For our website:
USA: http://www.ntsoftdist.com

Email for US sales information to:
ntsales@ntsoftdist.com
Email for US Tech support to:
daved@ntsoftdist.com
Email to the US Editor:
stu@ntnews.com

Email for European Sales to:
Europe@sunbelt.fr
Email for European Tech support to:
robdixon@sunbelt.demon.co.uk

**************************************************

Legal Stuff:
This document is provided for informational purposes only. 
The information contained in this document represents the
current view of Sunbelt Software Distribution on the issues
discussed as of the date of publication. Because Sunbelt
must respond to changes in market conditions, it should not
be interpreted to be a commitment on the part of Sunbelt
and Sunbelt cannot guarantee the accuracy of any
information presented after the date of publication.

INFORMATION PROVIDED IN THIS DOCUMENT IS PROVIDED "AS IS"
WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
FREEDOM FROM INFRINGEMENT.

The user assumes the entire risk as to the accuracy and the
use of this document. This document may be copied and
distributed subject to the following conditions: 1) All text
must be copied without modification and all pages must be
included; 2) All copies must contain Sunbelt's copyright
notice and any other notices provided therein; and 3) This
document may not be distributed for profit. All trademarks
acknowledged. Copyright Sunbelt Software Distribution,Inc 1997.

Well Gunnar, I guess not. I was thinking of something like a flavor of
UNIX, but if you issue ANY PING command such as -l 65000 it WILL blow your
95 sky high! Or did you use another program to do it ?!? Certainly sure,
since you will not be able to do anything like:

PING xxxx.yyyy.zzzz.wwww -l 65510 -s 1 -t

Your W95 will blue screen out.

Best Regards,

R_o_m_u_l_o Moacyr C_h_o_l_e_w_a - MCSE, MCIS, MCNS, MCPS, CNA
mailto:rcholewa@elogica.com.br - mailto:romuloc@msconecta.com.br
http://www.elogica.com.br/users/rcholewa
----
From: Gunnar Bredow 
To: Romulo Moacyr Cholewa 
Date: Domingo, 8 de Junho de 1997 22:07
Subject: Re: [NTSEC] NT and POD

Simple - I did it from a Windows 95 machine :)

regard

Gunther

----------
> From: Romulo Moacyr Cholewa 
> To: Gunnar Bredow 
> Subject: Re: [NTSEC] NT and POD
> Date: Saturday, 7 June 1997 6:50
>
> How did you "pinged" it with a 65510 packet ?!? With NT ?!? It allows
you
> only 65000.
>
> R_o_m_u_l_o Moacyr C_h_o_l_e_w_a - MCSE, MCIS, MCNS, MCPS, CNA
> mailto:rcholewa@elogica.com.br - mailto:romuloc@msconecta.com.br
> http://www.elogica.com.br/users/rcholewa
> ----
> From: Gunnar Bredow 
> To: ntsecurity@iss.net
> Date: Sexta-feira, 6 de Junho de 1997 17:44
> Subject: [NTSEC] NT and POD
>
> What ever happened to the Ping of Death scare ?
> I set up a test NT 4 server with SP3 and pinged it with a packet of size
> 65510 - whammo - the whole server reboots with quite ungracefully with
> services failing until it was completely powerd off and restarted. Was
> this
> not meant to be fixed ? What is the issue when this is done across the
> internet ? I would assume that routers would fragment it so it would not
> be
> a concern but this still concerns me.
>
> any ideas ?
>
> Gunther
>
>



At 20:12 6/7/97 -0700, you wrote:
>I recall someone posting a bug a few weeks ago that could blue screen NT even 
>with SP3 & the OOB patch. Can someone repost it?

There was one a while back that would nuke SP2 - we helped track that one
down, and it is fixed in SP3.

It involved a mismatched smbmount and Linux kernel.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Try a bridge or give a call to cisco they are always happy to sell you
something


Jan Braeuer wrote:
> 
> hallo,
> 
> i am looking for a product (firewall) that can handle a ip address
> translation, where the schema for translation depends on the target ip
> address for the traffic
> for example internal net 192.168.10.0 and traffic for network 172.16.x.x
> should be translated to 172.17.x.x and traffic for 192.168.100.0 should be
> translated to 192.168.101.x .
> 
> has anyone a idea ?
> 
> thanks
> jan
Is this list not mainly for "Security" opposed to "how do I setup this and
that in NT"?

Joel Lafleur
Technical Support
Golden Triangle On Line
1-519-576-1713
At 02:56 PM 6/7/97 +0200, Kris Carlier wrote:
>Is it true that, in order to use pptp, you need "servers" at both sides,
>i.e. your IAP will need to support PPTP too.
>

No. MS has a SW driver for NT and a beta for '95

>Is it true that PPTP runs on top of TCP ? 

Port 1723, right?

>
>Is there a definitive answer about the portnumber pptp runs on ?
>
>kr=
> \\\___///
> \\ - - //
> ( @ @ )
> +---------------oOOo-(_)-oOOo-------------+
> | kris carlier - carlier@iguana.be |
> | Hiroshima 45, Tsjernobyl 86, Windows 95 |
> | Linux, the choice of a GNU gener8ion |
> | SMS: +32-75-61.43.05 |
> +------------------------Oooo-------------+
> oooO ( )
> ( ) ) /
> \ ( (_/
> \_)
>
>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
The numbers you have quoted are definately correct. Protocol ID 47 is also referred to as GRE.

I have implemented this in a number of sites.

Regards

Ben Thomas
BA(Th), MCT, MCSE, MCSD

mailto://bthomas@pro.co.nz
http://www.pro.co.nz

Ph: Intl+64 (4) 577 3771
Fx: Intl+64 (4) 577 3772
Mobile: 025-59 59 59


-----Original Message-----
From: Alan C. Ramsbottom [SMTP:acr@als.co.uk]
Sent: Sunday, June 08, 1997 10:20 AM
To: ntsecurity@iss.net
Cc: root@iguana.be
Subject: Re: [NTSEC] Secure Telnet!

On 7 Jun 97 at 14:56, Kris Carlier wrote:

> Is there a definitive answer about the portnumber pptp runs on ?

Just read about this in the NT Router (final release of MPR) docs:

 "PPTP uses TCP Port 1723 for the control channel and IP Protocol 
 ID 47 for the data channel"

Regards,

--Alan--
acr@als.co.uk

PPTP uses 40/128 bit encription, depending on US/Canada or rest of the 
world. Third party plug ins are available for non-North American 
continents.

Regards

Ben Thomas
BA(Th), MCT, MCSE, MCSD

mailto://bthomas@pro.co.nz
http://www.pro.co.nz

Ph: Intl+64 (4) 577 3771
Fx: Intl+64 (4) 577 3772
Mobile: 025-59 59 59


-----Original Message-----
From: Ryan Anderson [SMTP:ryan@michonline.com]
Sent: Sunday, June 08, 1997 9:42 AM
To: Kris Carlier
Cc: vojin; NT Security List
Subject: Re: [NTSEC] Secure Telnet!

On Sat, 7 Jun 1997, Kris Carlier wrote:

> > If we were to use PPTP would'nt all communications, regardless of the 
port
> > in use, be secure.
> > Assuming that this is correct, ssh equivalents would then probably be
> > redundant.
[...]
> b) pptp is secure enough

PPTP uses encryption?

-----------------------------------------------------------------------
Ryan Anderson - "Who knows, even the horse might sing"
Wayne State University - CULMA "May you live in interesting times.."
ryan@michonline.com Ohio = VYI of the USA
PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9
-----------------------------------------------------------------------

I recall someone posting a bug a few weeks ago that could blue screen NT even 
with SP3 & the OOB patch. Can someone repost it?

-mike
Hi Eric,

On Sat, 7 Jun 1997, Eric Germann wrote:

> >Is it true that, in order to use pptp, you need "servers" at both sides,
> >i.e. your IAP will need to support PPTP too.
> 
> No. MS has a SW driver for NT and a beta for '95

In that case, I have a (too) old version of the MS 687C course
(Supporting MS NT4.0 Core technologies). On page 339 (Module 12: Remote
Access Service), I read the following:

"Calling an ISP
When using an ISP with PPTP, the only difference is that the client must
first call an ISP to gain access to the Internet. PPTP must also be
supported at the ISP's POP. Therefore, the client first calls the ISP, and
after establishing a connection to the ISP, calls the WNT RAS server
through that connection to extablish the PPTP tunnel."
 
To be precise, when I write IAP: Internet ACCESS Provider, I guess I mean
the same as MS who speaks about the more general term I Service P.

Is this a new feature in the PPTP stuff that I didn't see ? if so, where
can I get the update ?

> >Is it true that PPTP runs on top of TCP ? 
> 
> Port 1723, right?

> >Is there a definitive answer about the portnumber pptp runs on ?

I am wondering why you need PPTP when you can do IP-IP (e.g. using
linux), without the need for the IAP to do something special for you. If
you want it to be encrypted, pipe it through a SSH-connection ? What's
wrong with that scenario ?

kr=

 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)



Hi Everybody,

Does anybody know about a way to allow our RAS users only one 
simultaneous login?

/BRGDS

Anders

hurtigh@ancestor.se

http://www.ancestor.se/
http://www.funbase.se/essentials/livsviktigt/text_index.html

Voice: +46 (0)70 5153230
Fax: +46 (0)70 6101937
On Sun, 8 Jun 1997, Kris Carlier wrote:

> In that case, I have a (too) old version of the MS 687C course
> (Supporting MS NT4.0 Core technologies). On page 339 (Module 12: Remote
> Access Service), I read the following:
> 
> "Calling an ISP
> When using an ISP with PPTP, the only difference is that the client must
> first call an ISP to gain access to the Internet. PPTP must also be
> supported at the ISP's POP. Therefore, the client first calls the ISP, and
> after establishing a connection to the ISP, calls the WNT RAS server
> through that connection to extablish the PPTP tunnel."
> 
> To be precise, when I write IAP: Internet ACCESS Provider, I guess I mean
> the same as MS who speaks about the more general term I Service P.
> 
> Is this a new feature in the PPTP stuff that I didn't see ? if so, where
> can I get the update ?

Your documentation is very old. PPTP started life as a protocol to be
implemented at the terminal server level. A bunch of terminal server
companies like ascend and 3com implemented it. Microsoft has since
extented it to do end-to-end tunneling. Check the Microsoft web site for
an update.

> I am wondering why you need PPTP when you can do IP-IP (e.g. using
> linux), without the need for the IAP to do something special for you. If
> you want it to be encrypted, pipe it through a SSH-connection ? What's
> wrong with that scenario ?

Because PPTP not only allows you to encapsulate IP, it also encapsulates
IPX and NetBUI. PPTP is really just PPP over GRE with a control TCP
connection. BTW, PPTP doesnt really do encryption. PPP does the
encription. Encryption and authentication are negociated by PPP over GRE
not the PPTP control connection.

> kr=
> 
> \\\___///
> \\ - - //
> ( @ @ )
> +---------------oOOo-(_)-oOOo-------------+
> | kris carlier - carlier@iguana.be |
> | Hiroshima 45, Tsjernobyl 86, Windows 95 |
> | Linux, the choice of a GNU gener8ion |
> | SMS: +32-75-61.43.05 |
> +------------------------Oooo-------------+
> oooO ( )
> ( ) ) /
> \ ( (_/
> \_)
> 
> 
> 

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

-----BEGIN PGP SIGNED MESSAGE-----

Does anyone know if there are organisations that certify someone on
computer security? I'm not looking for products like the ISS stuff or
Cisco's PIX and the like, but rather for a general security
certification, something that can qualify one as a computer security
specialist.

Please let me know if you know about such a thing, preferably with
URL.


Thanks,
Frank




-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM5r2bcZP3ocmY5AlAQHLhgP/UFhNJnyrxAyEEZ7pgqeMBLs1qwhbxegf
aR56WbTwexWewGiQ2uFVXy9kL4VGJaFUNm5ubaQvvDndFDumoDy/5HaxLALkyRUY
UdCAB1Xb9BZHY8gbEfQgWpknjELWNIkemmTdeZsfCgo02FIArcCVaPRTsNhYj/1C
uAlzXnE0a1A=
=q06q
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
> Does anybody know about a way to allow our RAS users only one
simultaneous login?

I don't, but please let me know if you find a solution.

Don't hold your breath, I've been looking for something to do this for the
last 6 months...

Regards

Bob
*****************************************
 Bob Love, Technical Director
 Heartbeat Online Tanzania Ltd
 http://www.raha.com/user/bob
*****************************************

Does anyone know if there are organisations that certify someone on
computer security? 

Thanks,
Frank

You may want to look at :http://www.isc2.org - they offer certification exams leading to the CISSP qualification - the exams are based on a CBK (Common Body Of Knowledge) covering ten different areas relating to security.

If anyone else knows of anything similar - please let me know.

Best Regards - Ivor

CISSP provides a form of security certification. I am planning to take the training either later this year or early next year!

Here's their web site:

http://www.isc2.org/isc2.htm#isc2

----------
From: Frank Knobbe[SMTP:FKnobbe@BellSouth.net]
Sent: Sunday, June 08, 1997 12:14 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Security Certifications?

-----BEGIN PGP SIGNED MESSAGE-----

Does anyone know if there are organisations that certify someone on
computer security? I'm not looking for products like the ISS stuff or
Cisco's PIX and the like, but rather for a general security
certification, something that can qualify one as a computer security
specialist.

Please let me know if you know about such a thing, preferably with
URL.


Thanks,
Frank




-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM5r2bcZP3ocmY5AlAQHLhgP/UFhNJnyrxAyEEZ7pgqeMBLs1qwhbxegf
aR56WbTwexWewGiQ2uFVXy9kL4VGJaFUNm5ubaQvvDndFDumoDy/5HaxLALkyRUY
UdCAB1Xb9BZHY8gbEfQgWpknjELWNIkemmTdeZsfCgo02FIArcCVaPRTsNhYj/1C
uAlzXnE0a1A=
=q06q
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----


On my recent alarm of POD and NT 4 + SP3, I appologise if any undue alarm
was caused. The situation which I believe which is most probable is that I
installed a new service without reapplying the SP and also the recommended
installation of the postfix OOB did the trick. I can no longer reproduce
the effect.

thanks for your responses

Gunther
Several have been asking about a secure telnet/ftp client/server for NT.
It's not out yet, but looks like we're making progress outside of the
ssh/ssltelnet family.

Posted on Bos:

From: Jordan K. Hubbard, jkh@time.cdrom.com
To: best-of-security@suburbia.net


Subject: Sun Crypto Skirts Feds

Forwarded-by: Keith Bostic 
Forwarded-by: Jeff Reed 

Sun Crypto Skirts Feds
 By John Fontana, Communications Week

 Menlo Park, Calif. -- Sun Microsystems is prepared to take on the 
federal
government this week when it discloses plans to offer a product from 
Russia
that provides 128-bit and triple DES encryption over the Internet.

 The software, which Sun will offer worldwide, could help ignite 
electronic
commerce over the Internet. It could also lead to an all-out brawl between
Sun and the Feds.

 It is now illegal for a U.S. company to export encryption software that
exceeds 56-bit encoding. But it is legal to import such technology from
abroad, presuming the domestic vendor had no role in its development.

 "The government will try to link Sun to the development of this product
and go after them, or this will open the floodgates on strong encryption,"
said John O'Leary, the director of education at the Computer Security
Institute in San Francisco.

 "The government will find that we are in full compliance with the letter
of the law," maintained Humphrey Polanen, general manager of Sun's 
security
and electronic-commerce group. "We took great pains to stay within the
legal requirements." Polanen said a key factor was that Sun offered no
technical assistance in the development of the software, although it is
based on a protocol the company published publicly nearly two years ago.

 The product Sun will OEM is Secure Virtual Private Network for Windows.
Developed by Moscow-based ElvisPlus Co., the product will be sold through
Sun channels under the name PC SunScreen SKIP E+. The software is based on
Sun's Simple Key Management for IP (SKIP) encryption and key management
technology. It will ship with algorithms for 56- and 64-bit DES, two- and
three-key triple DES and 128-bit ciphers for both traffic and key
encryption.

 SKIP, a published specification, had been submitted to the Internet
Engineering Task Force for standardization, but the draft proposals have
expired, a source said.

 The software manages keys for exchanging encrypted data and can sit on 
any
machine, including desktops, servers and routers. Because it operates at
the network level, it can work with any IP transmission and does not
require any modification to existing applications.

 Sun's plan to import the Russian technology neatly sidesteps current U.S.
restrictions. To export encryption software using a key code in excess of
40 bits, a U.S. business must first get government approval.

 Furthermore, the would-be exporter must have a plan in place to supply a
key recovery model within a two-year time frame before receiving approval.
SKIP E+ does not include a model for key recovery, and Sun did not seek
government approval for the product, but the computer maker expects to
provide the software to the global offices of its U.S.-based customers and
others through third-party distributors.

 Sun's newly formed Security Group--and before that its Internet Commerce
Group--has worked for two years with the company's legal and
export-compliant government regulatory departments laying the groundwork
that led to the OEM deal, and this will be the first time a major U.S.
computer company has offered U.S.-based corporations 128-bit and triple 
DES
encryption for global use. Given President Clinton's lack of support for
current efforts to lift encryption export restrictions, Sun is 
anticipating
a major backlash from the Clinton administration. A White House
spokesperson declined comment.

 But a source familiar with the administration's handling of encryption
policy was doubtful that the White House would wage a full-scale attack on
Sun.

 "What Sun had to go through to release a product like this points up the
folly of the current policy," commented Rep. Bob Goodlatte (R-Va.), who
authored a bill that would prohibit mandatory key recovery.

 Last week, Goodlatte's bill, the Security and Freedom through Encryption
(SAFE) Act, was approved by the House Judiciary Committee, marking the
first time any encryption legislation had made it out of committee. It
could take another eight to 12 months, however, before it moves through 
the
full House and Senate and on to the president.

 The computer industry and retail and banking groups are vehemently 
opposed
to the export restrictions and have been trying to find ways around them.

 Hewlett-Packard, IBM, Trusted Information Systems and others have formed 
a
Key Recovery Alliance as a way to work within the current law pending
relaxation of the restrictions. And RSA Data Security Inc. has bought a
Japanese software vendor, now called Nihon-RSA.

 But Sun believes it will be some time before other software companies can
match its efforts.

 Several products incorporate the SKIP protocol, including Sun's own line
of SunScreen security products, Firewall-1 from Check Point Software
Technologies Ltd. and SmartGate from VOne Corp. Sun says it is also
negotiating with two leading router vendors.

 SKIP E+ provides encryption and authentication of any IP-based
communication, including Telnet, HTTP, SQL requests and SMTP, while it
manages encryption keys, negotiates data transfers and controls access to
data through a three-tiered approval process.

 Sun says work still remains to create a management model for the access
lists network administrators would need to create for a global system.

 "You'll see some announcements in a month or two that take care of the
overall management headache for this," said Chris Tolles, product manager
for the network security products group. "We're moving forward with
solutions that get to the large-scale access control list distribution
problem. It's a key issue for wide-scale deployment."

 SKIP E+ will be available Aug. 15 and will run on Windows 3.11, Windows 
95
and Windows NT. It is compatible with most commercial TCP/IP stacks for
Windows 3.x, Windows 95, NT 3.5 and NT 4.0. ElvisPlus plans to make
evaluation copies available on its Web site. 

 Related articles from:
 
 Search TechWire & CMP Archives 

Copyright (c) CMP Media, 1996.




"All they know about public policy is what we tell them."
 - David Brinkley, speaking of the American people to a 
 meeting of the American TV/Radio Broadcasters Association

Bob Tinsley wrote:
> Unfortunately, the code-base is huge (ssh is all-singing, all-dancing) and
> there have been occasional complaints in comp.security.unix that it has never
> been properly audited. 

ssh has been audited this spring at a Network Security Seminar at 
Helsinki University of Technology. I think there is going to be
published 
a paper by the auditors.

> Don't get me wrong; ssh is an excellent piece of software, but I _would_
> object to claiming it offers `military grade security' until it achieves
> at _least_ an E4 rating.

I do agree that this is the case for the freeware/shareware version.
However I do believe that they (http://www.ssh.fi) are at the
moment fixing the security holes found from ssh for the commercial
version.

--
Pauli Wihuri, pauli@wihuri.pp.fi, +358 50 62344
Good idea to compile a list.

Can I have a copy when completed.

Thanks

John Taylor
john@carrhouse.force9.net


----------
> From: Elias Karakoulakis 
> To: NT Security list 
> Subject: [NTSEC] Common Registry Keys
> Date: 07 June 1997 08:48
> 
> Hello All,
> 
> I am compiling a list of common registry keys that are useful to be
> manipulated via login scripts or the System Policies. For example,
> trying to lock down %systemroot% hard, requires me to change the
> Internet Explorer's cache, cookies and history folders (to be
> pointing e.g. to c:\temp). For that, I've made an addition to the
> (shell) policy in winnt.adm (poledit template)
> Could you be so kind to help me with all the keys you've found
> noteworthy, I would be grateful.
> 
> p.s. Mail me too if you want any login scripts, PolEdit templates and
> administration scripts that I've made.
> 
> Elias Karakoulakis
> Undergraduate student at the National Technical University of Athens
> ekarak@softlab.ece.ntua.gr
> 
You may wan't to look at the Information Security Degree at Royal Holloway,
University of London. You will need a good first degree in Maths/Computer
Science from a good University. Apploications far exceed places so the earliest
entry would be Sept 98 I understand. Course details include

Computer Security 
Network Security 
Cryptography
Advanced Cryptography
Security Management
Database Security
Computer Crime
Standards and Evaluation Criteria

Lectures are mainly from Industrial experts like the Computer Crime from the
former head of the Crime Unit at Interpol, Cryptography by Prof. Fred Piper. 


www.rhbnc.ac.uk 
isg.rhbnc.ac.uk

Regards,


Mark Curphey 

---------- Forwarded message ----------
Date: Sun, 8 Jun 1997 13:14:21 -0600
From: Frank Knobbe 
To: ntsecurity@iss.net
Subject: [NTSEC] Security Certifications?

-----BEGIN PGP SIGNED MESSAGE-----

Does anyone know if there are organisations that certify someone on
computer security? I'm not looking for products like the ISS stuff or
Cisco's PIX and the like, but rather for a general security
certification, something that can qualify one as a computer security
specialist.

Please let me know if you know about such a thing, preferably with
URL.


Thanks,
Frank




-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM5r2bcZP3ocmY5AlAQHLhgP/UFhNJnyrxAyEEZ7pgqeMBLs1qwhbxegf
aR56WbTwexWewGiQ2uFVXy9kL4VGJaFUNm5ubaQvvDndFDumoDy/5HaxLALkyRUY
UdCAB1Xb9BZHY8gbEfQgWpknjELWNIkemmTdeZsfCgo02FIArcCVaPRTsNhYj/1C
uAlzXnE0a1A=
=q06q
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----


You can do this. The service called Scheduler is the NT equivalent of
Cron. Use Server Manager (or net commands) to make sure that the server
service is running automatically on all machines. Then you may schedule
batch jobs to occur whenever you like with the AT command. Here's the
command-line syntax taken from AT /?.

AT [\\computername] [ [id] [/DELETE] | /DELETE [/YES]]
AT [\\computername] time [/INTERACTIVE]
 [ /EVERY:date[,...] | /NEXT:date[,...]] "command"

\\computername Specifies a remote computer. Commands are scheduled on the
 local computer if this parameter is omitted.
id Is an identification number assigned to a scheduled
 command.
/delete Cancels a scheduled command. If id is omitted, all the
 scheduled commands on the computer are canceled.
/yes Used with cancel all jobs command when no further
 confirmation is desired.
time Specifies the time when command is to run.
/interactive Allows the job to interact with the desktop of the user
 who is logged on at the time the job runs.
/every:date[,...] Runs the command on each specified day(s) of the week or
 month. If date is omitted, the current day of the month
 is assumed.
/next:date[,...] Runs the specified command on the next occurrence of the
 day (for example, next Thursday). If date is omitted, the
 current day of the month is assumed.
"command" Is the Windows NT command, or batch program to be run.

Note that you may schedule jobs *for* other machines as long as you have
privilege on that machine.

There are also 3rd party tools such as QMaster, or SQL Server that do a
more robust job of scheduling, but the AT command is free.

 --Paul




At 08:39 PM 6/6/97 -0400, you wrote:
>Just a thought, it is a pain to have to go around
>to workstations and routinely update the ERDs. It
>would be nice if an event scheduler (equivalent of 
>crontab in Unix) would be implemented so that a 
>reminder or prompt for a ERD update were displayed 
>on each workstation and server.
>
>-Jeff
>
>
> http://www.sitta.uwstout.edu/gerberje/
>
+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*
Paul Christian Nelis | "There is nothing so inefficient as 
Citadel Investment Group. | efficiently doing that which should
nelis@wfg.com | never have been done at all."

Y'know, you'd think it would be in there. I mean, it's not like a
totally unreasonable policy to set (hint hint any Microsoft PM's out
there....)

OTOH, one crude way to do this might be to implement call back. I know,
I know. In this day and age of laptops and mobile it's terribly
un-palatable for many.

Mike


> ----------
> From: Bob Love[SMTP:bob@raha.com]
> Sent: Sunday, June 08, 1997 11:37 AM
> To: Anders Hurtigh; ntsecurity@iss.net
> Subject: Re: [NTSEC] Disallow multiple RAS-logons
> 
> > Does anybody know about a way to allow our RAS users only one
> simultaneous login?
> 
> I don't, but please let me know if you find a solution.
> 
> Don't hold your breath, I've been looking for something to do this for
> the
> last 6 months...
> 
> Regards
> 
> Bob
> *****************************************
> Bob Love, Technical Director
> Heartbeat Online Tanzania Ltd
> http://www.raha.com/user/bob
> *****************************************
> 
Can anyone recomend a specific NT registry text book ? Something more technical
than "Windows NT registry Troubleshooting" by Rob Tidrow that I can really get
down to the security concerns with. 

Regards,


Mark Curphey


On Fri, 6 Jun 1997, Kelly E. Gibbs wrote:

> 
> Also you can change registery entries from the command line, so if you
> require say two very different configurations, a batch file can alter the
> params and reboot. Is there any interest in this batch file, please let me
> know and I'll post what I have or is everyone aware of how to do this?

Love to have that too. :)

And some way to restore a whole tape to the drives by booting off a floppy
and CD (drivers and all that have to be on there, etc.) Otherwise, your
drive crashes, you have to sit there and reinstall NT from scratch and
then restore it from tape... :( I'd rather just stick a tape in, boot off
the CD and tell it "restore it all while I go out for a few hours..."

I wish we could get rid of the annoying 3 floppy boot. I'm sure a single
floppy that has drivers for various CDROMS and code to just boot off the
CDROM would be more convenient too... After all there are some machines
that can boot right off the floppy, so all we need is a small tiny program
to boot off a CDROM... :( Most of the newer BIOSes have that feature
anyway...

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "Boy meets beer. Boy drinks Beer, |./|\.
..\|/..|sunder@sundernet.com| Boy gets another beer!" |/\|/\
<--*-->| ------------------ | |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================





hallo,

i am looking for a product (firewall) that can handle a ip address
translation, where the schema for translation depends on the target ip
address for the traffic
for example internal net 192.168.10.0 and traffic for network 172.16.x.x
should be translated to 172.17.x.x and traffic for 192.168.100.0 should be
translated to 192.168.101.x .

has anyone a idea ?

thanks
jan


NT 4.0 will boot off the CD by default if you want. That way you don't
need the boot floppies.

Jason Nash

> -----Original Message-----
> From: Ray Arachelian [SMTP:sunder@brainlink.com]
> Sent: Monday, June 09, 1997 12:36 PM
> To: Kelly E. Gibbs
> Cc: John Wiltshire; Les Landau; ntsecurity@iss.net
> Subject: Re: [NTSEC] SAM files, ERD, command line tools, and
> sundry.
> 
> On Fri, 6 Jun 1997, Kelly E. Gibbs wrote:
> 
> > 
> > Also you can change registery entries from the command line, so if
> you
> > require say two very different configurations, a batch file can
> alter the
> > params and reboot. Is there any interest in this batch file, please
> let me
> > know and I'll post what I have or is everyone aware of how to do
> this?
> 
> Love to have that too. :)
> 
> And some way to restore a whole tape to the drives by booting off a
> floppy
> and CD (drivers and all that have to be on there, etc.) Otherwise,
> your
> drive crashes, you have to sit there and reinstall NT from scratch and
> then restore it from tape... :( I'd rather just stick a tape in, boot
> off
> the CD and tell it "restore it all while I go out for a few hours..."
> 
> I wish we could get rid of the annoying 3 floppy boot. I'm sure a
> single
> floppy that has drivers for various CDROMS and code to just boot off
> the
> CDROM would be more convenient too... After all there are some
> machines
> that can boot right off the floppy, so all we need is a small tiny
> program
> to boot off a CDROM... :( Most of the newer BIOSes have that feature
> anyway...
> 
> =====================================Kaos=Keraunos=Kybernetos=========
> =====
> .+.^.+.| Ray Arachelian | "Boy meets beer. Boy drinks Beer,
> |./|\.
> ..\|/..|sunder@sundernet.com| Boy gets another beer!"
> |/\|/\
> <--*-->| ------------------ |
> |\/|\/
> ../|\..| "A toast to Odin, | For with those which eternal lie, with
> |.\|/.
> .+.v.+.|God of screwdrivers"| strange aeons, even death may die.
> |.....
> ======================== http://www.sundernet.com
> =========================
I'm just sending this message to test the waters. I occasionally have to
recruit people to come in and take a look at some new IBM security software, or
the web pages that are associated with it. IBM does pay people for their time
and it gives users a chance for a sneak preview at some of our newest
technology. The reason I chose this group is because we are working on our
Firewall as well as SecureWay, Internet Connection Server and eNetwork
products. If it would not annoy or offend anyone to have this posted here,
please let me know.

Thanks in advance.

Julie Swindell
Web Externals Design & Development
(919) 254-6061
jaswinde@us.ibm.com
On Mon, 9 Jun 1997, Jan Braeuer wrote:
> hallo,
> 
> i am looking for a product (firewall) that can handle a ip address
> translation, where the schema for translation depends on the target ip
> address for the traffic
> for example internal net 192.168.10.0 and traffic for network 172.16.x.x
> should be translated to 172.17.x.x and traffic for 192.168.100.0 should be
> translated to 192.168.101.x .

If you have a spare machine, Linux with masquerading is a free/easy solution.
Spend 39.95 for the CD though. FTPing a couple hundred meg is no fun. 

www.redhat.com

 -al
____________________________________________________________
Alexander N. Spitzer *** cyways, inc. *** Internet Solutions
------------------------------------------------------------
MailTo:aspitzer@cyways.com Web :http://www.cyways.com
Phone :(800) 5-cyways Fax :(617) 926-8440
Pager :aspitzer-pager@cyways.com (first 80 chars of message)
------------------------------------------------------------
 My address MAY NOT be used for UNSOLICITED email.
------------------------------------------------------------

I'd like to know why th ftp service dont run when tha 139 port is closed.??



Alexandre Queiroz
Webmaster - NET2000
NATAL/RN - BRAZIL
webmaster@net2000.com.br


Windows 95 and NT 4.0 Registry & Customization Handbook

It's a Que book, by Jerry Honeycutt. Pretty good. Talks about using inf
and reg files to do batch updates and modification to the registry. It
also talks about regedt32 vs regedit, Policy Editor, etc.

 --Paul

At 04:10 PM 6/9/97 +0100, Mark Curphey wrote:
>Can anyone recomend a specific NT registry text book ? Something more
technical
>than "Windows NT registry Troubleshooting" by Rob Tidrow that I can really
get
>down to the security concerns with. 
>
>Regards,
>
>
>Mark Curphey
>
>
+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*
Paul Christian Nelis | "There is nothing so inefficient as 
Citadel Investment Group. | efficiently doing that which should
nelis@wfg.com | never have been done at all."

Gunther,
We also could not reproduce the problem after applying the Post-SP3 OOB
fix. Bug closed.
Thanks,
Paul

> -----Original Message-----
> From: Gunnar Bredow [SMTP:gbredow@comtech.com.au]
> Sent: Sunday, June 08, 1997 5:56 PM
> To: Paul Bronowski (Volt Comp)
> Subject: Re: 86687: Ping with packet size of 65510 takes down NT
> 4.0 +SP3 (notyet verified).
> 
> Hi, Thanks for the prompt response. Appologies if this may have caused
> an
> alarm but this is is the configuration of the NT machine;
> 
> i486, 32M RAM
> Intel Etherexpress Pro/100 v1.04 network card.
> Build 1381
> Service Pack 3
> IIS 3
> TCPIP and IPX/SPX
> Client Services for Netware
> 
> I was on the same segment and from a Win95 machine (Compaq 133
> notebook
> with SMC EtherEZ 10M card) did a 
> "ping -l 65510 xxx.xxx.xxx.xxx"
> 
> anyway - the response was a prompt reboot (ie black screen and the
> whole
> reboot phase. At this the mouse service failed to start. A cold boot
> fixed
> this. (NB I did not do anything to the mouse such as wriggle it etc.)
> I wouldn't believe it so I did it again. Same thing except no services
> failed that time. And again I tried it.
> The end situation was I installed the OOB SP3 postfix and now I can't
> reproduce it which is a good thing.
> 
> If I reinstall SP3 I believe that would remove OOB, correct ?
> Then I could try it again.
> 
> regards, Gunther
> ----------
> > From: Paul Bronowski (Volt Comp) 
> > To: 'gbredow@comtech.com.au'
> > Subject: 86687: Ping with packet size of 65510 takes down NT 4.0
> +SP3
> (notyet verified).
> > Date: Saturday, 7 June 1997 4:00
> > 
> > Gunther,
> > Recently, you submitted a Windows NT bug report as described below.
> We
> > could not reproduce this problem. Please tell me exactly what you
> are
> > doing to cause this failure. What kind of network card does your
> system
> > use? Is this a blue screen failure, or an instantaneous reboot?
> Are
> > you able to reproduce the problem on multiple Windows NT systems?
> What
> > type of system are you pinging from?
> > Thank you for your help,
> > Paul Bronowski
> > Windows NT Test Team : )
> > To learn more about Windows NT please take a moment to visit
> > http://www.microsoft.com/ntworkstation and
> > http://www.microsoft.com/ntserver.
> > 
> >
> ----------------------------------------------------------------------
> --
> > --------
> > From: Gunnar Bredow [SMTP:gbredow@comtech.com.au]
> > Sent: Friday, June 06, 1997 1:19 AM
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] NT and POD
> > 
> > What ever happened to the Ping of Death scare ?
> > I set up a test NT 4 server with SP3 and pinged it with a packet of
> size
> > 65510 - whammo - the whole server reboots with quite ungracefully
> with
> > services failing until it was completely powerd off and restarted.
> Was
> > this
> > not meant to be fixed ? What is the issue when this is done across
> the
> > internet ? I would assume that routers would fragment it so it would
> not
> > be
> > a concern but this still concerns me.
> > 
> > any ideas ?
> > 
> > Gunther
> >
> ----------------------------------------------------------------------
> --
> > --------
I am running 4 Compaq Proliants (2x2000 and 2x 1500) and using SP3 
with no problems at all.

Cheers

David Eddey
IT Manager
Australian National Training Authority

----------
From: Keith.Pyper@berlitz.ie[SMTP:Keith.Pyper@berlitz.ie]
Sent: Saturday, June 07, 1997 8:47 AM
To: ntsecurity@iss.net; Gunnar Bredow
Subject: Re: [NTSEC] NT and POD

 Hi,

 I have a similar problem with a Compaq Proliant server, with SP3
 It just keeps rebooting every few days..?? It seems to shut down 
 safely, because there is no check disk ran on reboot.

 I have Compaq in sight manager on it but there is no hard ware
 problems are reported. As anybody else noticed this?

 Keith,


______________________________ Reply Separator 
_________________________________
Subject: [NTSEC] NT and POD
Author: "Gunnar Bredow" at btsdub-inet
Date: 06/06/97 16:18


What ever happened to the Ping of Death scare ?
I set up a test NT 4 server with SP3 and pinged it with a packet of 
size
65510 - whammo - the whole server reboots with quite ungracefully with 
services failing until it was completely powerd off and restarted. Was 
this
not meant to be fixed ? What is the issue when this is done across the 
internet ? I would assume that routers would fragment it so it would 
not be
a concern but this still concerns me.

any ideas ?

Gunther


Well Gunnar, I guess not. I was thinking of something like a flavor of
UNIX, but if you issue ANY PING command such as -l 65000 it WILL blow your
95 sky high! Or did you use another program to do it ?!? Certainly sure,
since you will not be able to do anything like:

PING xxxx.yyyy.zzzz.wwww -l 65510 -s 1 -t

Your W95 will blue screen out.

Best Regards,

R_o_m_u_l_o Moacyr C_h_o_l_e_w_a - MCSE, MCIS, MCNS, MCPS, CNA
mailto:rcholewa@elogica.com.br - mailto:romuloc@msconecta.com.br
http://www.elogica.com.br/users/rcholewa
----
From: Gunnar Bredow 
To: Romulo Moacyr Cholewa 
Date: Domingo, 8 de Junho de 1997 22:07
Subject: Re: [NTSEC] NT and POD

Simple - I did it from a Windows 95 machine :)

regard

Gunther

----------
> From: Romulo Moacyr Cholewa 
> To: Gunnar Bredow 
> Subject: Re: [NTSEC] NT and POD
> Date: Saturday, 7 June 1997 6:50
>
> How did you "pinged" it with a 65510 packet ?!? With NT ?!? It allows
you
> only 65000.
>
> R_o_m_u_l_o Moacyr C_h_o_l_e_w_a - MCSE, MCIS, MCNS, MCPS, CNA
> mailto:rcholewa@elogica.com.br - mailto:romuloc@msconecta.com.br
> http://www.elogica.com.br/users/rcholewa
> ----
> From: Gunnar Bredow 
> To: ntsecurity@iss.net
> Date: Sexta-feira, 6 de Junho de 1997 17:44
> Subject: [NTSEC] NT and POD
>
> What ever happened to the Ping of Death scare ?
> I set up a test NT 4 server with SP3 and pinged it with a packet of size
> 65510 - whammo - the whole server reboots with quite ungracefully with
> services failing until it was completely powerd off and restarted. Was
> this
> not meant to be fixed ? What is the issue when this is done across the
> internet ? I would assume that routers would fragment it so it would not
> be
> a concern but this still concerns me.
>
> any ideas ?
>
> Gunther
>
>



This is only being posted once, and I think it will be of some
interest to the readers of this list (which I am one of).


Dominique

______________________________________________________________________


BLACK HAT Briefings announcement

July 9th and 10th, Las Vegas Nevada


http://www.defcon.org/blackhat/



It's late. You're in the office alone, catching up on database
administration.

Behind you, your network servers hum along quietly, reliably. Life is
good.

Life is secure. Or is it?


A wave of unease washes over you. The air seems cold and frighteningly
still.

Your hands turn clammy as a sixth sense tells you, suddenly, you're not
alone.

They're out there. Worse, they're trying to get in. But who? And how?
And

what can you do to stop them?


Presented by DEF CON Communications and Cambridge Technology Partners,
the

Black Hat Briefings have been organized to put an end to nightmares 
like

these. While many conferences focus on information and network
security,

only the Black Hat Briefings will put your engineers and software
programmers

face-to-face with today's cutting edge computer security experts and

"hackers". Only the Black Hat Briefings will provide your people with
the

tools and understanding they need to thwart those lurking in the shadows
of

your firewall.


The reality is, they are out there. The choice is yours. You can live
in

fear of them. Or, you can learn from them.



 Conference Overview


Spanning two days with two separate tracks, the Black Hat Briefings will
focus

on the vital security issues facing organizations with large enterprise

networks and mixed network operating systems. Topics will include denial
of

service attacks, secure programming techniques, and tool selection for

creating and effectively monitoring secure networks. From PEX systems to
Java

and ActiveX, from Unix to Windows NT and Netware, intensive sessions
will

cover the intricate security problems confronting organizations seeking
to

leverage the full power of emerging technologies. CIO's are welcome, but
they

better bring the people implementing their network strategies and
building

their applications, because this conference is for them.



 Wednesday, July 9th


09:00 - 09:45 Keynote Address: Ira Winkler, NCSA.


10:00 - 11:30 Track A Auditing and Risk Analysis of Windows NT.

 Track B Internet Attack Methodologies.


11:40 - 13:10 Track A How Firewalls Fit into the Corporate 
Landscape.

 Track B Secure programming practices and source code

 analysis.


13:20 - 14:20 Lunch


14:25 - 15:20 Ray Kaplan: Meet the Enemy Session


15:30 - 17:00 Track A TCP/IP Internals: Everything You Wanted to 
Know

 About Hacking the TCP/IP Stack.


 Track B Secure Implementations of ActiveX in a
Corporate

 Environment.


17:10 - 18:40 Track A Counter survailence expert.




 Thursday, July 10th


09:00 - 09:45 Keynote Address: Richard Thieme.


10:00 - 11:30 Track A Why Cryptography is Harder Than it Looks.

 Track B A Review and Implementation of Free Utilities
& Software Packages for Maintaining, Monitoring, and
Securing

 Systems and Networks.


11:40 - 13:10 Track A Novell Security, Auditing, Detection and
Prevention.

 Track B Denial of Service Attacks and Defensive
Strategies


13:20 - 14:20 Lunch 


14:25 - 15:20


15:30 - 17:00 Track A CIFS and Microsoft Security

 Track B SNMP Security Consideration and Implementation




 Notable speakers and "hackers"


Dominique Brezinski - Windows NT security expert.

Ray Kaplan - Corporate security expert.

Myles Connley - Firewall expert.

Peter Shipley - Unix security and auditing expert.

Bruce Schneier - Cryptography expert, author of Applied
Cryptography.

Mudge - Expert of secure programming techniques and

 originator of many CERT advisories.

Route - Editor of Phrack magazine, the underground's
largest

 electronic journal of computer hacking. TCP/IP
guru.

Kore - Novell security, auditing, detection and
prevention

 specialist.

QMaster - Expert in secure ActiveX and Internet application

 development.

Sluggo - Security defense strategy expert.

Hobbit - NT CIFS Security.

Jeremy - SNMP and SNMP2 security implications.

Richard Thieme - Internet Visionary.

Richard K. - Counter survailence specialist.

Ira Winkler - NCSA, author of "Corporate Espionage"

Chris Goggans - Wheel Group, Ex-LOD and past editor of Phrack.



Fees & Registration: Program fees are $995. To register or for more

information, contact:


 William Brittingham

 Cambridge Technology Partners

 304 Vassar Street

 Cambridge, MA 02139

 617.374.8580 or e-mail wbritt@ctp.com

 http://www.defcon.org/blackhat/


 Hotel Information


The Black Hat Briefings will take place July 9th and 10th at the 
Aladdin

Hotel & Casino in Las Vegas, Nevada. To take advantage of conference
rates

reservations must be made prior to June 9. When making arrangements,
please

reference the CTP-DC Communications conference.


The Aladdin Hotel and Casino, 

3667 Las Vegas Blvd., South

Las Vegas, NV 89109

Phone: 800.634.3424


DEF CON Communications


DEF CON Communications is an independent organization providing 
multiple

services around computer network security and security auditing. In
addition

to The Black Hat Briefings, DEF CON organizes one of the largest
gatherings

for computer security minded individuals with topics ranging from
computer

culture to network security to personal privacy. DEF CON V will be help
July

11-13 at the Aladdin Hotel. Via it's speakers, it's programs, and it's
full

complement of consulting services, DEF CON demonstrates there are people
in

this world more paranoid than you. All Black Hat attendees recieve 
free

admission to DEF CON V should they decide to stay the weekend.


Cambridge Technology Partners

http://ctp.com/


Cambridge Technology Partners is a new breed of systems integrator. We
have

applied our unique core values to the application development market to

fundamentally reinvent the way information technology solutions are

delivered. We combine process innovation, custom and package software

deployment, and training to rapidly deliver end-to-end business systems
that

create immediatebottom-line impact for our clients. We do it fast. We
do it

for a fixed price. And we do it on time.


Additional Sponsors


Aventail Corporation

http://www.aventail.com/


Founded in February 1996, Aventail Corporation is the leading vendor of

next-generation Internet security systems. Its software allows
organizations

to secure their networks, manage their employees' access to the Internet
and

build Virtual Private Networks (VPNs). Creating a VPN gives
organizations the

ability to dynamically create a private communication or data channel
over

the Internet. Aventail's adherence to open security standards
simplifies

VPN deployment, enables interoperability, and leverages corporations'

existing network investments. Its VPN solutions allow companies to
extend

the reach of their corporate Intranets to customers, partners, remote

offices, and worldwide employees.



National Computer Security Association

http://www.ncsa.com/


NCSA is an independent organization offering objective views and opinions
on

computer security issues. We strive to improve computer security through
the

sharing of knowledge, dissemination of information, and certification 
of

security products.




Dominique Brezinski

----------------------------------------------------

My opinions expressed here, and in any public forum, 

are my own and do not represent those of my employer 

or its clients. I am an individual, and I will 

retain those rights of free speech granted to me, 

regardless of my employment status. 

 ----
From: Joel Lafleur 
To: ntsecurity@iss.net
Date: Sunday, 8 June 1997 13:48
Subject: [NTSEC] This list

>Is this list not mainly for "Security" opposed to "how do I setup this
and
>that in NT"?
>


I would agree with this statement, but ask: what mailing list would be
appropriate for "How do I setup this and that in NT" ?


>Joel Lafleur
>Technical Support
>Golden Triangle On Line
>1-519-576-1713


Virgil
virgil@eis.net.au
Proud Home Owner
 

I had one with the processor loose (a little bit anyway) in the board. We $(#$*% 'd with it for about 2 weeks before someone else looked in and said, "hey, is that pushed in all the way?

All that it took...

----------
From: Anony Mouse
Sent: Friday, June 06, 1997 8:39 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Re: Compaq Proliant Server

I had this same sort of problem with a Compaq Proliant server (spontaneous
reboots every so often, sometimes up to three times a day, sometimes every
few days) and I found that for some reason a problem with the HP Laserjet
(I forget which one) giving the error Fuser temperature low (or something
like that) was kicking back to the server and causing it to shut down
spontaneously. I fixed the problem by turning off the power save function
on the printer, and it's been running smooth for 2 weeks now. I don't know
if this has anything to do with Keith's problem, but it sounds like it
could...

Dave Mills


----------
> From: Keith Pyper 
> To: ntsecurity@iss.net; Gunnar Bredow 
> Subject: Re: [NTSEC] NT and POD
> Date: Friday, June 06, 1997 6:47 PM
> 
> Hi,
> 
> I have a similar problem with a Compaq Proliant server, with SP3
> It just keeps rebooting every few days..?? It seems to shut down 
> safely, because there is no check disk ran on reboot.
> 
> I have Compaq in sight manager on it but there is no hard ware 
> problems are reported. As anybody else noticed this?
> 
> Keith,



At 20:12 6/7/97 -0700, you wrote:
>I recall someone posting a bug a few weeks ago that could blue screen NT even 
>with SP3 & the OOB patch. Can someone repost it?

There was one a while back that would nuke SP2 - we helped track that one
down, and it is fixed in SP3.

It involved a mismatched smbmount and Linux kernel.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Try a bridge or give a call to cisco they are always happy to sell you
something


Jan Braeuer wrote:
> 
> hallo,
> 
> i am looking for a product (firewall) that can handle a ip address
> translation, where the schema for translation depends on the target ip
> address for the traffic
> for example internal net 192.168.10.0 and traffic for network 172.16.x.x
> should be translated to 172.17.x.x and traffic for 192.168.100.0 should be
> translated to 192.168.101.x .
> 
> has anyone a idea ?
> 
> thanks
> jan
On Jun 9, Paul Christian Nelis wrote:
> Windows 95 and NT 4.0 Registry & Customization Handbook
>
> It's a Que book, by Jerry Honeycutt. Pretty good. Talks about using inf
> and reg files to do batch updates and modification to the registry. It
> also talks about regedt32 vs regedit, Policy Editor, etc.

There's an O'Reilly book about the Win95 registry. 
Perhaps NT's will be the subject of the next book.


-- 
Ng Pheng Siong * Pacific Internet Pte Ltd * Singapore
PGP: send mail with subject "send pgp key" * http://darkwing.pacific.net.sg

Fast. Secure. Cheap. Pick two.
On 10. juni 1997 03:32, Virgil[SMTP:virgil@eis.net.au] wrote:
> ----
>From: Joel Lafleur 
>To: ntsecurity@iss.net
>Date: Sunday, 8 June 1997 13:48
>Subject: [NTSEC] This list
>
>>Is this list not mainly for "Security" opposed to "how do I setup this
>and
>>that in NT"?
>>
>I would agree with this statement, but ask: what mailing list would be
>appropriate for "How do I setup this and that in NT" ?
>
>

Now since sombody finally brought this up (and i didnt want to be the one to add more spam to the list),
i totally agree..

This list is for NT security, 

this list is not for setting up programs, this list is not wierd CPU problems falling out of their sockets.

iwntug@iwntug.org is mailing list exactly for the purpose of discussing all aspects of Windows NT,
setting up, installing and running it.

for more information:

www.bhs.com or ->

-------------------------------------------
How to Access the List Manager
-------------------------------------------

You can interact with the List Manager by sending commands
in the body of an E-mail message addressed
to "iwntug-request@iwntug.org".

(Important Note: Commands in the "Subject:" line are NOT processed.)

Available List Manager Commands

The List Manager understands the following commands:

(Note: In the descriptions below items contained in []'s are optional. 
When providing the item, do not include the []'s around it.)

subscribe [
] [DIGEST]

 Subscribe yourself (or
if specified) to the named .
 
 Note: You must unsubscribe first if you change form immediate to
digest mode
 or from digest to immediate mode.

unsubscribe [
]

 Unsubscribe yourself (or
if specified) from the named
.
which

 Find out which lists you are on.
info 

 Retrieve the general introductory information for the named .
lists

 Show the lists served by this List Manager server.
help

 Retrieve this message.
end

 Stop processing commands (useful if your mailer adds a signature).
----------------------------------------------


And now leats lean back and find a few more exploits or security holes to discuss :-)


vader@inet.uni-c.dk | "We learn from history,
Chris Larsen | that we don't learn from history"
Struers A/S |
System Manager | All opinions expressed herein are solely
http://www.babel.dk/windowsnt/ | of my own, and _not_ of my employers.

How about you post it all on a web page for all to see and contribute
to. You might find a more find more interactive feedback

Steve


Elias Karakoulakis wrote:
> 
> Hello All,
> 
> I am compiling a list of common registry keys that are useful to be
> manipulated via login scripts or the System Policies. For example,
> trying to lock down %systemroot% hard, requires me to change the
> Internet Explorer's cache, cookies and history folders (to be
> pointing e.g. to c:\temp). For that, I've made an addition to the
> (shell) policy in winnt.adm (poledit template)
> Could you be so kind to help me with all the keys you've found
> noteworthy, I would be grateful.
> 
> p.s. Mail me too if you want any login scripts, PolEdit templates and
> administration scripts that I've made.
> 
> Elias Karakoulakis
> Undergraduate student at the National Technical University of Athens
> ekarak@softlab.ece.ntua.gr

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
--------------------------------------------------------------------
> I've ether-sniffed my ssh connections and observed a handful of bytes
> per 1 byte keypress... perhaps 4-6 bytes created when I'm in triple
> DES mode. I love the program, the security is military grade point

 Try Blowfish - it should be both faster and lighter and harder to
break. The DES has been around for ages and its S-boxes are solid
against all known forms of attacks - that much is certain - but no
weakness is known to exist in Blowfish either. (I do not consider
brute-force-search an attack as any cryptosystem will fail to that.)

> to point, and the only thing more you'd need is tempest equipment
> and storage encryption for icing on the cake. Now if they would
> just do the same for FTP.

 This issue has been discussed with DataFellows in detail and they
admit that the current implementation of SSH cannot forward ftp (except
PERHAPS in passive mode). They have promised to "look into it" for the
next release. I am not too optimistic about this anyway - I do not
appreciate datafellows at all. The original SSH program developed by
Taty Ylönen was a GNU software (as the unix version still is thanks to
Tatu), but DF charges unimaginable sums for the other OS versions of
SSH. Second example is F-PROT, an icelandic anti-virus software, is
excellent and used to be shareware until DF took over... Both programs
are excellent as other DF programs seem to be also (forgetting the fact
that there is no 32-bit windows SSH client).

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
Hi,

Northern Technology has a product called RasTracker wich has a lot of
interesting new functions for RAS, maybe it'll fix your problems. try
http://www.northern.se

/Jens

> -----Original Message-----
> From: Anders Hurtigh [SMTP:hurtigh@ancestor.se]
> Sent: den 8 juni 1997 16:11
> To: ntsecurity@iss.net
> Subject: [NTSEC] Disallow multiple RAS-logons
> 
> Hi Everybody,
> 
> Does anybody know about a way to allow our RAS users only one 
> simultaneous login?
> 
> /BRGDS
> 
> Anders
> 
> hurtigh@ancestor.se
> 
> http://www.ancestor.se/
> http://www.funbase.se/essentials/livsviktigt/text_index.html
> 
> Voice: +46 (0)70 5153230
> Fax: +46 (0)70 6101937





John Karabatich@COM TECH
10/06/97 19:42

Does anyone aware of a DLL or otherwise on NT 4.0 that will allow me to
have more restrictive password settings than currently available on NT. I
need restrictions to be similar to ones available on AS400 user security
profiles.


Thanks in Advanced.


Depends what you are looking for
Have a look at the NT4 SP2 (or 3) readme which will explain about
passfilt.dll which provides "strong" password enforcement for users
changing their password via the UI.

> -----Original Message-----
> From: jkarabatich@comtech.com.au [SMTP:jkarabatich@comtech.com.au]
> Sent: Tuesday, June 10, 1997 10:43 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] NT 4.0 Security Profile
> 
> 
> 
> 
> 
> 
> John Karabatich@COM TECH
> 10/06/97 19:42
> 
> Does anyone aware of a DLL or otherwise on NT 4.0 that will allow me
> to
> have more restrictive password settings than currently available on
> NT. I
> need restrictions to be similar to ones available on AS400 user
> security
> profiles.
> 
> 
> Thanks in Advanced.
> 

 How can I get the last login date and time for users without any third
 party packages (e.g., NO Somar dumpacl)?

 Please let me know!

 Thanks!

 Connie
For both NT 4.0 Server and Workstation.

1) Go into Programs->Administrative Tools (Common)->User Manager.
Selection Options->Auditing. Then select the kinds of events you want to
audit.

2) Go into Programs->Administrative Tools (Common)->Event Viewer and then
select the security log. This will list all of the people who have logged
in/out of your system (plus whatever else you selected).

At 09:58 AM 6/10/97 -0400, cmbalodimos-barry@bkb.com wrote:
>
> How can I get the last login date and time for users without any third
> party packages (e.g., NO Somar dumpacl)?
>
> Please let me know!
>
> Thanks!
>
> Connie
>
>
Since I've had a lot of feedback regarding the NT administration scripts,
policy templates, registry changes etc., I made a website, the URL is:

http://www.softlab.ece.ntua.gr/~ekarak/nt

I will keep feeding it with all the stuff I get from you people, but
PLEASE stop sending me "meee tooo" messages.


Elias Karakoulakis
Undergraduate student at National Technical University of Athens
ekarak@softlab.ece.ntua.gr

"Life is a Sinewave"

If you have access to the NT Server Resource Kit you can use a Microsoft utility:

Excerpt from Knowledge base article Q158388
 Usrstat.exe Displays username, fullname, and last login date and time for
 each user account across all domain controllers.

I hope this helps.

 Michael Gillespie

-----Original Message-----
From: cmbalodimos-barry@bkb.com [SMTP:cmbalodimos-barry@bkb.com]
Sent: Tuesday, June 10, 1997 8:59 AM
To: ntsecurity(a)iss.net
Subject: [NTSEC] Last Login Date/Time


 How can I get the last login date and time for users without any third
 party packages (e.g., NO Somar dumpacl)?

 Please let me know!

 Thanks!

 Connie

There's a new one out from Wiley Interscience as well, but I left the
specs on it at home. I just got the flyer last night in the mail.

>----------
>From: ngps@pacific.net.sg[SMTP:ngps@pacific.net.sg]
>Sent: Monday, June 09, 1997 22:53
>To: nelis@wfg.com
>Cc: phac105@julia.ma.rhbnc.ac.uk; ntsecurity@iss.net
>Subject: Re: [NTSEC] NT Registry Books
>
>On Jun 9, Paul Christian Nelis wrote:
>> Windows 95 and NT 4.0 Registry & Customization Handbook
>>
>> It's a Que book, by Jerry Honeycutt. Pretty good. Talks about using inf
>> and reg files to do batch updates and modification to the registry. It
>> also talks about regedt32 vs regedit, Policy Editor, etc.
>
>There's an O'Reilly book about the Win95 registry. 
>Perhaps NT's will be the subject of the next book.
>
>
>-- 
>Ng Pheng Siong * Pacific Internet Pte Ltd *
>Singapore
>PGP: send mail with subject "send pgp key" *
>http://darkwing.pacific.net.sg
>
>Fast. Secure. Cheap. Pick two.
>
It seems that a majority of the list had no problem with me posting this, so
I'll be brief.

I currently work in Human Factors and we are interested in the usability of our
products and web sites. We often bring people in to help us test these factors
and sometimes use them to help us with prototypes. Most of the time this is
done in our usability lab located in Research Triangle Park, NC, but we also
conduct surveys and will begin to post the prototypes so that more people can
give us feedback on our designs. This will greatly help us, as we rarely get
to integrate the views of our foreign customers into our designs.

Once again, IBM pays for participation, even on surveys.

If you are interested please fill out and mail the following short survey to me
at jaswinde@us.ibm.com. Please do not reply to the listserver.

We will use this to choose participants for different activities. This
information will be stored in a database for the sole use of the usability
group here at IBM and will not be seen by anyone else.

Thank you for your time.
--------------------------------------------------------------------------------------------------------------------------------------------------------------
Name:
City, State:
Phone:
Fax:
E-Mail:
Job Title:
Company Name:
Company's Industry:
Company's approximate # of employees:

1. Are you, or have you ever been employed by IBM?
____ Currently employed by IBM
____ Previously employed by IBM
____ Never employed by IBM

2. Check all of the following that describe you:
____ I have responsibility for managing or maintaining IT Security products/
systems for my company.
____ I have responsibility for formulating and managing my company's IT
Security policy.
____ I manage part of my company's business where the supporting IT Security
system plays a very important part.
____ I make or influence the purchase decision for IT Security products,
technologies or services for my company.
____ I have a strong business need for information about IT Security products,
technologies, services, trends, issues, etc.

3. Please describe any additional job responsibilities you have regarding IT
or other security:

4. Which of the following describes your use of the internet to gain job
related information?
____ Never use the World Wide Web
____ Occasionally use the World Wide Web
____ Never use the World Wide Web

5. In which of the following research activities are you interested in being a
participant? (Check all that apply)
____ Day focus groups (6 to 8 hours)
____ Evening focus groups (3 to 4 hours)
____ US Mail Surveys
____ E-Mail Surveys
____ WWW Surveys
____ Product Evaluations (4 to 6 hours)

6. Would you be willing/ able to travel to our site at Research Triangle Park,
NC at our expense if an activity required it?
____ Yes
____ No

Julie Swindell
Web Externals Design & Development
(919) 254-6061
jaswinde@us.ibm.com
I may be setting up an FTP Server on the public Internet. If I use the 
Windows/NT 4.0 server what security and other pitfalls should I watch
out
for? I've heard there are better FTP servers available for Windows/NT.

Does anyone know where a better FTP server can be found?

Thank you,


John A. Jorgensen
Caliber Technology, Inc. (330) 384-9000 Ext 3848
557 E Tallmadge Ave. FAX (330) 258-6066
Akron, Ohio 44310
John Johnson wrote:

> As indipendant Auditors we have seen a few of these things about
> The Wall as its know is a low cost low brainer Firewall product meant
> for the small office sub office enviroment that seems to do what it says
> it is not a full firewall like checkpoint or Gurdian or Raptor but it does
> stop 99% of main attacks. it does however seem to be vulnerable to denial
> of service attacks but seeing this is for the smaller user the emphasis
> seems to be "bang for buck".

While the "low cost, low brainer" part is right, The Wall (and the
Wall Xtended) are both based on the same architecture as the Eagle NT
firewall, and as such is just as much firewall as the high-end Eagle.

The main differences are that the Wall series of products has a much 
more fixed configuration (requiring only minimal input from the admin/
installer but obviously limiting the amount of configuration that can
be done), and does not ship with the full set of proxies that the Eagle
ships with.

--rafal, working for but not speaking for Raptor

-- 
Rafal Boni rafal@raptor.com
69 Hickory Drive, Waltham, MA 02154 617.487.7700
The O'Reilly book is "Inside the Windows 95 Registry" (ISBN 1-56592-170-4),
this book and the Que book seem to be the best non-MonkeySoft books out.
They both overlap, but each contains reference info the other does not.

At 10:38 AM 6/10/97 -0700, Buff, Kurt wrote:
>There's a new one out from Wiley Interscience as well, but I left the
>specs on it at home. I just got the flyer last night in the mail.
>
>>----------
>>From: ngps@pacific.net.sg[SMTP:ngps@pacific.net.sg]
>>Sent: Monday, June 09, 1997 22:53
>>To: nelis@wfg.com
>>Cc: phac105@julia.ma.rhbnc.ac.uk; ntsecurity@iss.net
>>Subject: Re: [NTSEC] NT Registry Books
>>
>>On Jun 9, Paul Christian Nelis wrote:
>>> Windows 95 and NT 4.0 Registry & Customization Handbook
>>>
>>> It's a Que book, by Jerry Honeycutt. Pretty good. Talks about using inf
>>> and reg files to do batch updates and modification to the registry. It
>>> also talks about regedt32 vs regedit, Policy Editor, etc.
>>
>>There's an O'Reilly book about the Win95 registry. 
>>Perhaps NT's will be the subject of the next book.
>>
>>
>>-- 
>>Ng Pheng Siong * Pacific Internet Pte Ltd *
>>Singapore
>>PGP: send mail with subject "send pgp key" *
>>http://darkwing.pacific.net.sg
>>
>>Fast. Secure. Cheap. Pick two.
>>
>
>
For all who are interested.

Internet Security Review's Newsflashes are now freely available.
No ID and password needed.
Other categories to follow shortly.

check http://www.isr.net 

Red.


At 02:23 PM 6/10/97 -0400, you wrote:
>I may be setting up an FTP Server on the public Internet. If I use the 
>Windows/NT 4.0 server what security and other pitfalls should I watch
>out
>for? I've heard there are better FTP servers available for Windows/NT.
>
>Does anyone know where a better FTP server can be found?
>
>Thank you,

Try WarFTPD. I've found it one of the best FTP Servers available, and it's
shareware. The authors site is www.jgaa.com

Bill Kastner 
Systems Engineer E-Mail: bkastner@rand.com
Rand Technologies Web: http://www.rand.com 
5285 Solar Drive Phone: (905) 625-2000 x. 261 
Mississauga, Ontario Fax: (905) 625-6843
Canada L4W 5B8
Hi all

I have a question regarding NT security event log

There was one time a user came to me about his user profile is not
working, I check his profile under User Manager for Domains and found
out his profile is logged out. I knew if somebody tried to play around
his password for 10 times (which I set) and the profile will be
disabled. I then went to the event viewer security section and find out
whats wrong but I do not know how? Can somebody shed some light on this
matter.

thanks in advance

Joseph
Which proxies are noticeably absent?

Jeff

> -----Original Message-----
> From: Rafal Boni [SMTP:rafal@raptor.com]
> Sent: Tuesday, June 10, 1997 2:51 PM
> To: John Johnson; ntsecurity@iss.net
> Subject: Re: [NTSEC] The Wall [Reveiw]
> 
> John Johnson wrote:
> 
> > As indipendant Auditors we have seen a few of these things
> about
> > The Wall as its know is a low cost low brainer Firewall product
> meant
> > for the small office sub office enviroment that seems to do what it
> says
> > it is not a full firewall like checkpoint or Gurdian or Raptor but
> it does
> > stop 99% of main attacks. it does however seem to be vulnerable to
> denial
> > of service attacks but seeing this is for the smaller user the
> emphasis
> > seems to be "bang for buck".
> 
> While the "low cost, low brainer" part is right, The Wall (and the
> Wall Xtended) are both based on the same architecture as the Eagle NT
> firewall, and as such is just as much firewall as the high-end Eagle.
> 
> The main differences are that the Wall series of products has a much 
> more fixed configuration (requiring only minimal input from the admin/
> installer but obviously limiting the amount of configuration that can
> be done), and does not ship with the full set of proxies that the
> Eagle
> ships with.
> 
> --rafal, working for but not speaking for Raptor
> 
> -- 
> Rafal Boni
> rafal@raptor.com
> 69 Hickory Drive, Waltham, MA 02154
> 617.487.7700
At 02:23 PM 6/10/97 -0400, Jorgensen, John wrote:
>I may be setting up an FTP Server on the public Internet. If I use the 
>Windows/NT 4.0 server what security and other pitfalls should I watch
>out
>for? I've heard there are better FTP servers available for Windows/NT.
>
>Does anyone know where a better FTP server can be found?

As long as your security on your system is setup correctly, you should be
ok with the MS server. The disadvantage is that all ftp users must have an
NT user account. It may be possible to write a filter dll to use an
external data source, but I haven't done it and I haven't heard of anyone
else that has.

I use Serv-U 2.2 from http://www.cat-soft.com Serv-U is shareware. It costs
$50 per machine. It also supports an external dll interface for user
authentication. It works great, but unfortunately it doesn't run natively
as a service.

There is also a free service called WarFTP. It is supposed to be VERY
powerful and secure, but I could never get it to work. :( Then again, I
used it over a year ago and I'm sure it has improved! Here's the URL:
http://www.jgaa.com/

You may also want to check tucows, windows95.com, stroud, etc...

-Robert




Robert Boyle - Engineer robert@garden.net WAN/Intranet/Internet Services
Garden Networks: New Jersey's Premier Internet Service Provider
50 Diller Ave. / Newton, NJ 07860 (201)300-9211 10AM-5PM EST
28 Route 46 West / Pine Brook, NJ 07058 (201) 808-5558 10AM-7PM EST
http://www.garden.net Automatic Response: info@garden.net

>Name: Tani Hosokawa
>City, State: Vancouver, BC
>Phone: 604-294-9065
>Fax:
>E-Mail: thosokaw@sfu.ca
>Job Title: System Administrator
>Company Name: C.O.P. Data Systems International
>Company's Industry: Software, networking, data recovery, odd jobs
>Company's approximate # of employees: 10
>
>1. Are you, or have you ever been employed by IBM?
>____ Currently employed by IBM
>____ Previously employed by IBM
>_X__ Never employed by IBM
>
>2. Check all of the following that describe you:
>_X__ I have responsibility for managing or maintaining IT Security products/
>systems for my company.
>_X__ I have responsibility for formulating and managing my company's IT
>Security policy.
>_X__ I manage part of my company's business where the supporting IT Security
>system plays a very important part.
>_X__ I make or influence the purchase decision for IT Security products,
>technologies or services for my company.
>____ I have a strong business need for information about IT Security
products,
>technologies, services, trends, issues, etc.
>
>3. Please describe any additional job responsibilities you have regarding IT
>or other security:
>
>4. Which of the following describes your use of the internet to gain job
>related information?
>_X__ Frequently (Never <- typo) use the World Wide Web
>____ Occasionally use the World Wide Web
>____ Never use the World Wide Web
>
>5. In which of the following research activities are you interested in
being a
>participant? (Check all that apply)
>____ Day focus groups (6 to 8 hours)
>____ Evening focus groups (3 to 4 hours)
>_X__ US Mail Surveys
>_X__ E-Mail Surveys
>_X__ WWW Surveys
>_X__ Product Evaluations (4 to 6 hours)
>
>6. Would you be willing/ able to travel to our site at Research Triangle
Park,
>NC at our expense if an activity required it?
>_X__ Yes
>____ No

---
Unknown


A hotfixed Microsoft DNS Server for Windows NT 4.0 is now available on
the Microsoft FTP server.

This hotfix corrects two security problems related to the DNS server in
Service Pack 3:
Q167629: MS DNS server uses predictable query IDs and is vulnerable to
predictable ID cache pollution attack
Q142047: MS DNS server may fail due to an access violation if it
receives an unexpected response or packet

This hotfix also corrects two other problems related to the DNS server
in Service Pack 3:
Q154984: Failure to resolve recursive queries with large responses
Q154985: Result of changing zone type in DNS Manager is not written
back to persistent configuration

Microsoft strongly recommends upgrading your Microsoft DNS Server. The
hotfix and KB articles are available from:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixe
s-postSP3/dns-fix


Peter Brundrett
Microsoft


I heard from someone here that the OOB can be reproduced with 257 byte
packets. The Win95 PC would immediately reboot instead of giving a BSOD.


I don't have a test case here, but if anyone has, I'd be interested in
having a result on this issue.

Sander

---
Sander Goudswaard, the Netherlands
mailto:sander@sander.com
phone (work): +31 317 484053
www: http://www.student.wau.nl/~sander/
talk: sander@flex058.hhome.wau.nl or sander@flex167.iend.wau.nl
Does anyone know if it is possible to set up MS Proxy server to use either
SOCKS 4, or conventional mapped links or plugs?

I have a client who doesn't want to use the Winsock proxy that comes with
Proxy Server.

Thanks.

On Tue, 10 Jun 1997, Julie A Swindell wrote:

> Name: Chris Larsen
> City, State: Copenhagen, Denmark
> Phone: +45 33 33 93 38 (from 18.00-24.00 CET) or +45 38 27 37 95 (from 
09.00 - 16.00 CET)
> Fax: -
> E-Mail: vader@babel.dk, vader@inet.uni-c.dk
> Job Title: System Manager
> Company Name: Struers A/S (main employee), Babel: Internet Cafe 
(leisure time employment)
> Company's Industry: Struers: Metallographic equipemnt manufacturing and 
consuambles for this machinery. Babel: Well.. Internet access, 
surveillance, network monitoring, security audits, web publishing, 
techinical support, inet related education.
> Company's approximate # of employees: Struers: ~130, Babel: ~10

> 1. Are you, or have you ever been employed by IBM?
> ____ Currently employed by IBM
> ____ Previously employed by IBM
> _X__ Never employed by IBM
> 
> 2. Check all of the following that describe you:
> _X__ I have responsibility for managing or maintaining IT Security 
products/systems for my company.
> _X__ I have responsibility for formulating and managing my company's IT
> Security policy.
> ____ I manage part of my company's business where the supporting IT 
Security > system plays a very important part.
> _X__ I make or influence the purchase decision for IT Security 
products, technologies or services for my company.
> _X__ I have a strong business need for information about IT Security 
products, technologies, services, trends, issues, etc.
> 
> 3. Please describe any additional job responsibilities you have regarding IT
> or other security:
Internal security auditing, break in intrusion detection and evaluation. 
Logging and documenting of break ins for later use in court of law or 
other pursuits.

> 4. Which of the following describes your use of the internet to gain job
> related information?
> ____ Never use the World Wide Web
> ____ Occasionally use the World Wide Web
> ____ Never use the World Wide Web
Excuse me for adding my own:
 _X__ Always use the world wide web.

>
> 5. In which of the following research activities are you interested in being a
> participant? (Check all that apply)
> ____ Day focus groups (6 to 8 hours)
> _X__ Evening focus groups (3 to 4 hours)
> ____ US Mail Surveys
> _X__ E-Mail Surveys
> _X__ WWW Surveys
> _X__ Product Evaluations (4 to 6 hours)

> 6. Would you be willing/ able to travel to our site at Research Triangle Park,
> NC at our expense if an activity required it?
> _X__ Yes
> ____ No
> 
> Julie Swindell
> Web Externals Design & Development
> (919) 254-6061
> jaswinde@us.ibm.com
> 

Also refer to my previous email :-)



Chris Larsen | We learn from history, 
vader@inet.uni-c.dk | that we do not learn from history...
System Manager |
Struers A/S | All opinions expressed herein are my own
 | and _not_ those of my employers !!.

Slipped my fingers :-).. Wasnt meant to reply this to the list :-(


Chris Larsen | We learn from history, 
vader@inet.uni-c.dk | that we do not learn from history...
System Manager |
Struers A/S | All opinions expressed herein are my own
 | and _not_ those of my employers !!.

SPAM!

> -----Original Message-----
> From: Somebody [SMTP:thosokaw@sfu.ca]
> Sent: Tuesday, June 10, 1997 3:21 PM
> To: Julie A Swindell; ntsecurity@iss.net
> Subject: Re: [NTSEC] Recruiting for studies
> 
> >Name: Tani Hosokawa
> >City, State: Vancouver, BC
> >Phone: 604-294-9065
> >Fax:
> >E-Mail: thosokaw@sfu.ca
> >Job Title: System Administrator
> >Company Name: C.O.P. Data Systems International
> >Company's Industry: Software, networking, data recovery, odd jobs
> >Company's approximate # of employees: 10
> 
Frank Knobbe wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
>
> Does anyone know if there are organisations that certify someone on
> computer security? I'm not looking for products like the ISS stuff
> or
> Cisco's PIX and the like, but rather for a general security
> certification, something that can qualify one as a computer security
>
> specialist.
>
> Please let me know if you know about such a thing, preferably with
> URL.
>
> Thanks,
> Frank
>
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
>
> iQCVAwUBM5r2bcZP3ocmY5AlAQHLhgP/UFhNJnyrxAyEEZ7pgqeMBLs1qwhbxegf
> aR56WbTwexWewGiQ2uFVXy9kL4VGJaFUNm5ubaQvvDndFDumoDy/5HaxLALkyRUY
> UdCAB1Xb9BZHY8gbEfQgWpknjELWNIkemmTdeZsfCgo02FIArcCVaPRTsNhYj/1C
> uAlzXnE0a1A=
> =q06q
> -----END PGP SIGNATURE-----
> -----BEGIN SPAM WARNING-----
>
> WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
> AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
> THIS WILL DISABLE FURTHER CORRESPONDENCE.
> PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> EMAIL LIST.
>
> -----END SPAM WARNING-----

Try InfoSecurity News magazine at http://www.infosecnews.com
There was an article run on certifications for info security in the May
or April 97 issue.
The e-mail is ISN@misti.ccmail.compuserve.com

-Andre



On Thu, 22 May 1997, LR LeVally wrote:

> > From: "Joel W. Barrett" 
> 
> > You'll need to create an access list and then apply that access list to an 
> > interface on the router.
> > 
> > access-list 100 deny udp any {ip subnet} {subnet mask} eq 139
> > 
> > interface serial 0
> > ip access-group 100 in
> 
> Suppose I wanted to allow tcp access to port 139 for specific
> subnets only, i.e., deny the world, permit selected subnet?

Permit the selected, THEN deny the world. Least restrictive first, 
catch-alls last.

> 
> Can this be done on a Cisco 2501?
> 

Yes.

When replying to surveys sent to mailing lists, try to remember that 
"reply to all recipients" will include the list ... 

On Tue, 10 Jun 1997, Chris Larsen wrote:

> On Tue, 10 Jun 1997, Julie A Swindell wrote:
> 
> > Name: Chris Larsen
> > City, State: Copenhagen, Denmark
----- Forwarded message from Aleph One -----

>From owner-bugtraq@NETSPACE.ORG Tue Jun 10 23:36:33 1997
Received: from valis.worldgate.com (root@valis.worldgate.com [198.161.84.2]) by gras-varg.worldgate.com (8.8.5/8.6.12) with ESMTP id XAA29105 for ; Tue, 10 Jun 1997 23:36:31 -0600 (MDT)
Received: from brimstone.netspace.org (brimstone.netspace.org [128.148.157.143])
 by valis.worldgate.com (8.8.5/8.8.5) with ESMTP id XAA22436
 for ; Tue, 10 Jun 1997 23:33:46 -0600 (MDT)
Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with ESMTP id <33250-15687>; Wed, 11 Jun 1997 00:43:37 -0400
Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release 1.8c) with
 spool id 4158869 for BUGTRAQ@NETSPACE.ORG; Wed, 11 Jun 1997 00:20:57
 -0400
Received: from brimstone.netspace.org (brimstone [128.148.157.143]) by
 netspace.org (8.8.5/8.8.2) with ESMTP id AAA18023 for
 ; Wed, 11 Jun 1997 00:18:08 -0400
Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with
 ESMTP id <33076-15687>; Wed, 11 Jun 1997 00:22:44 -0400
Approved-By: aleph1@UNDERGROUND.ORG
Received: from dfw.dfw.net (aleph1@dfw.dfw.net [198.175.15.10]) by netspace.org
 (8.8.5/8.8.2) with SMTP id TAA16049 for ; Tue,
 10 Jun 1997 19:24:54 -0400
Received: from localhost by dfw.dfw.net (4.1/SMI-4.1) id AA13559; Tue, 10 Jun
 97 18:31:16 CDT
Message-ID: 
Date: Tue, 10 Jun 1997 18:31:16 -0500
Reply-To: Aleph One 
Sender: Bugtraq List 
From: Aleph One 
Subject: Q167629: Predictable Query IDs Pose Security Risks for DNS Servers
To: BUGTRAQ@NETSPACE.ORG

DOCUMENT:Q167629 [winnt]
TITLE: Predictable Query IDs Pose Security Risks for DNS Servers
PRODUCT: Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbnetwork NTSrv nttcp

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server versions 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

An attacker can send a query to a DNS server asking for the IP address (for
example, of www.microsoft.com.) The DNS server sends a recursive query on
behalf of the client at which point the attacker floods the DNS server with
responses indicating the IP address (for example, for www.microsoft.com it
may return 127.0.0.1,) or any other incorrect response as desired by the
attacker. The DNS server caches this result and subsequent queries for this
site return the incorrect IP address. The cached entry can be set to live
for an arbitrarily long time in the cache and is not purged until the DNS
server is reset.

CAUSE
=====

The Domain Name System (DNS) is used to resolve names with IP addresses and
a DNS query can be sent to any DNS server. If the server does not have the
authoritative answer to the query, it can ask other DNS servers in the DNS
tree for the answer. This is called a recursive query. The result of a
recursive query is cached by the originating DNS server to improve
performance. A DNS server may have many outstanding recursive queries at
any one moment in time and each outstanding query is identified by a query
ID.

Microsoft Windows NT (and many other) DNS servers use a predictable
sequence of query IDs when resolving recursive queries. If an attacker can
determine the current sequence number, they can determine future sequence
numbers. Knowledge of future sequence numbers helps an attacker flood a DNS
server with spoofed responses to recursive queries. This makes a "cache
pollution" attack easier to accomplish.

RESOLUTION
==========

The Microsoft DNS Server has been modified to use random query IDs. Random
query IDs reduce the effectiveness of this cache pollution attack. Obtain
the following fix, or wait for the next Windows NT service pack.

This hotfix has been posted to the following Internet location:

 ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
 hotfixes-postSP3/dns-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 prodnt

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

----- End of forwarded message from Aleph One -----

-- 
Email: skafte@worldgate.com Voice: +403 413 1910 Fax: +403 421 4929
 #575 Sun Life Place * 10123 99 Street * Edmonton, AB * Canada * T5J 3H1 
-- --
PGP 2.6.2 Key fingerprint = 42 9C 2C A8 4D 2B C9 C4 7D B6 00 B0 50 47 20 97 
http://gras-varg.worldgate.com/~skafte/ http://www.worldgate.com/
-- --
When things can't get any worse, they simplify themselves by getting a whole
lot worse then complicated. A complete and utter disaster is the simplest
thing in the world; it's preventing one that's complex. (Janet Morris)
----- Forwarded message from Aleph One -----

>From owner-bugtraq@NETSPACE.ORG Tue Jun 10 23:36:33 1997
Received: from valis.worldgate.com (root@valis.worldgate.com [198.161.84.2]) by gras-varg.worldgate.com (8.8.5/8.6.12) with ESMTP id XAA29110 for ; Tue, 10 Jun 1997 23:36:32 -0600 (MDT)
Received: from brimstone.netspace.org (brimstone.netspace.org [128.148.157.143])
 by valis.worldgate.com (8.8.5/8.8.5) with ESMTP id XAA22439
 for ; Tue, 10 Jun 1997 23:33:47 -0600 (MDT)
Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with ESMTP id <34934-15688>; Wed, 11 Jun 1997 00:33:30 -0400
Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release 1.8c) with
 spool id 4158603 for BUGTRAQ@NETSPACE.ORG; Wed, 11 Jun 1997 00:19:02
 -0400
Received: from brimstone.netspace.org (brimstone [128.148.157.143]) by
 netspace.org (8.8.5/8.8.2) with ESMTP id AAA18029 for
 ; Wed, 11 Jun 1997 00:18:09 -0400
Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with
 ESMTP id <32781-15689>; Wed, 11 Jun 1997 00:22:43 -0400
Approved-By: aleph1@UNDERGROUND.ORG
Received: from dfw.dfw.net (aleph1@dfw.dfw.net [198.175.15.10]) by netspace.org
 (8.8.5/8.8.2) with SMTP id TAA15843 for ; Tue,
 10 Jun 1997 19:22:56 -0400
Received: from localhost by dfw.dfw.net (4.1/SMI-4.1) id AA13002; Tue, 10 Jun
 97 18:29:18 CDT
Message-ID: 
Date: Tue, 10 Jun 1997 18:29:18 -0500
Reply-To: Aleph One 
Sender: Bugtraq List 
From: Aleph One 
Subject: Q142047: Bad Network Packet May Cause Access Violation (AV) on
 DNS Server
To: BUGTRAQ@NETSPACE.ORG

DOCUMENT:Q142047 [winnt]
TITLE: Bad Network Packet May Cause Access Violation (AV) on DNS Server
PRODUCT: Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbnetwork NTSrv nttcp

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

The Domain Name System (DNS) fails with an access violation and ceases to
resolve names.

CAUSE
=====

If a DNS query is modified so that the original query's AnswerCount field
is greater than 0, the DNS server may cause an access violation (AV).

If the AnswerCount is greater than 0, we expect to already have data from
the original query, but in this case, the data is not present.

RESOLUTION
==========

Obtain the following fix or wait for the next Windows NT service pack.

This hotfix has been posted to the following Internet location:

 ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
 hotfixes-postSP3/dns-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 prodnt

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

----- End of forwarded message from Aleph One -----

-- 
Email: skafte@worldgate.com Voice: +403 413 1910 Fax: +403 421 4929
 #575 Sun Life Place * 10123 99 Street * Edmonton, AB * Canada * T5J 3H1 
-- --
PGP 2.6.2 Key fingerprint = 42 9C 2C A8 4D 2B C9 C4 7D B6 00 B0 50 47 20 97 
http://gras-varg.worldgate.com/~skafte/ http://www.worldgate.com/
-- --
When things can't get any worse, they simplify themselves by getting a whole
lot worse then complicated. A complete and utter disaster is the simplest
thing in the world; it's preventing one that's complex. (Janet Morris)
----- Forwarded message from Aleph One -----

>From owner-bugtraq@NETSPACE.ORG Tue Jun 10 23:36:31 1997
Received: from valis.worldgate.com (root@valis.worldgate.com [198.161.84.2]) by gras-varg.worldgate.com (8.8.5/8.6.12) with ESMTP id XAA29100 for ; Tue, 10 Jun 1997 23:36:30 -0600 (MDT)
Received: from brimstone.netspace.org (brimstone.netspace.org [128.148.157.143])
 by valis.worldgate.com (8.8.5/8.8.5) with ESMTP id XAA22427
 for ; Tue, 10 Jun 1997 23:33:41 -0600 (MDT)
Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with ESMTP id <35225-15688>; Wed, 11 Jun 1997 00:44:29 -0400
Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release 1.8c) with
 spool id 4158731 for BUGTRAQ@NETSPACE.ORG; Wed, 11 Jun 1997 00:19:57
 -0400
Received: from brimstone.netspace.org (brimstone [128.148.157.143]) by
 netspace.org (8.8.5/8.8.2) with ESMTP id AAA18008 for
 ; Wed, 11 Jun 1997 00:18:08 -0400
Received: from netspace.org ([128.148.157.6]) by brimstone.netspace.org with
 ESMTP id <33485-15689>; Wed, 11 Jun 1997 00:22:44 -0400
Approved-By: aleph1@UNDERGROUND.ORG
Received: from dfw.dfw.net (aleph1@dfw.dfw.net [198.175.15.10]) by netspace.org
 (8.8.5/8.8.2) with SMTP id TAA16112 for ; Tue,
 10 Jun 1997 19:25:32 -0400
Received: from localhost by dfw.dfw.net (4.1/SMI-4.1) id AA13602; Tue, 10 Jun
 97 18:31:54 CDT
Message-ID: 
Date: Tue, 10 Jun 1997 18:31:53 -0500
Reply-To: Aleph One 
Sender: Bugtraq List 
From: Aleph One 
Subject: Q169461: Access Violation in DNS.EXE Caused by Malicious Telnet
 Attack
To: BUGTRAQ@NETSPACE.ORG

DOCUMENT:Q169461 [winnt]
TITLE: Access Violation in DNS.EXE Caused by Malicious Telnet Attack
PRODUCT: Microsoft Windows NT
PROD/VER:4.00
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbnetwork NTSrv nttcp

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Server version 4.0
--------------------------------------------------------------------------

SYMPTOMS
========

You may receive an Access Violation in Dns.exe. This is most often occurs
on computers connected to public networks, such as the Internet, where
deliberate attacks are common.

CAUSE
=====

This particular attack is usually generated maliciously by typing the
following command on the attacking system:

 telnet 19 | telnet 53

This command causes a telnet connection to be established to port 19 (the
chargen service, which generates a string of characters) with the output
redirected to a telnet connection to port 53 (the DNS service.) This flood
of characters causes an Access Violation in the DNS service, which is
terminated, disrupting name resolution services.

RESOLUTION
==========

The Microsoft DNS Server has been modified to to correct this problem.
Obtain the following fix or wait for the next Windows NT service pack.

This hotfix has been posted to the following Internet location:

 ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
 hotfixes-postSP3/dns-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional reference words: 4.00 prodnt denial of service dns telnet port
53

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

----- End of forwarded message from Aleph One -----

-- 
Email: skafte@worldgate.com Voice: +403 413 1910 Fax: +403 421 4929
 #575 Sun Life Place * 10123 99 Street * Edmonton, AB * Canada * T5J 3H1 
-- --
PGP 2.6.2 Key fingerprint = 42 9C 2C A8 4D 2B C9 C4 7D B6 00 B0 50 47 20 97 
http://gras-varg.worldgate.com/~skafte/ http://www.worldgate.com/
-- --
When things can't get any worse, they simplify themselves by getting a whole
lot worse then complicated. A complete and utter disaster is the simplest
thing in the world; it's preventing one that's complex. (Janet Morris)
Hi!

I'm looking for a way to distribute programs to NT Workstations. The
problem is that my users runs with User rights and some programs
requires higher rights when installing the program (for example
Administrator rights). What I'd like to do is to distribute programs so
that users could install it even if it requires Administrator rights
during installation (make the installation programs to run with
Administrator rights during installation). Are there any
programs/systems that could do this?
(Microsoft SMS??)

Regards
 /Dan Bryntze

I suppose that you can make the installation program run as an interactive service. This way, the installation will have system rights.


----------
De: Dan Bryntze[SMTP:d92-dbr@nada.kth.se]
Enviado: miércoles 11 de junio de 1997 13:08
Para: ntsecurity
Asunto: [NTSEC] Installing programs on NT Workstation

Hi!

I'm looking for a way to distribute programs to NT Workstations. The
problem is that my users runs with User rights and some programs
requires higher rights when installing the program (for example
Administrator rights). What I'd like to do is to distribute programs so
that users could install it even if it requires Administrator rights
during installation (make the installation programs to run with
Administrator rights during installation). Are there any
programs/systems that could do this?
(Microsoft SMS??)

Regards
 /Dan Bryntze



I have set (skipping the path of) EnablePlainTextPassword equal to
zero and of course I cannot access our NFS servers since they do not
have my cipherpassword in their /etc/passwd file (those familiar with
NIS+ will know how the authentication works, I won't go into detail
here). Now I would like to use those NFS services and allow plain
passwords to be sent TO SPECIFIC HOSTS ONLY! Is this possible? Can I
define the "trusted" hosts to which I may send plain passwords?

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
> I suppose that you can make the installation program run as an interactive service. This way, the installation will have system rights.
> 
> 
> ----------
> De: Dan Bryntze[SMTP:d92-dbr@nada.kth.se]
> Enviado: miercoles 11 de junio de 1997 13:08
> Para: ntsecurity
> Asunto: [NTSEC] Installing programs on NT Workstation
> 
> Hi!
> 
> I'm looking for a way to distribute programs to NT Workstations. The
> problem is that my users runs with User rights and some programs
> requires higher rights when installing the program (for example
> Administrator rights). What I'd like to do is to distribute programs so
> that users could install it even if it requires Administrator rights
> during installation (make the installation programs to run with
> Administrator rights during installation). Are there any
> programs/systems that could do this?
> (Microsoft SMS??)

Here we use McAfee's SaberLan and that seems to deal with most 
installation and software distribution options we want, not only for 
NT but also Novell. It also deals with application licenses etc.

Rgds, Mike.
--
Michael Roy Collins - Network Engineer - Tel: +44 (0)1983 526631 ext. 252
 The Isle of Wight College. Newport, Isle of Wight. PO30 5TA
Email: (work) Mike@iwightc.ac.uk (home) Mike@tiwc.demon.co.uk
> Administrator rights). What I'd like to do is to distribute programs so
> that users could install it even if it requires Administrator rights
> during installation (make the installation programs to run with
> Administrator rights during installation). Are there any

 You might want to try to accomplish this with the SU.EXE -program
included in the NT Resource Kit. It is similar to unix SU-programs and
it gives temporary administrator priviledges.

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
 Just to lessen my ignorance, why does a program need
 administrative rights to install? There must be a list of
 reasons, but I can't think of any good ones. Please educate
 me?

 Here is a short list of possible reasons:
 1) Program needs a user id to operate under.
 2) Program wants to install something in
 \winnt\system32 directory.
 (Why? won't the %LIB% path search the application's
 directory for the same library?)
 3) Installation can't get past certain nodes in the
 registry due to incorrect ACL settings.
 4) ... there are probably a number of other reasons.

 The only useful item in this list is #1. All the rest of the
 installation could be done as the newly created "ordinary"
 user. Am I missing something?

 Thanks.
 Ed

According to Dan Bryntze:
> 
> Hi!
> 
> I'm looking for a way to distribute programs to NT Workstations. The
> problem is that my users runs with User rights and some programs
> requires higher rights when installing the program (for example
> Administrator rights). What I'd like to do is to distribute programs so
> that users could install it even if it requires Administrator rights
> during installation (make the installation programs to run with
> Administrator rights during installation). Are there any
> programs/systems that could do this?
> (Microsoft SMS??)
> 
> Regards
> /Dan Bryntze
> 
> 


-- 
Ed Bradford
NT Architecture M/S 9170
Software Solutions Div. Integrated Solutions Architecture
egb@austin.ibm.com 11400 Burnet Rd
Phone: T/L 678-1421 Austin,Tx, 78758
Real Phone 512-838-1421 FAX 512-838-2212

Does anyone have NT Security Policies written they would be willing to
share? Additionally, has someone documented the standard file security
used for servers?

Thanks in Advance
John Rome

Along the vein of the recent NT security policy question, does anyone have
any corporate email, internet, security, computer usage policies that they
are will to share.

TIA,
Brian D. Frost


> -----Original Message-----
> From: Nick Keenan [SMTP:nick@gsionline.com]
> Sent: Tuesday, June 10, 1997 4:39 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] MS Proxy server and mapped links/plugs
> 
> >Does anyone know if it is possible to set up MS Proxy server to use
> either
> >SOCKS 4, or conventional mapped links or plugs?
> 
> My understanding is that you have to use the Microsoft client.
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
>From: egb@austin.ibm.com
...
>
> Just to lessen my ignorance, why does a program need
> administrative rights to install? There must be a list of
> reasons, but I can't think of any good ones. Please educate
> me?
>
> Here is a short list of possible reasons:
> 1) Program needs a user id to operate under.
> 2) Program wants to install something in
> \winnt\system32 directory.
> (Why? won't the %LIB% path search the application's
> directory for the same library?)
> 3) Installation can't get past certain nodes in the
> registry due to incorrect ACL settings.
> 4) ... there are probably a number of other reasons.
>
> The only useful item in this list is #1. All the rest of the
> installation could be done as the newly created "ordinary"
> user. Am I missing something?
>
> Thanks.
> Ed
>

5. Installing a service.
6. Modifying registry.

Pradeep
pradeep@nuview.com


I am still trying to use the AT scheduler to do remote shutdowns on NT
machines across the network. I am the domain admin and also have start the
scheduler as myself. Whenever I run my shutdown.exe routine from the
scheduler, I get an access denied, though I can run it from the command
line.

Any thoughts...

Brian D. Frost


On Sun, 8 Jun 1997, Frank Knobbe wrote:

> Does anyone know if there are organisations that certify someone on
> computer security? I'm not looking for products like the ISS stuff or
> Cisco's PIX and the like, but rather for a general security
> certification, something that can qualify one as a computer security
> specialist.

 Here are the (known to me) specific security certifications that tend 
to be vendor neutral and focus on general information security issues:

CISSP - Certified Information Systems Security Professional

 Requires:
 - Passing the CISSP examination
 - 3 years experience in at least one of the ten CISSP test domains 
 of Information Security
 - Pledging to follow the (ISC)^2 Code of Ethics
 - Meeting the Continuing Education requirements

 (ISC)^2 manages and is located at 
 http://www.isc2.org


CISA - Certified Information Systems Auditor

 Requires:
 - Passing CISA examination
 - 5 years experience in Information Systems auditing
 - Pledging to follow the ISACA Code of Professional Ethics
 - Meeting the Continuing Education requirements

 ISACA manages and is located at 
 http://www.isaca.org/cert1.htm


CSO - Computer Security Official

 Requires:
 - Passing the CSO examinations
 - Unspecified experience

 New Dimensions International appears to manage and is located at
 http://www.newdimensions.net/courses/cso.html


 I believe that the ICCP offers a specialty examination on Systems 
Security as part of the total Certified Computer Professional (CCP)
certification track; consisting of the core exam and two specialty 
exams. The ICCP web site is at http://www.iccp.org

 As a CISSP, I can say that I've been fairly happy with the 
certification and pre-cert process.

 ___________________________________________________________
 [ Bruce M., CISSP - bkmarsh@feist.com - Feist Systems, Inc. ]
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 "Our ability to network has far outpaced our ability to protect ourselves
 from cyber attack. We have a fundamental new danger in the cyber dimension."
 -- Kenneth Minihan, Director of the National Security Agency
Assuming that you are in a NT domain environment, the easiest way to allow
users the ability to have full or partial full control of their
workstations is to use the "Administrators" or "Power Users" built-in local
groups.

Placing the domainname\Domain Users group in the localmachine\Power Users
group will give users most of the software and device loading functionality
that they need.

If you put the domainname\Domain Users group in the
localmachine\Administrators group, all domain users will have administrator
right to the local workstation.

Alternatively, you can put individual domain user accounts in the local
groups.

This works very well, and has solved a great deal of our problems...

Allan


At 10:05 AM 6/11/97 -0500, Pradeep Tapadiya wrote:
>>From: egb@austin.ibm.com
>...
>>
>> Just to lessen my ignorance, why does a program need
>> administrative rights to install? There must be a list of
>> reasons, but I can't think of any good ones. Please educate
>> me?
>>
>> Here is a short list of possible reasons:
>> 1) Program needs a user id to operate under.
>> 2) Program wants to install something in
>> \winnt\system32 directory.
>> (Why? won't the %LIB% path search the application's
>> directory for the same library?)
>> 3) Installation can't get past certain nodes in the
>> registry due to incorrect ACL settings.
>> 4) ... there are probably a number of other reasons.
>>
>> The only useful item in this list is #1. All the rest of the
>> installation could be done as the newly created "ordinary"
>> user. Am I missing something?
>>
>> Thanks.
>> Ed
>>
>
>5. Installing a service.
>6. Modifying registry.
>
>Pradeep
>pradeep@nuview.com
>
>
>
-------------------------------------------------------------------
All new computing problems must be reported to the Help Desk.
-------------------------------------------------------------------
Allan Bourdius Help Desk: (412) 772-8700
System Administrator (NT Servers) Direct: (412) 772-5807
Information Systems & Services Main: (412) 772-6600
FORE Systems, Inc. Fax: (412) 772-6500
174 Thorn Hill Road Email: abourdiu@fore.com
Warrendale, PA 15086 URL: http://www.fore.com
"At the FOREfront of ATM internetworking - The ATM Experts."
Personal URL: http://www.geocities.com/CapitolHill/8260/
On Wed, 11 Jun 1997 bdfrost@centralplastics.com wrote:

> I am still trying to use the AT scheduler to do remote shutdowns on NT
> machines across the network. I am the domain admin and also have start the
> scheduler as myself. Whenever I run my shutdown.exe routine from the
> scheduler, I get an access denied, though I can run it from the command
> line.

What user is the schedule service running as? You'd have to be
administrator to run the shutdown, so make sure the account you use for
the scheduler is a member of admins... Don't use the LSA.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "Boy meets beer. Boy drinks Beer, |./|\.
..\|/..|sunder@sundernet.com| Boy gets another beer!" |/\|/\
<--*-->| ------------------ | |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

At 03:43 PM 6/11/97 +0300, Juha Jäykkä wrote:
>> Administrator rights). What I'd like to do is to distribute programs so
>> that users could install it even if it requires Administrator rights
>> during installation (make the installation programs to run with
>> Administrator rights during installation). Are there any
>
> You might want to try to accomplish this with the SU.EXE -program
>included in the NT Resource Kit. It is similar to unix SU-programs and
>it gives temporary administrator priviledges.

No, it does not give the user temporary administrator privileges, because
inorder to use SU.EXE the user must actually have more privileges
(SE_TCB_NAME) than the standard administrator account! I believe there is a
SU implementation out there that uses a service to encapsulate the
extensive privileges that are necessary to logon a user. The actaul command
run by the user feeds the username and password to the service by some IPC
mechanism and the service gets a token for the target user. This is a much
better implementation, for your users don't need to have excessive
privileges and potentially the service could implement some authorization
scheme to limit which users can attempt to SU.

Dominique

>
>-- 
> ---------------------------------------
> | Juha Jäykkä, juolja@utu.fi |
> | Turun yliopisto, ATK-keskus |
> | University of Turku, Computer Centre |
> | työ/office: +358 2 333 5961 |
> ---------------------------------------
>
>
Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
take a look at the Win-eXpose-Registry SHAREWARE 
you can download it from http://www.shetef.com
enjoy
Ziv
--- On Mon, 2 Jun 1997 09:21:16 -0500 Mark Hellel wrote:
> 
> 
> There are a couple of tools already out there that do this. Have a look at 
> regmon from O'reilly associates and have a look at sunbelt tools INC who do a 
> lot of third party utils.
> 
> 
> 
> Marky_Mark
> 
> You can lead a horse to water but a pencil must be lead!
> ______________________________ Reply Separator _________________________________
> Subject: Re: [NTSEC] Tool for monitoring changes in NT
> Author: Steve Toomey at Internet
> Date: 02/06/97 08:25
> 
> 
> You can use SYSDIFF (res kit) or 3rd party tools like Wininstall to take 
> snapshots of a registry and compare them 
> 
> Steve
> 
> 
> Jonn Martell wrote:
> > 
> > We are looking for a tool to monitor any changes done to the registry and 
> > to certain (system) directories.
> > 
> > We've looked for some time but can't find a good tool that can do this 
> > simple task. Without such a tool, administering NT properly in almost 
> > impossible.
> > 
> > One of the basic fundamentals in security is to monitor changes. One needs 
> > to easy find out when some registry keys have been changed and how. It's 
> > also important to know when certain files have been changed (through CRC
> > check?). It would be even nicer if the tool could monitor the file system 
> > changes as they happen and perform a file backup to a special mirror
> > directory (but I'll stop dreaming...). 
> > 
> > Having to reinstall NT because an SP failed is a joke - a good tool should 
> > be able to "perform an SP uninstall" and protect from other "trojan-like" 
> > nightmares :-)
> > 
> > If you know of any product, please email me directly and I'll summarize to 
> > this list in 7 days.
> > 
> > .................................................................. 
> > Jonn Martell, Network Analyst
> > University of British Columbia
> > "The more I work with NT, the more I like [the other system]...."
> 
> -- 
> ----------------------------------------------------------------------- 
> Steve Toomey | Internet Address : toomeys@dircon.co.uk 
> London, UK | Home page :
> Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys 
> -----------------------------------------------------------------------

---------------End of Original Message-----------------


 /~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
 | A B I R N E T Active Network Protection | 
 \~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/
 \========== Get an EVALUATION COPY at ===========/

Frank;

In addition to the ones already identified to you, The American Society for
Industrial Security (ASIS) (the largest security organization) has a
certification called the Certified Protection Professional (CPP)

They have a large national as well as international membership (over 25,000)

Overall they are more focused on the physical security issues but are very
diverse and do have a Computer Security emphasis. Of the more than 30
Standing Committees/Councils, roughly half are concerned with security
problems affecting businesses such as banking and financial institutions,
educational institutions, health care facilities, public utilities, and
retail establishments. The other half address general security problems
such as terrorism, physical security, computer security, privacy and
information management, investigations, white collar crime, fire prevention
and safety. Members of these committees/councils prepare special reports and
other publications, conduct security studies, and develop educational
programs which focus on specific security topics.

Check out their site for additional information:

http://www.asisonline.org/

Hope this helps,

Aaron


At 01:14 PM 6/8/97 -0600, you wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>Does anyone know if there are organisations that certify someone on
>computer security? I'm not looking for products like the ISS stuff or
>Cisco's PIX and the like, but rather for a general security
>certification, something that can qualify one as a computer security
>specialist.
>
>Please let me know if you know about such a thing, preferably with
>URL.
>
>
>Thanks,
>Frank
>
>
>
>
>-----BEGIN PGP SIGNATURE-----
>Version: 2.6.2
>
>iQCVAwUBM5r2bcZP3ocmY5AlAQHLhgP/UFhNJnyrxAyEEZ7pgqeMBLs1qwhbxegf
>aR56WbTwexWewGiQ2uFVXy9kL4VGJaFUNm5ubaQvvDndFDumoDy/5HaxLALkyRUY
>UdCAB1Xb9BZHY8gbEfQgWpknjELWNIkemmTdeZsfCgo02FIArcCVaPRTsNhYj/1C
>uAlzXnE0a1A=
>=q06q
>-----END PGP SIGNATURE-----
>-----BEGIN SPAM WARNING-----
>
>WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
>VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
>AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
>THIS WILL DISABLE FURTHER CORRESPONDENCE.
>PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
>THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
>EMAIL LIST.
>
>-----END SPAM WARNING-----
>
>

 / Aaron Kramer
 ____/ ____/ ___ / ____/ 10 West Broad St.
 ____ / ____ / /__/ / ____ / Suite 1660
 _______/ _______/ _______/ _______/ Columbus, OH 43215
 business driven technology solutions. 
 1-800-924-7737 ext.28
E-mail: aaron.kramer@ssds.com (614)221-0008 ext.28
Web Site: http://www.ssds.com (614)221-0010 fax

>From: bdfrost@centralplastics.com
...
>I am still trying to use the AT scheduler to do remote shutdowns on NT
>machines across the network. I am the domain admin and also have start the
>scheduler as myself. Whenever I run my shutdown.exe routine from the
>scheduler, I get an access denied, though I can run it from the command
>line.
>
>Any thoughts...
>
>Brian D. Frost
>

The scheduler runs under "System" account. This account does not have
network privileges.

Pradeep

All very nice and convenient, but just keep in mind:

If you let "J. Random User" (JRU) install software on his/her machine,
then you better be careful to make sure that "L. Powerful Administrator"
(LPA) never logs into that machine, because JRU could have installed a
password filter to steal LPA's password.

(JRU may not have even been aware that they installed the password
filter -- they might have been cruising the web and downloaded some
program that did the dirty deed...)

Paul
> ----------
> From: Allan Bourdius[SMTP:abourdiu@fore.com]
> Reply To: Allan Bourdius
> Sent: Wednesday, June 11, 1997 11:00 AM
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] Installing programs on NT Workstation
> 
> Assuming that you are in a NT domain environment, the easiest way to
> allow
> users the ability to have full or partial full control of their
> workstations is to use the "Administrators" or "Power Users" built-in
> local
> groups.
> 
> Placing the domainname\Domain Users group in the localmachine\Power
> Users
> group will give users most of the software and device loading
> functionality
> that they need.
> 
> If you put the domainname\Domain Users group in the
> localmachine\Administrators group, all domain users will have
> administrator
> right to the local workstation.
> 
> Alternatively, you can put individual domain user accounts in the
> local
> groups.
> 
> This works very well, and has solved a great deal of our problems...
> 
> Allan
> 
> 
> At 10:05 AM 6/11/97 -0500, Pradeep Tapadiya wrote:
> >>From: egb@austin.ibm.com
> >...
> >>
> >> Just to lessen my ignorance, why does a program need
> >> administrative rights to install? There must be a list of
> >> reasons, but I can't think of any good ones. Please educate
> >> me?
> >>
> >> Here is a short list of possible reasons:
> >> 1) Program needs a user id to operate under.
> >> 2) Program wants to install something in
> >> \winnt\system32 directory.
> >> (Why? won't the %LIB% path search the application's
> >> directory for the same library?)
> >> 3) Installation can't get past certain nodes in the
> >> registry due to incorrect ACL settings.
> >> 4) ... there are probably a number of other reasons.
> >>
> >> The only useful item in this list is #1. All the rest of the
> >> installation could be done as the newly created "ordinary"
> >> user. Am I missing something?
> >>
> >> Thanks.
> >> Ed
> >>
> >
> >5. Installing a service.
> >6. Modifying registry.
> >
> >Pradeep
> >pradeep@nuview.com
> >
> >
> >
> -------------------------------------------------------------------
> All new computing problems must be reported to the Help Desk.
> -------------------------------------------------------------------
> Allan Bourdius Help Desk: (412) 772-8700
> System Administrator (NT Servers) Direct: (412) 772-5807
> Information Systems & Services Main: (412) 772-6600
> FORE Systems, Inc. Fax: (412) 772-6500
> 174 Thorn Hill Road Email: abourdiu@fore.com
> Warrendale, PA 15086 URL: http://www.fore.com
> "At the FOREfront of ATM internetworking - The ATM Experts."
> Personal URL: http://www.geocities.com/CapitolHill/8260/
> 
Gomberg, Jeff wrote:
> 
> Which proxies are noticeably absent?
> 
> Jeff
The telnet proxy and the generic service passer most noticeably.
The real audio proxy is also not there (although the real audio
people are working on streaming there stuff through port 80/tcp).

It is designed to give people access to HTTP, FTP, and SMTP/POP,
and it will handle on site mail server or server at the ISP.

The only incoming connection allowed is SMTP. No Telnet, http,
ftp.
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
I keep a log of accesses of my web server and someone tried to connect to
ports 1351, 1352 and 1353. What are these ports? I cant find any
documentation of them.

Thank you!


Anyone have any feelings about the security implications of NetMeeting on 
a firewalled environment? We know that there is currently no way to proxy 
NetMeeting session on TIS Gauntlet, because it uses both TCP and UDP 
packets with dynamic addressing. So, it's not feasible as an 
internal-to-external technology.

But, anyone heard or know of any substantive security risks using it as 
an internal-only or external-only program??

The only ones seemingly saying anything about NetMeeting seems to be 
Microsoft. I'd like to hear from any third-parties, too... :)

Thanks.
Bill

==============================================================================
 Bill Casti, CQA Email: bill@casti.com
 Pager: +1 800 604 6149 Fax: 703 834 8209
==============================================================================


On Jun 10, Bill Kastner wrote:
> Try WarFTPD. I've found it one of the best FTP Servers available, and it's
> shareware. The authors site is www.jgaa.com

Freeware, I think. It looks very feature-rich, and since this is the
nt_security_ list, you'd want to consider that and the associated
code complexity.

-- 
Ng Pheng Siong * Pacific Internet Pte Ltd * Singapore
PGP: send mail with subject "send pgp key" * http://darkwing.pacific.net.sg

Fast. Secure. Cheap. Pick two.
I believe that the ultimate tool for registry monitoring is NTREGMON,
written by two NT wizards (Russinovich and Cogswell). You can find it at
their site, NTInternals http://www.ntinternals.com The distribution is
freeware and is complete with the C language source code for the application
and a device driver.
It offers a powerful filter utility, and it can capture and save every
operation on the registry.
BTW, there is also a monitor for the file system activites as well as a real
powerful tool for disaster recovery.

Massimo Cesaro

=======================================================
Research & Development Windows NT Lead Developer
NECSY
Network Control System s.p.a.
Via Lisbona, 29 35127 Padova - ITALY
Tel. 8291511 (PBX)
 8291629 (Direct)
 email: ces@necsy.it
=======================================================


>----------
>From: Ziv Dascalu[SMTP:ziv@AbirNet.com]
>Sent: mercoledi 11 giugno 1997 18.49
>To: Jonn Martell; Mark Hellel; Steve Toomey
>Cc: ntsecurity@iss.net
>Subject: Re: Re[2]: [NTSEC] Tool for monitoring changes in NT 
>
>take a look at the Win-eXpose-Registry SHAREWARE 
>you can download it from http://www.shetef.com
>enjoy
>Ziv
>--- On Mon, 2 Jun 1997 09:21:16 -0500 Mark Hellel 
>wrote:
>> 
>> 
>> There are a couple of tools already out there that do this. Have a look
>at 
>> regmon from O'reilly associates and have a look at sunbelt tools INC who
>do a 
>> lot of third party utils.
>> 
>> 
>> 
>> Marky_Mark
>> 
>> You can lead a horse to water but a pencil must be lead!
>> ______________________________ Reply Separator
>_________________________________
>> Subject: Re: [NTSEC] Tool for monitoring changes in NT
>> Author: Steve Toomey at Internet
>> Date: 02/06/97 08:25
>> 
>> 
>> You can use SYSDIFF (res kit) or 3rd party tools like Wininstall to take 
>> snapshots of a registry and compare them 
>> 
>> Steve
>> 
>> 
>> Jonn Martell wrote:
>> > 
>> > We are looking for a tool to monitor any changes done to the registry
>and 
>> > to certain (system) directories.
>> > 
>> > We've looked for some time but can't find a good tool that can do this 
>> > simple task. Without such a tool, administering NT properly in almost 
>> > impossible.
>> > 
>> > One of the basic fundamentals in security is to monitor changes. One
>needs 
>> > to easy find out when some registry keys have been changed and how. 
>It's 
>> > also important to know when certain files have been changed (through
>CRC
>> > check?). It would be even nicer if the tool could monitor the file
>system 
>> > changes as they happen and perform a file backup to a special mirror
>> > directory (but I'll stop dreaming...). 
>> > 
>> > Having to reinstall NT because an SP failed is a joke - a good tool
>should 
>> > be able to "perform an SP uninstall" and protect from other
>"trojan-like" 
>> > nightmares :-)
>> > 
>> > If you know of any product, please email me directly and I'll summarize
>to 
>> > this list in 7 days.
>> > 
>> > .................................................................. 
>> > Jonn Martell, Network Analyst
>> > University of British Columbia
>> > "The more I work with NT, the more I like [the other system]...."
>> 
>> -- 
>> ----------------------------------------------------------------------- 
>> Steve Toomey | Internet Address : toomeys@dircon.co.uk 
>> London, UK | Home page :
>> Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys 
>> -----------------------------------------------------------------------
>
>---------------End of Original Message-----------------
>
>
> 
>/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\
> | A B I R N E T Active Network Protection 
>| 
> 
>\~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~/
> \========== Get an EVALUATION COPY at 
>===========/
>
>
>> You might want to try to accomplish this with the SU.EXE -program
>>included in the NT Resource Kit. It is similar to unix SU-programs and
>>it gives temporary administrator priviledges.
> No, it does not give the user temporary administrator privileges, because
> inorder to use SU.EXE the user must actually have more privileges
> (SE_TCB_NAME) than the standard administrator account! I believe there is a

 Oops... noticed that immediately after sending the mail. But never the
less SU.EXE would do it!-) By the way, what does the
SeIncreaseQuotaPrivilege actually mean?

> SU implementation out there that uses a service to encapsulate the
> extensive privileges that are necessary to logon a user. The actaul command
> run by the user feeds the username and password to the service by some IPC
> mechanism and the service gets a token for the target user. This is a much

 And the service is run with SYSTEM privileges? Sounds excellent. Which
brings me to another point: the VDESK-program in the reskit allows up to
ten users to have their programs run on the same computer, on different
desktops. 
I have three questions, how ever:
 1) Any security problems around with VDESK? (Not too good an idea to
share
 workstations this way, I know.)

*** WARNING NON-SECURITY ISSUE COMING ***

 2) When user A is logged on and desktop 2 is switched on, user B
"logs"
 on and tries to start a program, they usually exit with different
error
 levels; EXPLORER, for example, cannot run if B is not the same as
A. Is
 there any way to fix this?
 3) If I lock the workstation, it is always locked by the first user
who has
 logged on (i.e. user A), not the user who "owns" the current
desktop.
 Can this be fixed?

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------

Hello all,

Running NT 4.0 - we want to close certain applications *as* or in the process of
starting a password-locked screen-saver process.

To explain further - as a user leaves his/her desktop unattended, we want the
workstation to activate its screensaver in (say) 30 minutes time, and at that
time we want a couple of processes (if running) to close (be it graceful or
not), and hence make the license for that software available to others.

We have found the autologout add-on, which logs a person out when a screen-saver
activates, but that action is a little too much...

Any help from people appreciated!

Many thanks,

Warwick Ravaillion
Ord Minnett Group Ltd (Australia)

(wravail@pop.ords.com.au)

Greetings,

I can not change password from windows95 clients. The clients are logged on
a NT server 4.0 SP3 which is the PDC. I try control pannel, passwords,
change other passwords, microsoft networking and I get Access has been denied.

I looked at Technet but had no success.

Can anybody suggest me how to change passwords from win95 clients.

thanks in advance,

------------------------------------------
+ Rezart Andoni / Network Administrator /
+ Open Internet Center / OSF Albania /
+ tel: +355 42 27731 /
+ tel: +355 42 35088 - - - - 223 /
+ Fax: +355 42 30506 /
+ mailto:rezi@oic.soros.al /
+ http://www.soros.al /
--------------------------------
There are two reasons for this. 

The first is that the admin policies in User Administrator for Domains
have "user must log on to change password", the workaround is to
deselect this option in the policies menu.

The second reason is that there is a Novell client as well as the NT
client. The Novell and MS Networking logon name must be the same. The
workaround is to use the net command on the command line to change the
password.

To get these articles from TechNet, type the error message exactly as
seen from the client into TechNet with quotes (") around the error
message.

Andrew van der Stock (03) 9342 8278
Information Services mailto:andrew.vanderstock@whcn.org.au
Western Health Care Network GPO Box 341C Melbourne 3001


 -----Original Message-----
 From: Rezart Andoni [SMTP:rezi@cc.soros.al]
 Sent: Thursday, June 12, 1997 7:00 PM
 To: ntsecurity@iss.net
 Subject: [NTSEC] Changing password

 Greetings,

 I can not change password from windows95 clients. The clients
are logged on
 a NT server 4.0 SP3 which is the PDC. I try control pannel,
passwords,
 change other passwords, microsoft networking and I get Access
has been denied.

 I looked at Technet but had no success.

 Can anybody suggest me how to change passwords from win95
clients.

 thanks in advance,

 ------------------------------------------
 + Rezart Andoni / Network Administrator /
 + Open Internet Center / OSF Albania /
 + tel: +355 42 27731 /
 + tel: +355 42 35088 - - - - 223 /
 + Fax: +355 42 30506 /
 + mailto:rezi@oic.soros.al /
 + http://www.soros.al /
 --------------------------------
I would definitely say, *do not* use this product as a external product. As soon as you let a session attach to your workstation the external user has your rights on your box. We are however, looking at this product to do some limited remote administration (i.e. Task Mgr.), the price is right for the product. 
-
Rick Bertoncin
Server Development Group
Ford System Integration Center
rbertonc@ford.com


-----Original Message-----
From: Bill Casti, CQA [SMTP:quire@casti.com]
Sent: Wednesday, June 11, 1997 10:26 PM
To: NT Security List
Subject: [NTSEC] re: NetMeeting


Anyone have any feelings about the security implications of NetMeeting on 
a firewalled environment? We know that there is currently no way to proxy 
NetMeeting session on TIS Gauntlet, because it uses both TCP and UDP 
packets with dynamic addressing. So, it's not feasible as an 
internal-to-external technology.

But, anyone heard or know of any substantive security risks using it as 
an internal-only or external-only program??

The only ones seemingly saying anything about NetMeeting seems to be 
Microsoft. I'd like to hear from any third-parties, too... :)

Thanks.
Bill

==============================================================================
 Bill Casti, CQA Email: bill@casti.com
 Pager: +1 800 604 6149 Fax: 703 834 8209
==============================================================================


Agreed. Wholeheartedly! Been there, seen that and suffered from those
who've done it. Our 'power user' group includes software development
engineers and 'professionally' qualified people. It's an undisciplined,
possibly lazy, way to discharge any networking / security
responsibilities we may have. 
I.T. cannot and should not IMHO, loosen up their approach to software /
hardware issues and standards and practices. Already a lot of
credibility has been lost through treating software systems and their
installation / control as something like adding a plug to a household
appliance. 
Microsoft and other desktop type system suppliers have done great work
in moving computing power to the user, but have also have created a
problem insofar as we spend more time and Money, company wide, on
teaching people to use this software, than on training for the job they
do. We also lose focus on the degree to which I.T. staff are trained as
well as the breadth that the training should have. Compared with 'old
mainframe' days, we have replaced the 'expensive' systems programmer
type with thousands of cheaper people, who cost hundred times more! The
company that moved towards PC based information systems in a NOS
environment has changed it's spending pattern, rather than save money or
increase job specific productivity! 
Integration of user / computer is a vexed issue made uglier by handing
over to the user that which should be handled within I.T.

Regards
Kevin Sizer
Information Security

> ----------
> From: Paul Leach[SMTP:paulle@microsoft.com]
> Reply To: Paul Leach
> Sent: Wednesday, June 11, 1997 11:37 PM
> To: ntsecurity@iss.net; 'Allan Bourdius'
> Subject: RE: [NTSEC] Installing programs on NT Workstation
> 
> All very nice and convenient, but just keep in mind:
> 
> If you let "J. Random User" (JRU) install software on his/her machine,
> then you better be careful to make sure that "L. Powerful
> Administrator"
> (LPA) never logs into that machine, because JRU could have installed a
> password filter to steal LPA's password.
> 
> (JRU may not have even been aware that they installed the password
> filter -- they might have been cruising the web and downloaded some
> program that did the dirty deed...)
> 
> Paul
> > ----------
> > From: Allan Bourdius[SMTP:abourdiu@fore.com]
> > Reply To: Allan Bourdius
> > Sent: Wednesday, June 11, 1997 11:00 AM
> > To: ntsecurity@iss.net
> > Subject: Re: [NTSEC] Installing programs on NT Workstation
> > 
> > Assuming that you are in a NT domain environment, the easiest way to
> > allow
> > users the ability to have full or partial full control of their
> > workstations is to use the "Administrators" or "Power Users"
> built-in
> > local
> > groups.
> > 
> > Placing the domainname\Domain Users group in the localmachine\Power
> > Users
> > group will give users most of the software and device loading
> > functionality
> > that they need.
> > 
> > If you put the domainname\Domain Users group in the
> > localmachine\Administrators group, all domain users will have
> > administrator
> > right to the local workstation.
> > 
> > Alternatively, you can put individual domain user accounts in the
> > local
> > groups.
> > 
> > This works very well, and has solved a great deal of our problems...
> > 
> > Allan
> > 
> > 
> > At 10:05 AM 6/11/97 -0500, Pradeep Tapadiya wrote:
> > >>From: egb@austin.ibm.com
> > >...
> > >>
> > >> Just to lessen my ignorance, why does a program need
> > >> administrative rights to install? There must be a list of
> > >> reasons, but I can't think of any good ones. Please educate
> > >> me?
> > >>
> > >> Here is a short list of possible reasons:
> > >> 1) Program needs a user id to operate under.
> > >> 2) Program wants to install something in
> > >> \winnt\system32 directory.
> > >> (Why? won't the %LIB% path search the application's
> > >> directory for the same library?)
> > >> 3) Installation can't get past certain nodes in the
> > >> registry due to incorrect ACL settings.
> > >> 4) ... there are probably a number of other reasons.
> > >>
> > >> The only useful item in this list is #1. All the rest of the
> > >> installation could be done as the newly created "ordinary"
> > >> user. Am I missing something?
> > >>
> > >> Thanks.
> > >> Ed
> > >>
> > >
> > >5. Installing a service.
> > >6. Modifying registry.
> > >
> > >Pradeep
> > >pradeep@nuview.com
> > >
> > >
> > >
> > -------------------------------------------------------------------
> > All new computing problems must be reported to the Help Desk.
> > -------------------------------------------------------------------
> > Allan Bourdius Help Desk: (412) 772-8700
> > System Administrator (NT Servers) Direct: (412) 772-5807
> > Information Systems & Services Main: (412) 772-6600
> > FORE Systems, Inc. Fax: (412) 772-6500
> > 174 Thorn Hill Road Email: abourdiu@fore.com
> > Warrendale, PA 15086 URL:
> http://www.fore.com
> > "At the FOREfront of ATM internetworking - The ATM Experts."
> > Personal URL: http://www.geocities.com/CapitolHill/8260/
> > 
> 
-----BEGIN PGP SIGNED MESSAGE-----

On 11 Jun 97 at 16:11, Pradeep Tapadiya wrote about: [NTSEC] Shutting
down users with AT

> >I am still trying to use the AT scheduler to do remote shutdowns on
> >NT machines across the network. I am the domain admin and also have
> >start the scheduler as myself. Whenever I run my shutdown.exe
> >routine from the scheduler, I get an access denied, though I can
> >run it from the command line.
> >
> >Any thoughts...
> 
> The scheduler runs under "System" account. This account does not
> have network privileges.


In other words, configure the Scheduler service to run under a user
account (I usually create a user called 'SchedulerAcct'). Give him
enough permission to shut down remote servers.


Regards,
Frank




-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM5/nZ8ZP3ocmY5AlAQH6YQP8CrjIMRXZ4iM9kkeitk9EpOZONxdEQEs6
y5kgrUhFImDYEO1RknA7MNNRSaeP4iiGedgdiiesLNSIaToHDBIMWLKIfcF3ajW8
Q/QAUnuR8y6b/DQb+3fStZzLrNgcLaufsWyJYMhb62MTm7IAJKjhxVYegKPENcIs
xWcD30PFwf8=
=YBU3
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
On Tue, 10 Jun 1997 23:06:45 +0200, you wrote:

>
>I heard from someone here that the OOB can be reproduced with 257 byte
>packets. The Win95 PC would immediately reboot instead of giving a BSOD.
Stupid question: Does 0.95 have a 'real' BSOD?? As far as I could
figure out, OOB-data (or better urgent data :)) only caused an
exception in the sockets dll but the system as it was still up...

just curious - Dietz

-- 

 Dietz Proepper, [Software|Web] Designer, S.E.P.P. MED
 AKA tik on IRC, bladerunner on netrek, 
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. Neither S.E.P.P. MED nor heaven 
+ or hell shall be made responsible.
On Thu, 12 Jun 1997 17:26:11 +1000, you wrote:

>
>Hello all,
>
>Running NT 4.0 - we want to close certain applications *as* or in the process of
>starting a password-locked screen-saver process.
>
>To explain further - as a user leaves his/her desktop unattended, we want the
>workstation to activate its screensaver in (say) 30 minutes time, and at that
>time we want a couple of processes (if running) to close (be it graceful or
>not), and hence make the license for that software available to others.
One could quite easily build a screen saver that does the requested...

>
>We have found the autologout add-on, which logs a person out when a screen-saver
>activates, but that action is a little too much...
Hmm - you shot their programs - therefore unsaved data or stuff is 
already lost. Auto-logging them out won't increase the damage done
already...
>
>Any help from people appreciated!
just my 0.01$ opinion...


cu


-- 

 Dietz Proepper, [Software|Web] Designer, S.E.P.P. MED
 AKA tik on IRC, bladerunner on netrek, 
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. Neither S.E.P.P. MED nor heaven 
+ or hell shall be made responsible.
>From the list of well know ports:

equationbuilder 1351/tcp Digital Tool Works (MIT)
equationbuilder 1351/udp Digital Tool Works (MIT)
# Terrence J. Talbot 
lotusnote 1352/tcp Lotus Note
lotusnote 1352/udp Lotus Note
# Greg Pflaum 
relief 1353/tcp Relief Consulting
relief 1353/udp Relief Consulting
# John Feiler 

tim

----------
From: Charles Deling
Sent: Wednesday, June 11, 1997 8:33 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Strange port numbers

I keep a log of accesses of my web server and someone tried to connect to
ports 1351, 1352 and 1353. What are these ports? I cant find any
documentation of them.

Thank you!


On Thu, Jun 12, 1997 at 12:35:46PM +0000, Dietz Proepper wrote:
> On Tue, 10 Jun 1997 23:06:45 +0200, you wrote:
> >I heard from someone here that the OOB can be reproduced with 257 byte
> >packets. The Win95 PC would immediately reboot instead of giving a BSOD.
> >
> Stupid question: Does 0.95 have a 'real' BSOD?? As far as I could
> figure out, OOB-data (or better urgent data :)) only caused an
> exception in the sockets dll but the system as it was still up...

 I don't quite agree, on all systems I've tried, despite the fact that the 
machine recovered from the "blue screen", it became so unstable that after a
couple of mouse clicks you couldn't even make [CTRL+ALT+DEL] to reboot, I don't
think this is just an exception on the "sockets dll", probably it took with it
a lot more... the Microsoft Way... "blow one program and take 3 for free!!"

-- 
Nuno Leitao (leitao@convex.pt)
Convex Informatica e Sistemas de Comunicacoes Portugal, Lda.
Tel.: +351 1 422 10 40, Fax.: +351 1 421 37 87
Charles Deling wrote:
> 
> I keep a log of accesses of my web server and someone tried to connect to
> ports 1351, 1352 and 1353. What are these ports? I cant find any
> documentation of them.
> 
> Thank you!

ESM, a security audit tool by Axent Technologies uses these ports when
the agents communicate with the security manager. If you or your
company has run this lately, you may have received a hit or two from
this product.

Just a thought.

Pat Hayden
> 
> All very nice and convenient, but just keep in mind:
> 
> If you let "J. Random User" (JRU) install software on his/her machine,
> then you better be careful to make sure that "L. Powerful Administrator"
> (LPA) never logs into that machine, because JRU could have installed a
> password filter to steal LPA's password.
> 
> (JRU may not have even been aware that they installed the password
> filter -- they might have been cruising the web and downloaded some
> program that did the dirty deed...)
> 
> Paul

Ture. And frightening. The point is that once a malicious program runs
in an administrative session there are (at last count) 19,367 ways it
can completely subvert that computer's and perhaps the network's
security (can you say "session hijacking"). PASSFILT is certainly one of
the easier ways to do so. This is not, BTW, an indictment of Windows NT.
It's as security-sound as any commercial operating is likely to be in
our lifetimes. The problem is that it's very, very easy to download a
Trojan Horse in today's seamless, transparent, world-wide-webbed
community. Without a "sandbox" for the horse's activities, these kinds
of attacks are "easy pickin's."

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/

> -----Original Message-----
> From: Sizer, Kevin [SMTP:KevinS@Siemens.co.za]
> Sent: Thursday, June 12, 1997 7:24 AM
> To: Paul Leach
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Installing programs on NT Workstation
> 
> I'm not posting about technical issues of system administration, but
> the social issues. In many senses, they're just as important.
> 
> >I.T. cannot and should not IMHO, loosen up their approach to software
> /
> >hardware issues and standards and practices. Already a lot of
> >credibility has been lost through treating software systems and their
> >installation / control as something like adding a plug to a household
> >appliance. 
> Actually, it's been my experience that I.S. departments have lost
> credibility by acting fascist, incompetent, and aloof. Focusing on
> control and ease of administration at the expense of users being able
> to get their work done will just alienate the users, and they'll go
> behind your back to do what they want.
> Don't forget that one of the reasons that many people went to using
> PCs was that they controlled them, and that way they didn't have to
> go through I.S.
> 
> >Compared with 'old
> >mainframe' days, we have replaced the 'expensive' systems programmer
> >type with thousands of cheaper people, who cost hundred times more!
> The
> >company that moved towards PC based information systems in a NOS
> >environment has changed it's spending pattern, rather than save money
> or
> >increase job specific productivity! 
> You're comparing apples to oranges. In the "Old Mainframe" days,
> only
> a limited number of people were in direct contact with the computers,
> the machines were simpler in terms of both hardware and software,
> and much less was asked of them. Also, the people who did use them
> had to be specially trained to use them.
> Now, you have a much larger user base using their computers for
> many more tasks. As for whether or not using PCs has saved money
> or increased productivity, I'd have to say that while going to PCs
> by itself doesn't save money, or increase productivity, but it does
> provide the flexibility to do so.
> 
> >Integration of user / computer is a vexed issue made uglier by
> handing
> >over to the user that which should be handled within I.T.
> Only if I.S. is capable of doing the job reliably. Many aren't.
> Here's
> some fun stories:
> At a previous job, I was on a team developing software for Sun
> workstations. One day, an IS person trashed the passwd file
> on our server, so none of us could save any work. Our lead
> logged onto THEIR server, and ran a "dumb" password cracker
> against their passwd file. It had several hits.
> The IS department at one of our clients recently decreed that
> everyone would run their displays at 800x600. We work with
> people who spend all day looking at scanned documents on
> 21" monitors. After several months, they managed to get special
> permission to run at 1600x1200, but they had to keep the door
> to their area closed, and not let people in.
> The same company also bought a modem bank so people could
> dial in and do work from home. That's a security risk, though, so
> nobody's actually allowed to dial into the modems. Connecting from
> the T1 line in the home office is fine. So, they make a long distance
> call to the modem bank at the home office, and telnet to the local
> machines.
> Another client purchases his computers through us. We're both
> cheaper and faster than going through I.S. (We're buying them
> Gateway PCs.)
> Finally, we got a call from another client who lost all the data in
> a Paradox program that we wrote. I.S. had just upgraded his operating
> system. They did this by wiping his disk and doing a new installation
> of the OS. They had asked him what he wanted to keep, and he had
> told them that he wanted to keep that program. Rather than back up
> and restore HIS database, they just copied the program from someone
> else's machine.
> A former coworker once had to maintain some programs that ran on
> a computer that contained classified data. He didn't have the
> clearance
> to see the data, or work in the building that the machine was in. One
> day, one of the programs stopped working. It took him over a week
> to even find out what the error message was. 
> 
> I am a programmer, and I do not use the software that I write. Sure,
> I test my code, and can do demonstrations, and what have you, but
> I'm not the target audience for my software. Fortunately, we have
> people on the team who understand the users, and we listen to them.
> Sometimes we make the changes they want, sometimes we don't, but
> we listen. There are a lot of people in I.T. who don't. It's real easy
> to
> concentrate on security and maintainability, and utterly alienate your
> user base. This can be just as bad, if not worse as 
> letting the users have free reign on their machines.
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
At 14:37 6/11/97 -0700, Paul Leach wrote:
>All very nice and convenient, but just keep in mind:
>
>If you let "J. Random User" (JRU) install software on his/her machine,
>then you better be careful to make sure that "L. Powerful Administrator"
>(LPA) never logs into that machine, because JRU could have installed a
>password filter to steal LPA's password.
>
>(JRU may not have even been aware that they installed the password
>filter -- they might have been cruising the web and downloaded some
>program that did the dirty deed...)

Lots of other chaos can ensue - for one thing, you guys slipped up and made
%systemroot% everyone:F by default. \program files is also everyone:F by
default, which means that virtually anything could be a trojan.

If you set the permissions as detailed in the security document on the
www.microsoft.com/security page, this problem is almost completely removed.

Another strategy is to allow the local user to be a Power User, and raise
their permissions as need be - you can then allow them to do what they need
without losing complete control over the system. If you allow the local
user access to a local admin account, anything can happen.

Also, as I'm sure you're aware, you have to be admin level to write the LSA
key, so only an admin could slip a password filter in on you (assuming
you're at SP3, or have removed the FPNWCLNT value - else anyone could do this).

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 09:41 6/11/97 -0500, John P. Rome wrote:
>Does anyone have NT Security Policies written they would be willing to
>share? Additionally, has someone documented the standard file security
>used for servers?

The best thing to do with a server is to create a partition for the OS only.
You then do not share any part of that partition, so it is accessible to
admins only. If space is a problem, you might want to redirect the print
spool elsewhere.

Then create as many data partitions as you like, and after it is formatted,
set it to admin full control only. As you create directories and share
them, add the appropriate permissions.

If you leave the web stuff out of it, servers are really easier to secure
than workstations. BTW, default permissions on a share is everyone:F -
don't leave it that way.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Although it's a little pedantic, JRU wouldn't get the domain admin
password with a hostile password filter on the workstation - it
(alledgedly) must be installed on the domain controller.

There are many other suitable techniques however, and at the very
least JRU could certainly wipe out every workstation in the domain 
with ease. Even if you ignore the security aspects, those pesky 
users will only go round accidentally breaking everything.

If you really have no other option but to give certain users admin
rights on their boxes, then you could set up a local admin account 
for them *without* domain rights. However, first get them to sign in
triplicate (and blood) that they will only login with this account
for software installation etc. and that afterwards, they will
immediately logout and revert to using their domain account.

Finally, what did people do with GUI software developers in the days 
of 3.5x i.e. people with entirely convincing reasons for changing 
their screen resolutions every five minutes?

Regards,

--Alan--
acr@als.co.uk

>On 11 Jun 97 at 14:37, Paul Leach wrote:
>
> All very nice and convenient, but just keep in mind:
> 
> If you let "J. Random User" (JRU) install software on his/her machine,
> then you better be careful to make sure that "L. Powerful Administrator"
> (LPA) never logs into that machine, because JRU could have installed a
> password filter to steal LPA's password.
> 
> (JRU may not have even been aware that they installed the password
> filter -- they might have been cruising the web and downloaded some
> program that did the dirty deed...)
You're right, a password filter wouldn't do it -- you'd need to install
a GINA.

> ----------
> From: acr@als.co.uk[SMTP:acr@als.co.uk]
> Reply To: acr@als.co.uk
> Sent: Thursday, June 12, 1997 1:00 PM
> To: ntsecurity@iss.net
> Cc: Paul Leach
> Subject: RE: [NTSEC] Installing programs on NT Workstation
> 
> Although it's a little pedantic, JRU wouldn't get the domain admin
> password with a hostile password filter on the workstation - it
> (alledgedly) must be installed on the domain controller.
> 
> There are many other suitable techniques however, and at the very
> least JRU could certainly wipe out every workstation in the domain 
> with ease. Even if you ignore the security aspects, those pesky 
> users will only go round accidentally breaking everything.
> 
> If you really have no other option but to give certain users admin
> rights on their boxes, then you could set up a local admin account 
> for them *without* domain rights. However, first get them to sign in
> triplicate (and blood) that they will only login with this account
> for software installation etc. and that afterwards, they will
> immediately logout and revert to using their domain account.
> 
> Finally, what did people do with GUI software developers in the days 
> of 3.5x i.e. people with entirely convincing reasons for changing 
> their screen resolutions every five minutes?
> 
> Regards,
> 
> --Alan--
> acr@als.co.uk
> 
> >On 11 Jun 97 at 14:37, Paul Leach wrote:
> >
> > All very nice and convenient, but just keep in mind:
> > 
> > If you let "J. Random User" (JRU) install software on his/her
> machine,
> > then you better be careful to make sure that "L. Powerful
> Administrator"
> > (LPA) never logs into that machine, because JRU could have installed
> a
> > password filter to steal LPA's password.
> > 
> > (JRU may not have even been aware that they installed the password
> > filter -- they might have been cruising the web and downloaded some
> > program that did the dirty deed...)
> 
First you can start the service with the administrator account, 
and you must choose in the box for the schedule service "log on as System
account",
so you can use AT command in the dos window.

Gossiaux O.

At 10:05 AM 6/11/97 -0500, you wrote:
>
>I am still trying to use the AT scheduler to do remote shutdowns on NT
>machines across the network. I am the domain admin and also have start the
>scheduler as myself. Whenever I run my shutdown.exe routine from the
>scheduler, I get an access denied, though I can run it from the command
>line.
>
>Any thoughts...
>
>Brian D. Frost
>
>
>
>
Steve Sutton writes:
> Ture. And frightening. The point is that once a malicious program runs
> in an administrative session there are (at last count) 19,367 ways it
> can completely subvert that computer's and perhaps the network's
> security (can you say "session hijacking"). PASSFILT is certainly one of
> the easier ways to do so. This is not, BTW, an indictment of Windows NT.
> It's as security-sound as any commercial operating is likely to be in
> our lifetimes. The problem is that it's very, very easy to download a
> Trojan Horse in today's seamless, transparent, world-wide-webbed
> community. Without a "sandbox" for the horse's activities, these kinds
> of attacks are "easy pickin's."

This should be an indictment of Windows NT. (Yes, this is an flame).
It's ridiculous to require administrator priviliges for most software
installs. This, AFAIK, is brought about by the apparent preference in 
the Windows world for leaving droppings everywhere. There is no
reason why programs shouldn't be able to put themselves in a single
(user-defined) directory. This would allow Joe User to install his
own programs in his home directory, as himself, without having any of
these security concerns.


-- 
The difference between a bug and | 
a feature is documentation. | Matt Simmons
 -- Ben Duncan | simmonmt@acm.org
 bend@ali.intop.net |




Does anyone use Crystal Reports from the resource kit for their Events?
If so, please contact me offline at (713)627-6117.

Thanks.


>From http://cnnfn.com/digitaljam/9706/12/netscape_pkg/

NEW YORK (CNNfn) - A serious new flaw that affects all versions of
Netscape Communications Corp.'s popular Navigator Internet browser
software -- including the final test version of its Communicator Suite
released Wednesday -- has been uncovered by a Danish software firm,
CNNfn has learned. 

The bug was reported by Cabocomm, a software company located about 100 
miles west of Copenhagen, Denmark. The bug makes it possible for Web-
site operators to read anything stored on the hard drive of a PC logged
on to the Web site.

After the firm reported the bug to CNN Financial News, CNNfn and PC
Magazine tested the bug by creating and storing a document on a PC's
hard drive in New York. Seconds later, the Danish company read it. 

As further proof, CNNfn and PC Magazine created another document which
the Danish company was also able to read.

[snip]

-- 
Andrew Purtell phone: (617) 272-9700
Network Administrator fax : (617) 272-9300
Intelligent Environments email: apurtell@ieinc.com
Burlington, MA 01803 USA akp@tiac.net
I hadn't seen this on the list as yet, so I thought I'd forward it on.
I've done little research on it as yet (sorry!) and the article mentions
little of the details of the break.

It seems that a website operator can use the netscape browser to obtain
files on the client (browsing) system. The interesting detail is that
in order to retrieve the file, one needs to know the name of the file on
that remote system. I wonder if it could be a variant of the IE bug
that had similar behaviour?

Anyway, I don't think it's cross-platform; unfortunately, the article
does not mention this explicitly. By implication[1], it would seem to
attack Windows based machines.

The URL and a portion of the article is below.

Mike



[1]everything refers to PC's, which to most
folks means Wintel boxes- I run Debian Linux 
on mine! And I'm sure there's a few SolarisX86's 
out there. Some people concider the 
Macintosh to be a personal computer too! Sorry,
just a favorite rant of mine.


http://cnnfn.com/digitaljam/9706/12/netscape_pkg/

Netscape bug uncovered 

Danish software firm finds flaw that
could let sites see data stored on PCs 

>From Correspondent Steve Young
June 12, 1997: AUTOPOSTTIME

Netscape 
NEW YORK (CNNfn) - A serious new flaw that
affects all versions of Netscape Communications
Corp.'s popular Navigator Internet browser
software -- including the final test version of its
Communicator Suite released Wednesday -- has
been uncovered by a Danish software firm, CNNfn
has learned. 

We have some computers showing 99-100% CPU utilization on the RPC
service again. These are NT 4.0 w/ Service Pack 3. Anyone know of any
new exploits on this? I haven't heard of anything.

Jason Nash
U.S. Postal Service

We are having a bit of a problem. I work for a large 
bank and we are currently in the middle of an NT Rollout. We are using NT WS 4.0 
and NT Svr 4.0. Now, the problem we are having is limited to one 
location.

Some of the programs we use are 16-bit applications 
(as the 32-bit versions are currently under development). Now, in one location, 
we seem to have a second instance of NTVDM.EXE running when we take a look at 
the processes. There are no applications running under this, as they are all 
under the first instance of NTVDM.

Now, the problem is, this second instance of NTVDM is 
sucking up 98-100% of cpu time. It is causing system instability, as well as 
crashing the first instance of NTVDM occassionally.

Sameer Khosla - labtec@netcom.ca

I'm involved in evaluating the security of several networks. Being
experienced with UNIX, I have several FREE tools that I use to test a
range of IP addresses over the network. I have seen a few FREE tools for
NT, but they either run only on the machine that they reside or they have
a GUI interface that forces you to access each machine individually. Are
there FREE tools for doing some basic checks on NT boxes? Where can I
find them? I don't mind writing a little code to help automate the
process of using a tool, as long as it has a command line interface.

I already have port scanners and sniffers, so I'm not interested in these.

TIA

 __________________________________________________________________________
| Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
| Eagan McAllister Associates, Inc. |
| |
| "Everything must be working perfectly, cause I don't smell any smoke" |
 --------------------------------------------------------------------------

HI

These sound not very bad :-(

So how do I see if I have a hacked logon service ?!? or is it 
impossible :-(
...or does anyone know one of these www sides.
I im interested what is possible now on nt 4.0, I have to secure some 
NT Domains here :-) !

Tnx folks
Patrik

> All very nice and convenient, but just keep in mind:
>
> If you let "J. Random User" (JRU) install software on his/her 
machine,
> then you better be careful to make sure that "L. Powerful 
Administrator"
> (LPA) never logs into that machine, because JRU could have installed 
a
> password filter to steal LPA's password.
>
> (JRU may not have even been aware that they installed the password
> filter -- they might have been cruising the web and downloaded some
> program that did the dirty deed...)
>
> Paul

Ture. And frightening. The point is that once a malicious program 
runs
in an administrative session there are (at last count) 19,367 ways it
can completely subvert that computer's and perhaps the network's
security (can you say "session hijacking"). PASSFILT is certainly one 
of
the easier ways to do so. This is not, BTW, an indictment of Windows 
NT.
It's as security-sound as any commercial operating is likely to be in
our lifetimes. The problem is that it's very, very easy to download a
Trojan Horse in today's seamless, transparent, world-wide-webbed
community. Without a "sandbox" for the horse's activities, these 
kinds
of attacks are "easy pickin's."

--
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com
 WWW: http://www.TrustedSystems.com/

Do u looking for a policy security file for NT server ? what do like 
to do ?
I have a good book that explain the syntax about .adm files
ISBN 0-7897-0842-6

But, if u know how to add a "Binary" Registry entry by Policy let me 
know I think it is impossible :-(

Patrik


-----Original Message-----
From: David LeBlanc [SMTP:dleblanc@iss.net]
Sent: Donnerstag, 12. Juni 1997 18:54
To: John P. Rome; ntsecurity@iss.net
Subject: Re: [NTSEC] NT Security Policies and standard server 
securitysetup

At 09:41 6/11/97 -0500, John P. Rome wrote:
>Does anyone have NT Security Policies written they would be willing 
to
>share? Additionally, has someone documented the standard file 
security
>used for servers?

The best thing to do with a server is to create a partition for the OS 
only.
You then do not share any part of that partition, so it is accessible 
to
admins only. If space is a problem, you might want to redirect the 
print
spool elsewhere.

Then create as many data partitions as you like, and after it is 
formatted,
set it to admin full control only. As you create directories and 
share
them, add the appropriate permissions.

If you leave the web stuff out of it, servers are really easier to 
secure
than workstations. BTW, default permissions on a share is everyone:F 
-
don't leave it that way.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |



>-----Original Message-----
>From: van der Stock, Andrew J [SMTP:Andrew.vanderStock@whcn.org.au]
>Sent: Thursday, June 12, 1997 10:28 AM
>To: 'ntsecurity@iss.net'
>Cc: 'rezi@cc.soros.al'
>Subject: RE: [NTSEC] Changing password
>
>There are two reasons for this. 
>
>The first is that the admin policies in User Administrator for Domains
>have "user must log on to change password", the workaround is to
>deselect this option in the policies menu.
>
>
>[Kuba Rycombel] I think rather "user cannot change password" policy??? 
> 
>
>The second reason is that there is a Novell client as well as the NT
>client. The Novell and MS Networking logon name must be the same. The
>workaround is to use the net command on the command line to change the
>password.
>
>To get these articles from TechNet, type the error message exactly as
>seen from the client into TechNet with quotes (") around the error
>message.
>
>Andrew van der Stock (03) 9342 8278
>Information Services mailto:andrew.vanderstock@whcn.org.au
>Western Health Care Network GPO Box 341C Melbourne 3001
>
>
> -----Original Message-----
> From: Rezart Andoni [SMTP:rezi@cc.soros.al]
> Sent: Thursday, June 12, 1997 7:00 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Changing password
>
> Greetings,
>
> I can not change password from windows95 clients. The clients
>are logged on
> a NT server 4.0 SP3 which is the PDC. I try control pannel,
>passwords,
> change other passwords, microsoft networking and I get Access
>has been denied.
>
> I looked at Technet but had no success.
>
> Can anybody suggest me how to change passwords from win95
>clients.
>
> thanks in advance,
>
> ------------------------------------------
> + Rezart Andoni / Network Administrator /
> + Open Internet Center / OSF Albania /
> + tel: +355 42 27731 /
> + tel: +355 42 35088 - - - - 223 /
> + Fax: +355 42 30506 /
> + mailto:rezi@oic.soros.al /
> + http://www.soros.al /
> --------------------------------

I think it would have something to do with File Upload Netscape feature.
Report says it's affecting _all_ version of NN, and file upload is there
from 2.0, so I may be wrong.
I don't remember the exact stream of communication of file upload, but
there is moment, where server can say - "yes, I want you to send me the file
you offer me". Maybe it can be bypassed somehow to force remote computer
send file _server_ wants ?

Anyway, it seems it's affecting just Window boxes. There isn't any indication
it's cross-platform; the picture beside the text is titled "Site operators
can access data on PC". And as some1 already said, PC means Wintel
for most people (the ones not knowing about Unices running on i386 ;-)
Or maybe editors forgot Netscape isn't running just on PC ;-)

jd
-- 
Jaromir Dolecek ICS MU, Botanicka 68A, Brno, 60200, Czech Rep.
dolecek@ics.muni.cz Tel.: +42-5-4151 2266
http://www.ics.muni.cz/~dolecek/
-------------------------------------------------------------------------------
It is better never to have been born. But who among us has such luck?
One in a million, perhaps.
Does anyone know of any security concerns of running a NT 3.51 Citrix Server 
with NC's connecting to it?

Thanks
Mark
I think you are right in that there are a lot of manufacturers that
although they have ported their apps to be 32bit have not embrassed the
multiuserdesktop idea and tend to try and put things in the wrong place
on the PC and the registry. These leads to no end of problems when you
try to manage the environment. I think a lot of manufacturers are trying
to keep their 16 and 32 bit products in line which can't always be the
case.

As for allowing users to do their own installs etc I must admit that I
would be very careful about that as you cannot enure a production
bulletproof environment if the users can play too much. There is an
important balance to be made on this topic

Steve


Matt Simmons wrote:
> 
> Steve Sutton writes:
> > Ture. And frightening. The point is that once a malicious program runs
> > in an administrative session there are (at last count) 19,367 ways it
> > can completely subvert that computer's and perhaps the network's
> > security (can you say "session hijacking"). PASSFILT is certainly one of
> > the easier ways to do so. This is not, BTW, an indictment of Windows NT.
> > It's as security-sound as any commercial operating is likely to be in
> > our lifetimes. The problem is that it's very, very easy to download a
> > Trojan Horse in today's seamless, transparent, world-wide-webbed
> > community. Without a "sandbox" for the horse's activities, these kinds
> > of attacks are "easy pickin's."
> 
> This should be an indictment of Windows NT. (Yes, this is an flame).
> It's ridiculous to require administrator priviliges for most software
> installs. This, AFAIK, is brought about by the apparent preference in
> the Windows world for leaving droppings everywhere. There is no
> reason why programs shouldn't be able to put themselves in a single
> (user-defined) directory. This would allow Joe User to install his
> own programs in his home directory, as himself, without having any of
> these security concerns.
> 
> --
> The difference between a bug and |
> a feature is documentation. | Matt Simmons
> -- Ben Duncan | simmonmt@acm.org
> bend@ali.intop.net |

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
--------------------------------------------------------------------
> This should be an indictment of Windows NT. (Yes, this is an flame).
> reason why programs shouldn't be able to put themselves in a single
> (user-defined) directory. This would allow Joe User to install his
> own programs in his home directory, as himself, without having any of
> these security concerns.

 And what exactly does this have to do with NT? Nothing at all. It is
the program developers who develop programs that use static
directories, not NT (in that case at least). No program that is properly
coded should need to copy anything into %systemroot%\system32
-directory. If the setup program does not give you any control over this
(as they usually don't) it is most inconvenient and requires an admin to
install the program (assuming only admins can write to
%systemroot%\system32 and registry). Any program, how ever, should run
with its files (mainly dll's) in any directory IN THE PATH - in NT the
directory . is always in the path (I may be in error?) - unlike unixes -
thus by placing the dll's and executables in the same directory should
always work. As usual (in windows-world), there are some bad coders who
do not search the path for dll's or who use static directories for
references rather than environment variables and relative paths.

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
Hi,

I couldn't replicate this on my NT4WS with SP3 and no hotfixes. I get a
confirmation that the machine has accepted all bytes sent.

I've tried with 257 bytes and some other higher values.

/Jens

> -----Original Message-----
> From: Sander Goudswaard [SMTP:sander@lx.student.wau.nl]
> Sent: den 10 juni 1997 23:07
> To: ntsecurity@iss.net
> Subject: [NTSEC] OOB with 257byte packets
> 
> 
> I heard from someone here that the OOB can be reproduced with 257 byte
> packets. The Win95 PC would immediately reboot instead of giving a
> BSOD.
> 
> 
> I don't have a test case here, but if anyone has, I'd be interested in
> having a result on this issue.
> 
> Sander
> 
> ---
> Sander Goudswaard, the Netherlands
> mailto:sander@sander.com
> phone (work): +31 317 484053
> www: http://www.student.wau.nl/~sander/
> talk: sander@flex058.hhome.wau.nl or sander@flex167.iend.wau.nl
I saw the above topic on the list and remembered a curiosity I once
ran into: on a standalone 4.0 SP3+oobfix server I changed my password.
Then I tested some things (password sniffers on the net) with that
password and wanted to change it again to the original (not exposed to
the sniffers) one. System replies "the account password can not be
changed at this time". Things I have considered:
 "Minimum Password Age" = Immediately
 "Password Uniqueness" = Do not keep history
 "Must log on to change" = No (besides I am logged on)
Is there something else to consider or is this a "feature"? (I have NOT
logged off since!)

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
Hello All

i have recently setup a standalone NT3.51 Server as a Workgroup and
enabled RAS on the box. When i check the event log - security there are
no entries for either logging on at the console or from the RAS logon.

Can anyone expand on why this should be ? 
-- 
 \\\|///
 \\ - - //
 ( @ @ )
 ***********************oOOo-(_)-oOOo***********************
 * davec@powinv.co.uk - Compuserve : 100740.1113 * 
 * Power Innovations Ltd *
 * Tel : 01234 223121 _ Fax : 01234 223011 *
 ***************oooO****oOOo-( )-oOOo****Oooo***************
 ( ) ( @ @ ) ( )
 \ ( // - - \\ ) /
 \_) ///|\\\ (_/

[To: and CC: trimmed down.]

> From: Juha Jäykkä 
> Date: Friday 13 June 1997 11:33
> 
> > This should be an indictment of Windows NT. (Yes, this is an flame).
> > reason why programs shouldn't be able to put themselves in a single
> > (user-defined) directory.

They can, if they stick to standard, well established, old, APIs. The
problem with this is that they then tend to be very boring applications.
To make use of new enhanced system APIs, you have to either include the
right system modules in your install kit (and stick them in the system
directory which may need admin rights), or restrict the platforms you are
targetting (which will be unacceptable to most developers).

> > This would allow Joe User to install his
> > own programs in his home directory, as himself, without having any of
> > these security concerns.
> 
> And what exactly does this have to do with NT? Nothing at all. It is
> the program developers who develop programs that use static
> directories, not NT (in that case at least). No program that is
properly
> coded should need to copy anything into %systemroot%\system32
> -directory.

While this is true of application specific DLLs (and most applications do
keep these in their application specific install directory), the
situation is different for modules that provide system services, such as
OLE subsystem dlls, or enhanced libraries such as MFC42. You often can
not rely on these being present, or of the correct version, on all
machines that you (as a software developer) are targetting, and it is
inappropriate to put such code in the application directory. Indeed, in
some cases you need to be sure that only the one version is being used or
it just won't work properly.

This problem arises from the fact that the state of Windows system code
is so dynamic right now. UNIX libraries hardly ever change (apart from
minor bugfixes), whereas whole swathes of new code keep appearing in
Windows.

The same goes for modules such as OCX controls, or common libraries that,
although not system code as such, you expect to be shared between several
applications - these should be installed into a directory which normal
users do not have write access to.

There is one other reason why you need to write to system areas of the
filesystem and registry: you're installing a program that you want to be
available under several different logons, and placed in a Common group.
This clearly needs more access that a normal user to accomplish.

> If the setup program does not give you any control over this
> (as they usually don't) it is most inconvenient and requires an admin
to
> install the program (assuming only admins can write to
> %systemroot%\system32 and registry). Any program, how ever, should run
> with its files (mainly dll's) in any directory IN THE PATH - in NT the
> directory . is always in the path (I may be in error?) - unlike unixes
-

Yes. The DLL search path is: the loading module's (that is the module
that called LoadLibrary()) directory, the current directory, the system
directories, the path.

The ability to exclude '.' from the path can be a very important security
feature - it allows the admin to know exactly where the code he is
running is coming from (and to allow 'restricted shells' that do not
allow running of private code). There is nothing, of course, to stop you
adding the current directory to you own personal path under UNIX, however
most people add it at the end, rather than the beginning (as it
implicitly is under Windows). This means that to run a program in the
current directory that has the same name as a system binary, you have to
explicitly prepend './' to it's name. This makes it harder for trojans to
spoof system programs (under any user).

> thus by placing the dll's and executables in the same directory should
> always work.

Unless the DLLs play tricks with shared memory segment to get IPC
effects, or use some internal protocol for IPC such that different
versions in different directories will not be able to communicate with
each other and thus break. Such code should be in a common directory (be
is System32 or a more specific shared code location) to make mismatches
harder to achieve.

> As usual (in windows-world), there are some bad coders who
> do not search the path for dll's or who use static directories for
> references rather than environment variables and relative paths.

If you just supply the module name (not the full path), Windows takes
care of locating the module for you. This is Good(tm). It would take
really broken code to try and enforce the location of a dll in a specific
hard-coded directory.


John
-- 
remember i was always true; remember that i always tried 
remember i loved only you; remember me and smile... 
for it's better to forget than to remember me and cry
:-p

I need to add routes at startup or permanently for all users. I have 
created a batch file with the "route add" command, but this only works
if you have admin rights. BTW, this is a great group. I joined a few 
months ago & this is my 1st question. 8-)






If you want to add a route as perminent then there is a switch that you can
use "-p" within the route command. This will enable your desired routes to
be enabled when NT loads. The syntax is -> route add -p

Hope this helps,

Mitchell Hryckowian
mitchell@triumph.com






arturo@intac.com on 06/13/97 07:39:26 AM

Please respond to arturo@intac.com

To: ntsecurity@iss.net
cc: (bcc: Mitchell Hryckowian/Triumph)
Subject: [NTSEC] adding routes at startup or permanently




I need to add routes at startup or permanently for all users. I have
created a batch file with the "route add" command, but this only works
if you have admin rights. BTW, this is a great group. I joined a few
months ago & this is my 1st question. 8-)












Use the following command: "route -p add [network] mask [netmask]
[gateway]".
This will add a persistent route and will be stored in the registry. You
will not have to change these after the very first time you use them. Get
rid of the batch files after you do this. Good luck.






arturo@intac.com on 06/13/97 07:39:26 AM

Please respond to arturo@intac.com

To: ntsecurity@iss.net
cc: (bcc: Andy S Bolin/Mott)
Subject: [NTSEC] adding routes at startup or permanently




I need to add routes at startup or permanently for all users. I have
created a batch file with the "route add" command, but this only works
if you have admin rights. BTW, this is a great group. I joined a few
months ago & this is my 1st question. 8-)








I have been actively looking for some verification of this exploit. I'm not saying it doesn't exist. But it is very strange the way it was handled. If I were the paranoid type, I would be very concerned by the motivation behind the story. Why tell the press and not Netscape? If indeed it effects all previous versions, we have been very slow to catch it (too preoccupied with M$?). Is this how information of this nature will be handled in the future? It's great that security is finally getting some airtime, however, the media tend to create more problems then awareness. Your comments on this matter are requested.


Thanks,
Bryan K. Fite
www.secure-it.net


Dave,

On the server, start the User Manager for Domains.

Select Policies/Audit and make sure that auditing is not turned off. I
would recommend checking all the boxes in the "Failure" column and all
the ones in the "Success" column EXCEPT: "Use of User Rights" and
"Process Tracking".

You also MUST enable auditing at the file/directory level for those
files and/or directories that you wish to track.

Good luck!

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
drbivens@agst.com


-----Original Message-----
From: Dave Claypole [SMTP:davec@powinv.co.uk]
Sent: Friday, June 13, 1997 09:27
To: ntsecurity@iss.net
Subject: [NTSEC] Security log

Hello All

i have recently setup a standalone NT3.51 Server as a Workgroup and
enabled RAS on the box. When i check the event log - security there are
no entries for either logging on at the console or from the RAS logon.

Can anyone expand on why this should be ? 



What port scanners and sniffers do you have? Are they freeware? Where can
I get them? I deperately need them myself. Help, please.....

On Thu, 12 Jun 1997, Bryan Swann wrote:

> I'm involved in evaluating the security of several networks. Being
> experienced with UNIX, I have several FREE tools that I use to test a
> range of IP addresses over the network. I have seen a few FREE tools for
> NT, but they either run only on the machine that they reside or they have
> a GUI interface that forces you to access each machine individually. Are
> there FREE tools for doing some basic checks on NT boxes? Where can I
> find them? I don't mind writing a little code to help automate the
> process of using a tool, as long as it has a command line interface.
> 
> I already have port scanners and sniffers, so I'm not interested in these.
> 
> TIA
> 
> __________________________________________________________________________
> | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> | Eagan McAllister Associates, Inc. |
> | |
> | "Everything must be working perfectly, cause I don't smell any smoke" |
> --------------------------------------------------------------------------
> 

At 09:18 13/6/97 -0400, Bryan K. Fite wrote:
>I have been actively looking for some verification of this exploit. 
>I'm not saying it doesn't exist. But it is very strange the way it 
>was handled.

I was able to find links from the CNN home page http://cnn.com and
Netscape's home page... There seems to be something there worth looking
closer... how much remains to be seen. Here are the articles I found (URLs
may have a very short life)...

Netscape Security Update:
 http://home.netscape.com/misc/security_update.html

CNNfn: Netscape bug uncovered: Danish software firm finds flaw that could
let sites see data stored on PCs 
 http://cnnfn.com/digitaljam/9706/12/netscape_pkg/

PC Magazine Online: Netscape Security Flaw: A bug lets curious webmasters
read files from your hard disk when you surf with Navigator.
 http://www8.zdnet.com/pcmag/news/trends/t970612b.htm

The reports I've seen are that the Danish firm told Netscape they could
visit them on Monday to get the details for free, or compensate them
reasonably for the several weeks of work they've invested in investigating
the matter. If it is true that Netscape offered only their $1,000 bugs
bounty and a t-shirt, would you blame them for telling Netscape to take a
hike... all the way to their office on Monday?

/Harold

ps. It may be tradition that firms rush to market with often buggy
products, to maximize their profits, and their customers hassle with (and
pay for) the impact of the bugs. My heart goes out to anybody who says
"hey-wait a minute!"

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Harold A. Driscoll mailto:harold@driscoll.chi.il.us
#include http://homepage.interaccess.com/~driscoll/
On Fri, 13 Jun 1997, Bryan K. Fite wrote:

> I have been actively looking for some verification of this exploit. I'm
> not saying it doesn't exist. But it is very strange the way it was
> handled. If I were the paranoid type, I would be very concerned by the
> motivation behind the story. Why tell the press and not Netscape?


Apparently, the firm which claims to have found the bug thought 
netscape's standing offer of $1000 and a t-shirt to be too small. When 
netscape refused to up the price, the information was withheld.



 ----------------------------------------------------------
 Life may not be fair, but root access sure makes it easier
 Malachi Kenney kfringe@infi-pos.com

One question not answered is: which files? Can they get files
that current user cannot read, etc. due to ACL entries? If they
could, that would be a big deal.

John

Center for High Assurance Computer Systems
Naval Research Laboratory


 One of my biggest gripes about the Win 3.1/95/NT family of applications
 is their insistance on installing its .DLLs and .INIs et al in the
 %systemroot% subdirectory. %systemroot% should be for the SYSTEM, not
 applications. I should be able to install my apps on D: or whatever
 drive (especially when space is tight on my system/boot partition) and
 have ALL the files of that app go there and not be spread all over god's
 creation. That way, I can lock down %systemroot% tight. But then, my
 opinion is a mere ant in an army of elephants.

 Duston Suits


______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] Installing programs on NT Workstation
Author: DLEBLANC (INTERNET.DLEBLANC) at INSSNAPI
Date: 6/13/97 3:16 AM


Received: from ISS.NET by CMSSOFT.STATE.IL.US
 (Soft*Switch Central V4L40P1A);
 13 Jun 1997 03:16:40 GMT
Received: (qmail 2673 invoked by alias); 12 Jun 1997 16:10:34 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 2664 invoked by alias); 12 Jun 1997 16:10:34 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 2641 invoked by uid 15); 12 Jun 1997 16:10:21 -0000
Received: (qmail 2627 invoked from network); 12 Jun 1997 16:10:16 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 12 Jun 1997 16:10:16 -0000
Received: from dogbert (dogbert.iss.net [208.21.2.60]) by arden.iss.net
(8.8.5/8.7.3) with SMTP id MAA08171; Thu, 12 Jun 1997 12:10:12 -0400 Message-Id:
<2.2.32.19970612160857.01357aac@mail.iss.net> X-Sender: dleblanc@mail.iss.net
X-Mailer: Windows Eudora Pro Version 2.2 (32) Mime-Version: 1.0 Content-Type:
text/plain; charset="us-ascii" Date: Thu, 12 Jun 1997 12:08:57 -0400 To: Paul
Leach , ntsecurity@iss.net,
 "'Allan Bourdius'" 
From: David LeBlanc 
Subject: RE: [NTSEC] Installing programs on NT Workstation
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: David LeBlanc 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net

At 14:37 6/11/97 -0700, Paul Leach wrote:
>All very nice and convenient, but just keep in mind:
>
>If you let "J. Random User" (JRU) install software on his/her machine,
>then you better be careful to make sure that "L. Powerful Administrator"
>(LPA) never logs into that machine, because JRU could have installed a
>password filter to steal LPA's password.
>
>(JRU may not have even been aware that they installed the password
>filter -- they might have been cruising the web and downloaded some
>program that did the dirty deed...)

Lots of other chaos can ensue - for one thing, you guys slipped up and made
%systemroot% everyone:F by default. \program files is also everyone:F by
default, which means that virtually anything could be a trojan.

If you set the permissions as detailed in the security document on the
www.microsoft.com/security page, this problem is almost completely removed.

Another strategy is to allow the local user to be a Power User, and raise
their permissions as need be - you can then allow them to do what they need
without losing complete control over the system. If you allow the local
user access to a local admin account, anything can happen.

Also, as I'm sure you're aware, you have to be admin level to write the LSA
key, so only an admin could slip a password filter in on you (assuming
you're at SP3, or have removed the FPNWCLNT value - else anyone could do this).

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |
[This is a rephrasing of an earlier question that got no responses] 

I have a client who is using MS Proxy server, and wants to use non-Windows
clients. Is it possible to set up MS Proxy server so that you don't need
to use the ms-proxy client -- i.e. to use SOCKS or mapped links?

Any clues are appreciated.

Thanks


I too think that it is quite strange the way this was handled. And I
have a slew of questions. Perhaps that Danish company was trying to get
it's name out there? Perhaps they want to embarass Netscape for some
reason? Since the details of the bug are not being released yet, how
can it be verified? So why go to the press instead of a forum like this
one? Surely there was some motive.

Meka Egwuekwe



Bryan K. Fite wrote:
> 
> I have been actively looking for some verification of this exploit. I'm not saying it doesn't exist. But it is very strange the way it was handled. If I were the paranoid type, I would be very concerned by the motivation behind the story. Why tell the press and not Netscape? If indeed it effects all previous versions, we have been very slow to catch it (too preoccupied with M$?). Is this how information of this nature will be handled in the future? It's great that security is finally getting so
> 
> Thanks,
> Bryan K. Fite
> www.secure-it.net
I installed MS Proxy Server last night and will eventually take the MS test for 
it. I need to learn as much about it as possible so if anyone has questions 
about it I'd be happy to figure out the answer for you.

I am currently using it as a network address translation (NAT) and dial-up 
solution for a small home network with limited Internet accounts. It seems to 
work very well. It did require MS IIS to be installed prior to its installation 
but that was not a major hassle.

I can now do an internal FTP site, Intranet Web services, and a Gopher server 
if I wanted.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!





> ----------
> From: Matt Simmons[SMTP:simmonmt@cs.purdue.edu]
> Reply To: Matt Simmons
> Sent: Thursday, June 12, 1997 2:41 PM
> To: Steve Sutton
> Cc: Paul Leach; ntsecurity@iss.net; 'Allan Bourdius'
> Subject: Re: [NTSEC] Installing programs on NT Workstation
> 
> Steve Sutton writes:
> > Ture. And frightening. The point is that once a malicious program
> runs
> > in an administrative session there are (at last count) 19,367 ways
> it
> > can completely subvert that computer's and perhaps the network's
> > security (can you say "session hijacking"). PASSFILT is certainly
> one of
> > the easier ways to do so. This is not, BTW, an indictment of Windows
> NT.
> > It's as security-sound as any commercial operating is likely to be
> in
> > our lifetimes. The problem is that it's very, very easy to download
> a
> > Trojan Horse in today's seamless, transparent, world-wide-webbed
> > community. Without a "sandbox" for the horse's activities, these
> kinds
> > of attacks are "easy pickin's."
> 
> This should be an indictment of Windows NT. (Yes, this is an flame).
> It's ridiculous to require administrator priviliges for most software
> installs. This, AFAIK, is brought about by the apparent preference in
> 
> the Windows world for leaving droppings everywhere. There is no
> reason why programs shouldn't be able to put themselves in a single
> (user-defined) directory. This would allow Joe User to install his
> own programs in his home directory, as himself, without having any of
> these security concerns.
> 
If it were true that applications for Windows were like UNIX "ls" or
"awk" or "grep", then what you say would be correct. And to the extent
that they are, it is possible in NT to install them so that they are
"per-user", and it might be acceptable to let random users install them
(see the last paragraph below).

But Windows apps are not monolithic statically linked single executable
files; they are collections of dynamically linked libraries (DLLs),
called from a main executable. Some of these DLLs can be shared. For
example, there is a library of common C++ classes that some but not all
apps use, a library of APIs to support HTTP and FTP, a library for SSL,
one for sockets, one for OLE, and one for common UI elelments, like the
file open dialog. Apps want them to be shared for a variety of reasons:
save space, or because they fix bugs, or because they are a way to ship
enhanced functionality in a system service needed by the application.

Apps install these in a shared place, and these are the ones that have
the potential to be a trojan horse. So, only trusted people should be
allowed to install them.

One other point -- if Joe User has the right to install programs in his
own directory, and nowhere else, then he can't trojan an admin who logs
into his machine, but he can still be trojaned by stuff he downloads
from the net.

Paul
Most things are shareware as opposed to Freeware but give the following a try :>

Port Scanners : Try Network Toolbox which has one built in as well as finger,
ping etc. Excellent. www.jriver.com. Also
there is portscan pro and fastscan.
Packet Sniffers : Session Wall is excellent www.abirnet.com. Very good filters
an excellent GUI. Others are etherpeek and netxray (shareware only gets first 5
packets).

regards,



Mark Curphey


On Fri, 13 Jun 1997, Bryan Swann wrote:

> I run the port scanners from a UNIX box. The web site www.rootshell.com
> has lots of good tools. Actually, I don't have a need for a sniffer just
> yet, but I there are several free ones available for UNIX systems. If you
> are on a budget, download Linux and load it on a PC with at least a
> pentium processor and 16MB of RAM.
> 
> I'm unawre of any sniffers for NT. Since you can get source code for
> sniffers, I'm sure they could be ported to NT. There are propably
> sniffers already available. Hopefully someone else will comment on these.
> 
> __________________________________________________________________________
> | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> | Eagan McAllister Associates, Inc. |
> | |
> | "Everything must be working perfectly, cause I don't smell any smoke" |
> --------------------------------------------------------------------------
> 
> On Fri, 13 Jun 1997, Ron Schreiner wrote:
> 
> > What port scanners and sniffers do you have? Are they freeware? Where can
> > I get them? I deperately need them myself. Help, please.....
> > 
> > On Thu, 12 Jun 1997, Bryan Swann wrote:
> > 
> > > I'm involved in evaluating the security of several networks. Being
> > > experienced with UNIX, I have several FREE tools that I use to test a
> > > range of IP addresses over the network. I have seen a few FREE tools for
> > > NT, but they either run only on the machine that they reside or they have
> > > a GUI interface that forces you to access each machine individually. Are
> > > there FREE tools for doing some basic checks on NT boxes? Where can I
> > > find them? I don't mind writing a little code to help automate the
> > > process of using a tool, as long as it has a command line interface.
> > > 
> > > I already have port scanners and sniffers, so I'm not interested in these.
> > > 
> > > TIA
> > > 
> > > __________________________________________________________________________
> > > | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> > > | Eagan McAllister Associates, Inc. |
> > > | |
> > > | "Everything must be working perfectly, cause I don't smell any smoke" |
> > > --------------------------------------------------------------------------
> > > 
> > 
> > 
> 

Bryan K. Fite wrote:
> I have been actively looking for some verification of this exploit.
> I'm not saying it doesn't exist. But it is very strange the way it was
> handled. If I were the paranoid type, I would be very concerned by
> the motivation behind the story. Why tell the press and not Netscape?
> If indeed it effects all previous versions, we have been very slow
> to catch it (too preoccupied with M$?). Is this how information of
> this nature will be handled in the future? It's great that security is
> finally getting some airtime, however, the media tend to create more
> problems then awareness. Your comments on this matter are requested.
>
>

It's very very strange it goes up just in time Communicator is about
to fully release. I wouldn't be suprised to hear it's a twist.
Maybe it's paranoid to see M$ behind each corner, but it's clean
they like Netscape to have as much bugs as it should - even if some
of them have to be fake. Strange is CNNfn and PC Magazine is cooperating
w/ it - too much people for story to be simply not true. Something is rotten
in this issue, at least from my point of view.

I don't know of any feature of Netscape 1.0 which should
be used for exploit. No JavaScript, no Java, no file upload, just
HTTP/1.0 compliance. It hasn't have even bookmarks and it has had
just a small configation file and cache. And this bug should affect
all Netscape browsers ... it's strange.

jd
-- 
Jaromir Dolecek 
dolecek@ics.muni.cz
http://www.ics.muni.cz/~dolecek/
I run the port scanners from a UNIX box. The web site www.rootshell.com
has lots of good tools. Actually, I don't have a need for a sniffer just
yet, but I there are several free ones available for UNIX systems. If you
are on a budget, download Linux and load it on a PC with at least a
pentium processor and 16MB of RAM.

I'm unawre of any sniffers for NT. Since you can get source code for
sniffers, I'm sure they could be ported to NT. There are propably
sniffers already available. Hopefully someone else will comment on these.

 __________________________________________________________________________
| Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
| Eagan McAllister Associates, Inc. |
| |
| "Everything must be working perfectly, cause I don't smell any smoke" |
 --------------------------------------------------------------------------

On Fri, 13 Jun 1997, Ron Schreiner wrote:

> What port scanners and sniffers do you have? Are they freeware? Where can
> I get them? I deperately need them myself. Help, please.....
> 
> On Thu, 12 Jun 1997, Bryan Swann wrote:
> 
> > I'm involved in evaluating the security of several networks. Being
> > experienced with UNIX, I have several FREE tools that I use to test a
> > range of IP addresses over the network. I have seen a few FREE tools for
> > NT, but they either run only on the machine that they reside or they have
> > a GUI interface that forces you to access each machine individually. Are
> > there FREE tools for doing some basic checks on NT boxes? Where can I
> > find them? I don't mind writing a little code to help automate the
> > process of using a tool, as long as it has a command line interface.
> > 
> > I already have port scanners and sniffers, so I'm not interested in these.
> > 
> > TIA
> > 
> > __________________________________________________________________________
> > | Bryan Swann (swann@nosc.mil) 803/974-4267 803/974-5080 (Fax) |
> > | Eagan McAllister Associates, Inc. |
> > | |
> > | "Everything must be working perfectly, cause I don't smell any smoke" |
> > --------------------------------------------------------------------------
> > 
> 
> 

>We have some computers showing 99-100% CPU utilization on the RPC
>service again. These are NT 4.0 w/ Service Pack 3. Anyone know of any
>new exploits on this? I haven't heard of anything.

I had this problem when I booted an NTW 4/SP3 machine with a specialty PC
card in its reader. The card didn't have a driver installed. WHAM! As soon
as I logged in, RPC started using 100% of CPU. If I logged in without the
card, no problem. Once I installed the driver, everything was normal.

The machine was a Dell Optiplex with their SMC internal card cage, running
NT4 1381 with SP3 and no hotfixes. Beats me why it was doing that; I'm just
glad it stopped.

Cheers,
-Paul

--
Paul Robichaux | LJL Enterprises, Inc.
paul@ljl.com | We didn't invent e-mail; we just make it secure.
 |
Author, _Windows NT Server 4 Administrator's Guide_, ISBN 0761507515 (Prima)


There's another interesting (non-technical) article about this at the following URL:

http://www.sjmercury.com/business/netscape061297.htm

Regards.

that wouldn't be a netscape security hole that would be a winnt hole. 
the netscape process is running on behalf of the user that started it, 
so just like any other program it would have the same access rights as 
the user running it. this doesn't lessen the risk because most of us are 
logged on as Administrator anyway.

Patrick


>From owner-ntsecurity@iss.net Fri Jun 13 15:24:41 1997
>Received: (qmail 27266 invoked by alias); 13 Jun 1997 15:46:27 -0000
>Delivered-To: nt-out-link@iss.net
>Received: (qmail 27259 invoked by alias); 13 Jun 1997 15:46:25 -0000
>Delivered-To: nt-out@iss.net
>Received: (qmail 27253 invoked by uid 15); 13 Jun 1997 15:46:24 -0000
>Received: (qmail 27242 invoked from network); 13 Jun 1997 15:46:20 
-0000
>Received: from arden.iss.net (root@208.21.0.8)
> by phoenix.iss.net with SMTP; 13 Jun 1997 15:46:20 -0000
>Received: from itd.nrl.navy.mil (itd.nrl.navy.mil [132.250.81.2]) by 
arden.iss.net (8.8.5/8.7.3) with SMTP id LAA08204 for 
; Fri, 13 Jun 1997 11:46:18 -0400
>Received: from wallace (wallace.itd.nrl.navy.mil) by itd.nrl.navy.mil 
(4.1/SMI-4.1)
> id AA00422; Fri, 13 Jun 97 11:46:16 EDT
>Received: by localhost with Microsoft MAPI; Fri, 13 Jun 1997 11:43:07 
-0400
>Message-Id: <01BC77EE.F65CCD10@mcdermott@itd.nrl.navy.mil>
>From: John McDermott 
>To: "'ntsecurity@iss.net'" 
>Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
>Date: Fri, 13 Jun 1997 11:43:06 -0400
>Organization: Naval Research Laboratory
>X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4008
>Sender: owner-ntsecurity@iss.net
>Precedence: bulk
>Reply-To: John McDermott 
>X-Loop: ntsecurity
>X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to 
majordomo@iss.net
>X-Comment: DO NOT send subscribe/unsubscribe messages to 
ntsecurity@iss.net
>
>One question not answered is: which files? Can they get files
>that current user cannot read, etc. due to ACL entries? If they
>could, that would be a big deal.
>
>John
>
>Center for High Assurance Computer Systems
>Naval Research Laboratory
>



---------------------------------------------------------
Get Your *Web-Based* Free Email at http://www.hotmail.com
---------------------------------------------------------

What we are trying to figure out is why the second ntvdm is running at 
all.
----
From: Stephen Wiles <swiles@empower.com>
To: 'Sameer Khosla' <labtec@netcom.ca>
Date: Friday, June 13, 1997 1:08 AM
Subject: RE: [NTSEC] Multiple instances of NTVDM

I would guess that you have a badly behaving 16 bit app 
or something is
running high or realtime in the second separate NTVDM.

> -----Original Message-----
> From: Sameer Khosla [SMTP:labtec@netcom.ca]
> Sent: Thursday, June 12, 1997 9:07 PM
> To: NT Security Mailing List; MCSE Mailing List
> Subject: [NTSEC] Multiple instances of NTVDM
>
> We are having a bit of a problem. I work for a large bank and we are
> currently in the middle of an NT Rollout. We are using NT WS 4.0 and
> NT Svr 4.0. Now, the problem we are having is limited to one location.
> Some of the programs we use are 16-bit applications (as the 32-bit
> versions are currently under development). Now, in one location, we
> seem to have a second instance of NTVDM.EXE running when we take a
> look at the processes. There are no applications running under this,
> as they are all under the first instance of NTVDM.
> Now, the problem is, this second instance of NTVDM is sucking up
> 98-100% of cpu time. It is causing system instability, as well as
> crashing the first instance of NTVDM occassionally.
> Sameer Khosla - labtec@netcom.ca 
<mailto:labtec@netcom.ca>

Unfortunately, the 16-bit apps we are running are mission critical. We can't 
kill ntvdm because there must be one instance of it running with our mission 
critical apps. As well, our users have about as much knowledge of computers as 
a grape. They have been specifically trained on these apps and no more.

Unfortunately, I can't be more descriptive because company policy prohibits 
me.
Sameer Khosla - labtec@netcom.ca
----
From: Ryan Ferris <ryan25@hooked.net>
To: 'Sameer Khosla' <labtec@netcom.ca>
Date: Friday, June 13, 1997 1:43 PM
Subject: RE: [NTSEC] Multiple instances of NTVDM

Yes that's endemic to NT.  NT simply lets NTVDMs 
hang around well after the 16 bit applications are closed.  They cause holy 
hell on the desktop.  You shouldn't run 16 bit applications on NT, no 
matter what anyone tells you.  You can try configuring your sixteen bit 
applications to run in separate memory space or to run in a lower priority. 
Conversely, you can try to opposites.

I resort to teaching users the command below (from the resource kit utility) 
and/or showing them  how to go into the processes tab of Task Manager and 
delete the "empty NTVDM".

Kill ntvdm

-----Original Message-----
From: Sameer Khosla [SMTP:labtec@netcom.ca]
Sent: Thursday, June 12, 1997 7:07 PM
To: NT Security Mailing List; MCSE Mailing List
Subject: [NTSEC] Multiple instances of NTVDM

We are having a bit of a problem. I work for a large bank and we are currently 
in the middle of an NT Rollout. We are using NT WS 4.0 and NT Svr 4.0. Now, the 
problem we are having is limited to one location.
Some of the programs we use are 16-bit applications (as the 32-bit versions are 
currently under development). Now, in one location, we seem to have a second 
instance of NTVDM.EXE running when we take a look at the processes. There are no 
applications running under this, as they are all under the first instance of 
NTVDM.
Now, the problem is, this second instance of NTVDM is sucking up 98-100% of cpu 
time. It is causing system instability, as well as crashing the first instance 
of NTVDM occassionally.
Sameer Khosla - labtec@netcom.ca

<< File: ATT00000.htm >>

> >I have been actively looking for some verification of this exploit.
> >I'm not saying it doesn't exist. But it is very strange the way it
> >was handled.
> 
> I was able to find links from the CNN home page http://cnn.com and
> Netscape's home page... There seems to be something there worth
> looking
> closer... how much remains to be seen. Here are the articles I found
> (URLs
> may have a very short life)...
> 
> Netscape Security Update:
> http://home.netscape.com/misc/security_update.html
> 
> CNNfn: Netscape bug uncovered: Danish software firm finds flaw that
> could
> let sites see data stored on PCs
> http://cnnfn.com/digitaljam/9706/12/netscape_pkg/
> 
> PC Magazine Online: Netscape Security Flaw: A bug lets curious
> webmasters
> read files from your hard disk when you surf with Navigator.
> http://www8.zdnet.com/pcmag/news/trends/t970612b.htm
> 
> 
> ps. It may be tradition that firms rush to market with often buggy
> products, to maximize their profits, and their customers hassle with
> (and
> pay for) the impact of the bugs. My heart goes out to anybody who says
> "hey-wait a minute!"

There seems to be another link that I have found that mentions this,
It is from Mercury Center, however I'm not sure what Mercury Center is
http://www.sjmercury.com/business/netscape061297.htm

It tends to put the story is a slightly different light that the others
from PC Magazine and CNN.

By the way, has anyone considered the possibility of the javascript
"mailto:" function attaching a file without any user input?
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
At 11:25 AM 6/13/97 -0400, you wrote:
>I too think that it is quite strange the way this was handled. And I
>have a slew of questions. Perhaps that Danish company was trying to get
>it's name out there? Perhaps they want to embarass Netscape for some
>reason? Since the details of the bug are not being released yet, how
>can it be verified? So why go to the press instead of a forum like this
>one? Surely there was some motive.
>
>Meka Egwuekwe


Here's my take:

This Cabocomm guy finds or invents a bug in Netscape. (I'm still skeptical
there is one - the file upload capability should be controlled only by the
user, not on command of the server. If it turns out that Netscape can be
made to upload files on command of the server, it's probably not a bug, but
intentional, which is a chilling thought.)

He already knows Netscape's reward for such is $1000 which is pitifully
stupid on Netscape's part IMO. It should be $100,000 for a bug like this.

So he does the best thing. He calls CNN which now has a world wide scoop on
a Netscape bug, just as the Intenet and Netscape and Microsoft are getting
more and more public interest. That's where I heard it first. This list
usually knows about stuff like this before the press gives a shit.

CNN pays for that sort of thing. All news agencies do. I have no idea how
much but I bet it's a hell of a lot more than $1000.

Any thoughts?


randall g =%^)>
mailto:randallg@telemark.net
http://www.telemark.net/~randallg

They said they wanted money. Can't say I blame them. Probably costing 
Netscape $10,000s to find it if they can. They should have coughed up the 
dough.

----------
From: owner-ntsecurity@iss.net on behalf of Meka Egwuekwe
Sent: Friday, June 13, 1997 10:25 AM
To: Bryan K. Fite
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

I too think that it is quite strange the way this was handled. And I
have a slew of questions. Perhaps that Danish company was trying to get
it's name out there? Perhaps they want to embarass Netscape for some
reason? Since the details of the bug are not being released yet, how
can it be verified? So why go to the press instead of a forum like this
one? Surely there was some motive.

Meka Egwuekwe



Bryan K. Fite wrote:
> 
> I have been actively looking for some verification of this exploit. I'm not 
saying it doesn't exist. But it is very strange the way it was handled. If I 
were the paranoid type, I would be very concerned by the motivation behind the 
story. Why tell the press and not Netscape? If indeed it effects all previous 
versions, we have been very slow to catch it (too preoccupied with M$?). Is 
this how information of this nature will be handled in the future? It's great 
that security is finally getting so
> 
> Thanks,
> Bryan K. Fite
> www.secure-it.net

This is the information that I have on 
the Netscape story. It seems that they do not want to let him talk to the 
person that is in charge of the Bug Reward that Netscape has...

MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1997 
JUN 13 (NB) -- By Patrick McKenna. "Let me talk to the guy with the 
checkbook," wrote an unnamed Danish programmer who created a non-public 
World Wide Web site which allows the site operator to copy files from the hard 
disk of any user of Netscape's [NASDAQ:NSCP 
] Web browser Navigator accessing the site. He contacted Netscape through e-mail 
earlier this week, but refused to divulge his Navigator bug-find for a customary 
Netscape fee of $1,000.
"We want all Navigator users to know that we take all bug reports 
seriously and our engineers are working on this problem right now," began 
Netscape spokesperson, Jennifer O'Mahoney. "At this time, there are no 
reported incidents of this reported bug affecting any Navigator user accessing 
public or intranet Web sites. The probability of it affecting these users is 
very low. "

According to Netscape, communication with the programmer has been limited to 
e-mail. After refusing to put him in touch with the "guy with the 
checkbook," Netscape was warned the information would be revealed to the 
media. Cable News Network (CNN) was contacted by the programmer and given a 
demonstration of the bug through a non-public Web site designed by the 
programmer. The bug was confirmed by PC Magazine.

Although Netscape has not been able to internally examine and confirm the 
"briber bug," the Internet/intranet software developer has assumed the 
CNN demonstration was successfully completed.

According to reports, from the programmer and CNN, a navigator user visiting 
the site in question opens his or her hard disk to the operator. The site 
operator, however, must know specific file names to access any information on a 
user's hard disk. Which version or versions of Navigator are susceptible to the 
bug are currently unknown, but one report says the Dane claims version 2.0 and 
all later versions contain the programming flaw.

The Dane chose to pressure Netscape during the company's developer conference 
in San Jose, California. In spite of the timing, Netscape remained adamant in 
its response. "We will not be blackmailed or allow an individual or group 
to hold us hostage," added O'Mahoney.

She also told Newsbytes, "We will keep everyone posted of this situation 
throughout the today and following days on our Web site (http://home.netscape.com )." Once on 
Netscape's home page click on "Flash Items." No discussions of 
specific amounts of money have occurred between the unnamed programmer and 
Netscape.

(19970612/Press Contact: Jennifer O'Mahoney, Netscape, tel 415-528- 2619; 
Reported by Newsbytes News Network: http://www.newsbytes.com 
/NETSCAPELOGO/PHOTO)

"The Pulse of the Information Age" Newsbytes News Network http://www.newsbytes.com 24-hour computer, 
telecom and online news

© 1997 Newsbytes

Jeffrey Fry
CNA, A+ Certified Technician
chec@itw.com
fry@mapeaston.com
http://www.itw.com/~chec

----
From: Meka Egwuekwe <meka@issl.atl.hp.com>
To: Bryan K. Fite <bryanf@secureitinc.com>
Cc: ntsecurity@iss.net
Date: Friday, June 13, 1997 22:31
Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

I too think that it is quite strange the way this was 
handled.  And I
have a slew of questions.  Perhaps that Danish company was trying to 
get
it's name out there?  Perhaps they want to embarass Netscape for some
reason?  Since the details of the bug are not being released yet, how
can it be verified?  So why go to the press instead of a forum like 
this
one?  Surely there was some motive.

Meka Egwuekwe

Bryan K. Fite wrote:
>
> I have been actively looking for some verification of this exploit. I'm not 
saying it doesn't exist. But it is very strange the way it was handled. If I 
were the paranoid type, I would be very concerned by the motivation behind the 
story. Why tell the press and not Netscape?  If indeed it effects all 
previous versions, we have been very slow to catch it (too preoccupied with 
M$?). Is this how information of this nature will be handled in the future? It's 
great that security is finally getting so
>
> Thanks,
> Bryan K. Fite
> www.secure-it.net

http://www.newsbytes.com/3.html
Full story at that address, also http://home.netscape.com/misc/security_update.html 
is where the information that Netscape has provided on the subject is 
posted.
It is said to affect Netscapes version 
2.0 and above.

Jeffrey Fry
CNA, A+ Certified Technician
chec@itw.com
fry@mapeaston.com
http://www.itw.com/~chec

----
From: Meka Egwuekwe <meka@issl.atl.hp.com>
To: Bryan K. Fite <bryanf@secureitinc.com>
Cc: ntsecurity@iss.net
Date: Friday, June 13, 1997 22:31
Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

I too think that it is quite strange the way this was 
handled.  And I
have a slew of questions.  Perhaps that Danish company was trying to 
get
it's name out there?  Perhaps they want to embarass Netscape for some
reason?  Since the details of the bug are not being released yet, how
can it be verified?  So why go to the press instead of a forum like 
this
one?  Surely there was some motive.

Meka Egwuekwe

Bryan K. Fite wrote:
>
> I have been actively looking for some verification of this exploit. I'm not 
saying it doesn't exist. But it is very strange the way it was handled. If I 
were the paranoid type, I would be very concerned by the motivation behind the 
story. Why tell the press and not Netscape?  If indeed it effects all 
previous versions, we have been very slow to catch it (too preoccupied with 
M$?). Is this how information of this nature will be handled in the future? It's 
great that security is finally getting so
>
> Thanks,
> Bryan K. Fite
> www.secure-it.net

###### ## ## ######
 ## ### ## ##
 ###### ## # ## ##
 ## ## ### ##
 ###### . ## ## . ######.

 Secure Networks Inc.
 AND
 CORE Seguridad de la Informacion


 Security Advisory
 April 22, 1997

 BIND Vulnerabilities and Solutions


Problem Description
~~~~~~~~~~~~~~~~~~~

This advisory contains descriptions and solutions for two vulnerabilities
present in current BIND distributions. These vulnerabilities are actively
being exploited on the Internet.

I. The usage of predictable IDs in queries and recursed queries allows for
 remote cache corruption. This allows malicious users to alter domain
 name server caches to change the addresses and hostnames of hosts on the
 internet.

II. A failure to check whether hostname lengths exceed MAXHOSTNAMELEN in
 size. This results in potential buffer overflows in programs which
 expect the BIND resolver to only return a maximum hostname length of
 MAXHOSTNAMELEN.



 Problem I. The usage of predictable ID's
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Problem I. - Impact
~~~~~~~~~~~~~~~~~~~

Remote root users can poison BIND and Microsoft Windows NT name server
caches by forging UDP packets. We should note that unlike other well
documented attacks, in this instance it is NOT necessary for the attacker
to take over a DNS server or sniff the target network.


Problem I. - Technical Details
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This particular cache corruption attack requires that the target nameserver
be configured to allow recursion. Recursion allows a nameserver to handle
requests for zones or domains which it does not serve. When receiving a
query for a zone or domain which is not served by the name server, the name
server will transmit a query to a nameserver which serves the desired
domain. Once a response is received from the second nameserver, the first
nameserver sends the response back to the requesting party.

The following attack is outlined in the paper "Addressing weaknesses in the
Domain Name System Protocol" by Christopher Schuba and Eugene Spafford [6].
To the extent of our knowledge, this problem has not been previously
addressed. The paper also assumes that the attacker has super-user access
to a primary nameserver, here we demonstrate that this is not necessary nor
are source routed packets required.

Using the recursion feature, one can poison the cache on a name server with
the following procedure:


Problem I. - The Players
~~~~~~~~~~~~~~~~~~~~~~~~

. HOST.ATTACKER.COM is the attacking host.

. DNS.ATTACKER.COM is ATTACKER.COM's nameserver, we presume that this is
 the only name server for ATTACKER.COM to simplify the description.

. DNS.TARGET.COM is the target nameserver which runs BIND. What we will
 attempt to do is add an A (address) resource record on DNS.TARGET.COM
 that will resolve WWW.SPOOFED.COM to 127.0.0.1. We are sure that
 WWW.SPOOFED.COM is not cached in DNS.TARGET.COM's DNS cache.

. DNS.SPOOFED.COM is the nameserver for SPOOFED.COM's domain. We have
 determined this before the attack begins. Once again we just presume
 its the only one in order to simplify this description.


Problem I. - The Attack
~~~~~~~~~~~~~~~~~~~~~~~

A. First a query is sent to DNS.TARGET.COM asking for the address of
 UNKNOWN.ATTACKER.COM. Our query has the recursion desired bit set,
 meaning that if the nameserver we are querying has recursion enabled,
 it will query another nameserver with our query (assuming it does not
 have the information cached).

B. DNS.TARGET.COM will first determine who serves the ATTACKER.COM
 domain, then it will build a query packet and send it to
 DNS.ATTACKER.COM.

C. We sniff DNS.ATTACKER.COM's local network and retrieve the query packet
 sent by DNS.TARGET.COM to DNS.ATTACKER.COM. We can then determine
 the query ID (qid0) used by DNS.TARGET.COM. Chances are that the
 next queries generated by DNS.TARGET.COM will have query IDs that will
 fall in the range [qid0,qid0+N] where N is dependent on the amount of
 queries DNS.TARGET.COM is generating in the period of time on which the
 attack takes place. N is usually <= 10 for most cases.

D. Once we have determined what the next query ID generated will be, we
 send a query to DNS.TARGET.COM asking for WWW.SPOOFED.COM's address.

E. Then we start sending spoofed DNS replies from DNS.SPOOFED.COM,
 telling DNS.TARGET.COM that WWW.SPOOFED.COM is '127.0.0.1'.

F. If we guessed the query ID used by DNS.TARGET.COM in its recursed
 query and our response is received first, our response will be taken
 as valid and the address will be cached. Subsequent responses will
 be discarded as duplicates. We can always send many (N*M) spoofed
 packets with different IDs in the range (qid0,qid0+N] so we will be
 sure that at least one of them will hit DNS.TARGET.COM and have the
 'right' ID. M is a factor dependent of the amount of UDP packets we
 expect to lose on their way to DNS.TARGET.COM.


Problem I. - The Result
~~~~~~~~~~~~~~~~~~~~~~~

If the attack succeeded, any query to DNS.TARGET.COM asking for
WWW.SPOOFED.COM's address, will get 127.0.0.1 as a response. Thus,
any user on TARGET.COM's domain will connect to 127.0.0.1 if they try to
contact WWW.SPOOFED.COM.

The usage of 127.0.0.1 in this description is of course for instructional
purposes, any IP address can be used, in particular an attacker could use
its own IP address (BADGUY.COM's IP) so all connections to 'host' will go
to 'BADGUY'. The attacker can then 'impersonate' WWW.SPOOFED.COM. Given
this attack, it is easy to visualize the effects of impersonating a high
traffic FTP distribution site. This attack can also be used to intercept
email traffic, and bypass address based authentication methods, including
TCP wrappers and firewalls.


Problem I. - Notes
~~~~~~~~~~~~~~~~~~

This attack depends on a few things to succeed:

1. The attacker has complete control of DNS.ATTACKER.COM's network,
 he can both spoof and sniff DNS packets there. In particular, he can
 sniff DNS packets sent to DNS.ATTACKER.COM.

2. Spoofed DNS responses sent from the attacker to DNS.TARGET.COM must
 be received before the legit response from DNS.SPOOFED.COM. This is
 very easy to achieve. In testing we have not yet encountered a situation
 where we could not get our packets to the nameserver first.

3. The name server on DNS.TARGET.COM supports recursion and caches
 responses. This is common practice. It should be noted that most
 nameservers allow recursion (unless specifically denied by
 configuration options). Root name servers, however, do not allow
 recursion.

 If DNS.TARGET.COM caches negative responses as well (NCACHE), a denial
 of service attack can be performed, in this case, spoofed responses sent
 by the attacker will tell DNS.TARGET.COM that WWW.SPOOFED.COM does not
 exist (and be authorative on this).

 The existence of several nameservers for the domains does not alter the
 basic outline of this attack. The attacker would only need to send DNS
 responses with source addresses of each of SPOOFED.COM's nameservers.
 (N*M*I responses, where I is the number of nameservers).


Problem I. - Systems Affected
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

- - All systems using BIND as their domain name server with recursion
 enabled.

- - Windows NT (server) version 3.51 & 4.0 DNS server.
 Microsoft has been notified and has acknowledged this is a serious
 problem. No information on a fix is availible.



 Problem II. Hostname length checking
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Problem II. - Impact
~~~~~~~~~~~~~~~~~~~~

BIND allows passing of hostnames larger than MAXHOSTNAMELEN in size to
programs. As many programs utilize buffers of size MAXHOSTNAMELEN and
copy the results from a query into these buffers, an overflow can occur.
This can allow an attacker to execute arbitrary commands on a remote
server in a worst case scenario.


Problem II. - Systems Affected
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

All systems running BIND.


Fix Information
~~~~~~~~~~~~~~~

Obtain BIND version 4.9.5-P1. BIND is availible from ftp.isc.org in
the directory /isc/bind/src. Patches to solve both problem I and
problem II are included at the end of this advisory. Once BIND
has been obtained, follow the following procedure:

i. First remove the patches from this text. This can be performed by
 removing all text in between the "CUT HERE" lines, and saving it
 to a text file (i.e. /tmp/diffs.txt).

ii. Perform the following operations to apply the patches:

% gzip -d bind.tar.gz
% mkdir bind
% cd bind
% tar -xvf ../bind.tar
% patch < /tmp/diffs.txt

iii. Rebuild BIND


Attributions
~~~~~~~~~~~~

 Ivan Arce 
 Emiliano Kargieman 

 The OpenBSD Project
 Who found a good solution to problem, developed a solution and
 performed various tests to ensure its correctness. Individuals
 involved in this effort were:

 Theo de Raadt 
 Niels Provos 
 Todd Miller 
 Allen Briggs 

 Further attributions:
 AUSCERT 
 David Sacerdote 
 Oliver Friedrichs 
 Alfred Huger 


Additional Information:
~~~~~~~~~~~~~~~~~~~~~~~

 [1] Vixie P. , "DNS and BIND security issues".
 This was originally published in the proceedings of the
 5th USENIX Security Symposium and its included in the BIND
 distribution under the doc/misc directory.

 [2] Kumar A., Postel J., Neuman C., Danzig P. , Miller S.
 "RFC1536: Common DNS implementation errors and suggested fixes"

 Refer to problem 2 for a description of other weaknesses previously
 found in the recursion scheme.

 [3] Lottor, M., "RFC1033: Domain administrators operations guide"
 [4] Mockapetris, P., "RFC1034: Domain names - Concepts and facilities"
 [5] Mockapetris, P., "RFC1035: Domain Names - Implementation and specification"

 [6] Schuba Christopher and Spafford Eugene, "Adressing weaknesses in the
 Domain Name System Protocol", COAST Laboratory, Department of Computer
 Science, Purdue University.

 Comments and questions regarding this advisory can be sent to:

 Ivan Arce 
 Emiliano Kargieman 

 For more information about CORE S.A. contact: core@secnet.com

 Or visit: http://www.secnet.com/core

 Encrypted mail can also be sent to encrypted with
 the following PGP key:

Type Bits/KeyID Date User ID
pub 1024/9E55000D 1997/01/13 Secure Networks Inc. 
 Secure Networks 

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3ia

mQCNAzLaFzIAAAEEAKsVzPR7Y6oFN5VPE/Rp6Sm82oE0y6Mkuof8QzERV6taihn5
uySb31UeNJ4l6Ud9alOPT/0YdeOO9on6eD1iU8qumFxzO3TLm8nTAdZehQSAQfoa
rWmpwj7KpXN/3n+VyBWvhpBdKxe08SQN4ZjvV5HXy4YIrE5bTbgIhFKeVQANAAUR
tCVTZWN1cmUgTmV0d29ya3MgSW5jLiA8c25pQHNlY25ldC5jb20+iQCVAwUQM1yd
EB/bLKAOe7p9AQFptAQAiYpaZCpSmGgr05E698Z3t5r5BPAKUEtgvF53AvZUQLxz
ZsYsVU5l5De0qKWJOQ/9LiDyWu1lvKhlTphbLy2RatWD4kO3oQL9v3TpSXm2WQhU
uIzyZvj7S5ENodNnKn+gCDIvbou6OMot+7dRbWWgN2oabbru4CSlOxbG++yaTz+J
AJUDBRAzTefbtOXez5VgyLkBAd0bA/43eGEgvPOFK+HHWCPpkSWCwtrtDU/dxOVz
9erHnT/CRxeojCI+50f71Qe+kvx9Q1odz2Jl/fLxhnPQdbPnpWblIbu4F8H+Syrj
HTilDrl1DWa/nUNgK8sb27SMviELczP1a8gwA1eo5SUCG5TWLLTAzjWOgTxod2Ha
OwseUHmqVIkAlQMFEDNOVsr/d6Iw8NVIbQEBxM0D/14XRfgSLwszgJcVbslMHm/B
fF6tHoWYojzQle3opOuMYHNN8GsMZRkc1qQ8QuNA9Aj5+qDqEontGjV5IvhBu1fY
FM77AhagskaFCZxwqV64Qrk328WDO89NGSd+RuovVNruDdn20TxNCEVuPTHjI0UA
8H+E6FW9jexg6RTHhPXYtCVTZWN1cmUgTmV0d29ya3MgPHNlY3VyaXR5QHNlY25l
dC5jb20+iQCVAwUQMtqTKB/bLKAOe7p9AQFw5wQAgUwqJ+ZqfEy/lO1srU3nzxLA
X0uHGHrMptRy/LFo8swD6G1TtWExUc3Yv/6g2/YK09b5WmplEJ+Q09maQIw+RU/s
cIY+EsPauqIq4JTGh/Nm0Z4UDl2Y1x4GNtm0YqezxUPS0P0A3LHVLJ3Uo5og0G8O
gPNrfbVz5ieT14OSCWCJAJUDBRAy2hd2/3eiMPDVSG0BAVNhBACfupfAcNhhnQaq
aI03DOOiZSRjvql1xw4V+pPhM+IksdSK3YNUZVJJtANacgDhBT+jAPRaYbBWI3A5
ZMdcSNM8aTG0LWMLIOiOYEm6Lgd3idRBFN0Js08eyITl8mhZ33mDe4I0KQri9UiV
ZcPYTbb9CWM6Hv2cMbt6S6kLnFziqIkAlQMFEDLaF0+4CIRSnlUADQEBCLoEAJwt
UofDgvyZ4nCDx1KKAPkkXBRaPMWBp46xeTVcxaYiloZfwHfpk1h2mEJAxmAsvizl
OtIppHl4isUxcGi/E2mLCLMvis22/IQP/9obPahPvgNaMLVtZljO1Nv3QFEkNciL
FEUTNJHR1ko7ibCxkBs4cOpirFuvTMDvWnNaXAf8
=DchE
- -----END PGP PUBLIC KEY BLOCK-----


Copyright Notice
~~~~~~~~~~~~~~~~
The contents of this advisory are Copyright (C) 1997 Secure Networks Inc and
CORE Seguridad de la Informacion S.A., and may be distributed freely provided
that no fee is charged for distribution, and that proper credit is given.

 You can find Secure Networks papers at ftp://ftp.secnet.com/pub/papers
 and advisories at ftp://ftp.secnet.com/advisories

 You can browse our web site at http://www.secnet.com

 You can subscribe to our security advisory mailing list by sending mail to
 majordomo@secnet.com with the line "subscribe sni-advisories"


Patches
~~~~~~~

 --- CUT HERE ---

diff -cNr ../bind-4.9.5-P1-rel/contrib/host/host.c ./contrib/host/host.c
*** ../bind-4.9.5-P1-rel/contrib/host/host.c Sat Oct 12 16:24:42 1996
- --- ./contrib/host/host.c Wed Apr 9 15:27:05 1997
***************
*** 537,543 ****
 _res.retrans = DEF_RETRANS; /* timeout in secs between retries */

 /* initialize packet id */
! _res.id = getpid() & 0x7fff;

 /* save new defaults */
 new_res = _res;
- --- 537,543 ----
 _res.retrans = DEF_RETRANS; /* timeout in secs between retries */

 /* initialize packet id */
! _res.id = res_randomid();

 /* save new defaults */
 new_res = _res;
diff -cNr ../bind-4.9.5-P1-rel/named/ns_main.c ./named/ns_main.c
*** ../bind-4.9.5-P1-rel/named/ns_main.c Tue Nov 26 03:11:23 1996
- --- ./named/ns_main.c Wed Apr 9 00:24:14 1997
***************
*** 1658,1668 ****
 }

 /*
! * These are here in case we ever want to get more clever, like perhaps
! * using a bitmap to keep track of outstanding queries and a random
! * allocation scheme to make it a little harder to predict them. Note
! * that the resolver will need the same protection so the cleverness
! * should be put there rather than here; this is just an interface layer.
 */

 void
- --- 1658,1668 ----
 }

 /*
! * This just an interface layer to the random number generator
! * used in the resolver.
! * A special random number generator is used to create non predictable
! * and non repeating ids over a long period. It also avoids reuse
! * by switching between two distinct number cycles.
 */

 void
***************
*** 1674,1683 ****
 u_int16_t
 nsid_next()
 {
! if (nsid_state == 65535)
! nsid_state = 0;
! else
! nsid_state++;
 return (nsid_state);
 }

- --- 1674,1680 ----
 u_int16_t
 nsid_next()
 {
! nsid_state = res_randomid();
 return (nsid_state);
 }

diff -cNr ../bind-4.9.5-P1-rel/res/Makefile ./res/Makefile
*** ../bind-4.9.5-P1-rel/res/Makefile Thu Aug 8 16:49:48 1996
- --- ./res/Makefile Wed Apr 9 00:32:13 1997
***************
*** 77,89 ****
 res_comp.c res_init.c res_mkquery.c res_query.c res_send.c \
 getnetbyaddr.c getnetbyname.c getnetent.c getnetnamadr.c \
 gethnamaddr.c sethostent.c nsap_addr.c hostnamelen.c inet_addr.c \
! inet_ntop.c inet_neta.c inet_pton.c inet_net_ntop.c inet_net_pton.c

 OBJS= base64.o herror.o res_debug.o res_data.o \
 res_comp.o res_init.o res_mkquery.o res_query.o res_send.o \
 getnetbyaddr.o getnetbyname.o getnetent.o getnetnamadr.o \
 gethnamaddr.o sethostent.o nsap_addr.o hostnamelen.o inet_addr.o \
! inet_ntop.o inet_neta.o inet_pton.o inet_net_ntop.o inet_net_pton.o

 all: libresolv.a

- --- 77,91 ----
 res_comp.c res_init.c res_mkquery.c res_query.c res_send.c \
 getnetbyaddr.c getnetbyname.c getnetent.c getnetnamadr.c \
 gethnamaddr.c sethostent.c nsap_addr.c hostnamelen.c inet_addr.c \
! inet_ntop.c inet_neta.c inet_pton.c inet_net_ntop.c inet_net_pton.c \
! res_random.c

 OBJS= base64.o herror.o res_debug.o res_data.o \
 res_comp.o res_init.o res_mkquery.o res_query.o res_send.o \
 getnetbyaddr.o getnetbyname.o getnetent.o getnetnamadr.o \
 gethnamaddr.o sethostent.o nsap_addr.o hostnamelen.o inet_addr.o \
! inet_ntop.o inet_neta.o inet_pton.o inet_net_ntop.o inet_net_pton.o \
! res_random.o

 all: libresolv.a

diff -cNr ../bind-4.9.5-P1-rel/res/res_comp.c ./res/res_comp.c
*** ../bind-4.9.5-P1-rel/res/res_comp.c Mon Dec 2 02:17:22 1996
- --- ./res/res_comp.c Fri Apr 18 18:45:02 1997
***************
*** 98,103 ****
- --- 98,105 ----

 dn = exp_dn;
 cp = comp_dn;
+ if (length > MAXHOSTNAMELEN-1)
+ length = MAXHOSTNAMELEN-1;
 eom = exp_dn + length;
 /*
 * fetch next label in domain name
diff -cNr ../bind-4.9.5-P1-rel/res/res_init.c ./res/res_init.c
*** ../bind-4.9.5-P1-rel/res/res_init.c Sat Sep 28 00:51:07 1996
- --- ./res/res_init.c Wed Apr 9 00:33:30 1997
***************
*** 197,209 ****
 if (!(_res.options & RES_INIT))
 _res.options = RES_DEFAULT;

- - /*
- - * This one used to initialize implicitly to zero, so unless the app
- - * has set it to something in particular, we can randomize it now.
- - */
- - if (!_res.id)
- - _res.id = res_randomid();
- -
 #ifdef USELOOPBACK
 _res.nsaddr.sin_addr = inet_makeaddr(IN_LOOPBACKNET, 1);
 #else
- --- 197,202 ----
***************
*** 644,655 ****
 return(0); /* if not using DNS configuration from NetInfo */
 }
 #endif /* NeXT */
- -
- - u_int
- - res_randomid()
- - {
- - struct timeval now;
- -
- - gettimeofday(&now, NULL);
- - return (0xffff & (now.tv_sec ^ now.tv_usec ^ getpid()));
- - }
- --- 637,639 ----
diff -cNr ../bind-4.9.5-P1-rel/res/res_mkquery.c ./res/res_mkquery.c
*** ../bind-4.9.5-P1-rel/res/res_mkquery.c Sat Sep 28 00:37:58 1996
- --- ./res/res_mkquery.c Wed Apr 9 00:31:30 1997
***************
*** 107,118 ****
 #endif
 /*
 * Initialize header fields.
 */
 if ((buf == NULL) || (buflen < HFIXEDSZ))
 return (-1);
 bzero(buf, HFIXEDSZ);
 hp = (HEADER *) buf;
! hp->id = htons(++_res.id);
 hp->opcode = op;
 hp->rd = (_res.options & RES_RECURSE) != 0;
 hp->rcode = NOERROR;
- --- 107,123 ----
 #endif
 /*
 * Initialize header fields.
+ *
+ * A special random number generator is used to create non predictable
+ * and non repeating ids over a long period. It also avoids reuse
+ * by switching between two distinct number cycles.
 */
+
 if ((buf == NULL) || (buflen < HFIXEDSZ))
 return (-1);
 bzero(buf, HFIXEDSZ);
 hp = (HEADER *) buf;
! hp->id = htons(_res.id=res_randomid());
 hp->opcode = op;
 hp->rd = (_res.options & RES_RECURSE) != 0;
 hp->rcode = NOERROR;
diff -cNr ../bind-4.9.5-P1-rel/res/res_random.c ./res/res_random.c
*** ../bind-4.9.5-P1-rel/res/res_random.c Wed Dec 31 17:00:00 1969
- --- ./res/res_random.c Tue Apr 22 02:31:25 1997
***************
*** 0 ****
- --- 1,262 ----
+ /* $OpenBSD: res_random.c,v 1.3 1997/04/19 10:07:01 provos Exp $ */
+
+ /*
+ * Copyright 1997 Niels Provos 
+ * All rights reserved.
+ *
+ * Theo de Raadt came up with the idea of using
+ * such a mathematical system to generate more random (yet non-repeating)
+ * ids to solve the resolver/named problem. But Niels designed the
+ * actual system based on the constraints.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ * must display the following acknowledgement:
+ * This product includes software developed by Niels Provos.
+ * 4. The name of the author may not be used to endorse or promote products
+ * derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+ /*
+ * seed = random 15bit
+ * n = prime, g0 = generator to n,
+ * j = random so that gcd(j,n-1) == 1
+ * g = g0^j mod n will be a generator again.
+ *
+ * X[0] = random seed.
+ * X[n] = a*X[n-1]+b mod m is a Linear Congruential Generator
+ * with a = 7^(even random) mod m,
+ * b = random with gcd(b,m) == 1
+ * m = 31104 and a maximal period of m-1.
+ *
+ * The transaction id is determined by:
+ * id[n] = seed xor (g^X[n] mod n)
+ *
+ * Effectivly the id is restricted to the lower 15 bits, thus
+ * yielding two different cycles by toggling the msb on and off.
+ * This avoids reuse issues caused by reseeding.
+ *
+ * The 16 bit space is very small and brute force attempts are
+ * entirly feasible, we skip a random number of transaction ids
+ * so that an attacker will not get sequential ids.
+ */
+
+ #include 
+ #include 
+ #include 
+ #include 
+
+ #if defined(BSD) && (BSD >= 199103)
+ # include 
+ # include 
+ # include 
+ #else
+ # include "../conf/portability.h"
+ #endif
+
+ #define RU_OUT 180 /* Time after wich will be reseeded */
+ #define RU_MAX 30000 /* Uniq cycle, avoid blackjack prediction */
+ #define RU_GEN 2 /* Starting generator */
+ #define RU_N 32749 /* RU_N-1 = 2*2*3*2729 */
+ #define RU_AGEN 7 /* determine ru_a as RU_AGEN^(2*rand) */
+ #define RU_M 31104 /* RU_M = 2^7*3^5 - don't change */
+
+ #define PFAC_N 3
+ const static u_int16_t pfacts[PFAC_N] = {
+ 2,
+ 3,
+ 2729
+ };
+
+ static u_int16_t ru_x;
+ static u_int16_t ru_seed;
+ static u_int16_t ru_a, ru_b;
+ static u_int16_t ru_g;
+ static u_int16_t ru_counter = 0;
+ static u_int16_t ru_msb = 0;
+ static long ru_reseed;
+ static u_int32_t tmp; /* Storage for unused random */
+ static struct timeval tv;
+
+ static u_int32_t pmod __P((u_int32_t, u_int32_t, u_int32_t));
+ static void res_initid __P((void));
+
+ #ifndef __OpenBSD__
+ /*
+ * No solid source of strong random in the system. Sigh. Fake it.
+ */
+ u_long
+ arc4random()
+ {
+ static char state[256];
+ char *savestate;
+ char *setstate();
+ static unsigned seed;
+ static int count;
+ u_long datum;
+
+ if (++count == 129837 || seed == 0) {
+ struct timeval tv;
+
+ count = 0;
+ gettimeofday(&tv, NULL);
+ seed = getpid() ^ tv.tv_sec ^ tv.tv_usec;
+ initstate(seed, state, sizeof state);
+ }
+ savestate = setstate(state);
+ datum = random();
+ setstate(savestate);
+ return (datum);
+ }
+
+ #endif
+
+ /*
+ * Do a fast modular exponation, returned value will be in the range
+ * of 0 - (mod-1)
+ */
+
+ static u_int32_t
+ pmod(gen, exp, mod)
+ u_int32_t gen, exp, mod;
+ {
+ u_int32_t s, t, u;
+
+ s = 1;
+ t = gen;
+ u = exp;
+
+ while (u) {
+ if (u & 1)
+ s = (s*t) % mod;
+ u >>= 1;
+ t = (t*t) % mod;
+ }
+ return (s);
+ }
+
+ /*
+ * Initalizes the seed and chooses a suitable generator. Also toggles
+ * the msb flag. The msb flag is used to generate two distinct
+ * cycles of random numbers and thus avoiding reuse of ids.
+ *
+ * This function is called from res_randomid() when needed, an
+ * application does not have to worry about it.
+ */
+ static void
+ res_initid()
+ {
+ u_int16_t j, i;
+ int noprime = 1;
+
+ tmp = arc4random();
+ ru_x = (tmp & 0xFFFF) % RU_M;
+
+ /* 15 bits of random seed */
+ ru_seed = (tmp >> 16) & 0x7FFF;
+
+ tmp = arc4random();
+
+ /* Determine the LCG we use */
+ ru_b = (tmp & 0xfffe) | 1;
+ ru_a = pmod(RU_AGEN, (tmp >> 16) & 0xfffe, RU_M);
+ while (ru_b % 3 == 0)
+ ru_b += 2;
+
+ tmp = arc4random();
+ j = tmp % RU_N;
+ tmp = tmp >> 16;
+
+ /*
+ * Do a fast gcd(j,RU_N-1), so we can find a j with
+ * gcd(j, RU_N-1) == 1, giving a new generator for
+ * RU_GEN^j mod RU_N
+ */
+
+ while (noprime) {
+ for (i=0; i=PFAC_N)
+ noprime = 0;
+ else
+ j = (j+1) % RU_N;
+ }
+
+ ru_g = pmod(RU_GEN,j,RU_N);
+ ru_counter = 0;
+
+ gettimeofday(&tv, NULL);
+ ru_reseed = tv.tv_sec + RU_OUT;
+ ru_msb = ru_msb == 0x8000 ? 0 : 0x8000;
+ }
+
+ u_int
+ res_randomid()
+ {
+ int i, n;
+
+ gettimeofday(&tv, NULL);
+ if (ru_counter >= RU_MAX || tv.tv_sec > ru_reseed)
+ res_initid();
+
+ if (!tmp)
+ tmp = arc4random();
+
+ /* Skip a random number of ids */
+ n = tmp & 0x2f; tmp = tmp >> 6;
+ if (ru_counter + n >= RU_MAX)
+ res_initid();
+
+ for (i=0; i<=n; i++)
+ /* Linear Congruential Generator */
+ ru_x = (ru_a*ru_x + ru_b) % RU_M;
+
+ ru_counter += i;
+
+ return (ru_seed ^ pmod(ru_g,ru_x,RU_N)) | ru_msb;
+ }
+
+ #if 0
+ void
+ main(int argc, char **argv)
+ {
+ int i, n;
+ u_int16_t wert;
+
+ res_initid();
+
+ printf("Generator: %d\n", ru_g);
+ printf("Seed: %d\n", ru_seed);
+ printf("Reseed at %ld\n", ru_reseed);
+ printf("Ru_X: %d\n", ru_x);
+ printf("Ru_A: %d\n", ru_a);
+ printf("Ru_B: %d\n", ru_b);
+
+ n = atoi(argv[1]);
+ for (i=0;i 
> They said they wanted money. Can't say I blame them. Probably costing
> Netscape $10,000s to find it if they can. They should have coughed up the
> dough.
> 
> ----------
> From: owner-ntsecurity@iss.net on behalf of Meka Egwuekwe
> Sent: Friday, June 13, 1997 10:25 AM
> To: Bryan K. Fite
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> I too think that it is quite strange the way this was handled. And I
> have a slew of questions. Perhaps that Danish company was trying to get
> it's name out there? Perhaps they want to embarass Netscape for some
> reason? Since the details of the bug are not being released yet, how
> can it be verified? So why go to the press instead of a forum like this
> one? Surely there was some motive.
> 
> Meka Egwuekwe
> 
> Bryan K. Fite wrote:
> >
> > I have been actively looking for some verification of this exploit. I'm not
> saying it doesn't exist. But it is very strange the way it was handled. If I
> were the paranoid type, I would be very concerned by the motivation behind the
> story. Why tell the press and not Netscape? If indeed it effects all previous
> versions, we have been very slow to catch it (too preoccupied with M$?). Is
> this how information of this nature will be handled in the future? It's great
> that security is finally getting so
> >
> > Thanks,
> > Bryan K. Fite
> > www.secure-it.net
Hello all,

Normally I am proud to be danish and very pleased with our reputation in
the IT industry. But the recent incident and the behaviour of one of my
countrymen makes me feel ashamed.

This is no way to behave, this is doing no good for our country and any
kind of blackmail no matter the amount of $ will ever be looked upon as
something we like to be assimilated with in our normally peacefully little
country.

Personally I have never heard of the person(s) involved, I have never heard
of the company before and even though I have no permission to speak for my
employer I will never do bussiness with this company if I ever run into
them, no matter what.

Instead the alleged security bug should have been made public on this list
so that anyone interested (including NETSCAPE) could evaluate it, comment
it and suggest fixes which could benefit us all.

I'm sorry if some may look upon this message as a flame. This is not what I
normally do, but somebody just stepped way out of line.

Regards,

N. Werner Mortensen, University of Copenhagen, MFI
Blegdamsvej 3, DK-2200 Copenhagen N, Denmark
Phone: +45 3532 7520 Fax: +45 3532 7537
e-mail: werner@mfi.ku.dk (I prefer MIME & ISO-8859-1)



On Fri, 13 Jun 1997, Joel W. Barrett wrote:

> I installed MS Proxy Server last night and will eventually take the MS test for 
> it. I need to learn as much about it as possible so if anyone has questions 
> about it I'd be happy to figure out the answer for you.
> 
> I am currently using it as a network address translation (NAT) and dial-up 
> solution for a small home network with limited Internet accounts. It seems to 
> work very well. It did require MS IIS to be installed prior to its installation 
> but that was not a major hassle.
> 
> I can now do an internal FTP site, Intranet Web services, and a Gopher server 
> if I wanted.

Ok, here is one question for you! :)

On one location, I setted up MS Proxy, the same way you did. Small group
of NT stations go to internet trought dial up proxy machine. I even
enabled that auto connect thingie inside ms proxy. The problem is.... when
someone from the group want's to access some website, he contacts ms
proxy, ms proxy then dials internet, and there you have it. You are on
internet. BUT, I haven't been able to DISCONNECT it automaticaly eather
(eg. after 5 minutes of inactivity). Is this like but withing NT or MS
Proxy?

I used similar (crippled) software for same purpose: Wingate. It worked
like a dream. And it didn't cost so much. ;)


Thanx in advance
Neven

Query:

If a server is running Bind V4.9.4 P1 can it be set to non recursive
responses to fix the problem?

If so, how without rebuilding the executable. Can this be set in zone files
of what?

regards
kevin


Email: kevin@gocdo.net.au
web: http://www.gocdo.net.au

On Sat, 14 Jun 1997, James Strompolis wrote:

> They said they wanted money. Can't say I blame them. Probably costing 
> Netscape $10,000s to find it if they can. They should have coughed up the 
> dough.

That's akin to saying that if you spot a bomb in a train station you 
should be able to collect money for warning the authorities from all of 
the potential victims families. After all, they'd certainly pay well for 
the privilige of living, and it would cost the govenrment quite a lot to 
search all the train stations within fifteen minutes.

It's simply mercenary extortion, and Netscape shouldn't "cough up". The 
logical offshoot of this is someone charging companies to protect them 
from every single buglet in every single application under NDA, so the 
vendor never learns of the vulnerability. This is *not* a good trend.

As much as I hate to see Netscape with potential holes, I applaud them for
standing their ground.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

On Sat, 14 Jun 1997, N. Werner Mortensen wrote:

> Hello all,
> 
> Normally I am proud to be danish and very pleased with our reputation in
> the IT industry. But the recent incident and the behaviour of one of my
> countrymen makes me feel ashamed.

I don't think it reflects on Denmark as it does on the company 
concerned. I'll certainly ensure that any company I work for knows about 
their ethics. That won't affect how I view other Danish companies 
however. 

The fact that this is limited to Netscape 2.0 and higher means that it 
almost certainly must be a bug in the HTTP upload code, and hopefully it 
won't take Netscape or someone else too long to figure out and fix this 
problem. If I can find the time I'll certainly be modifying my HTTP 
upload CGIs next week to see if I can reproduce the bug. 

I am actually surprised that this is the first such incident, as the 
Microsoft bug-upon-bug fest a couple of months ago would have been a 
perfect target for someone to attempt this ploy. I'm more surprised that 
it wasn't one of my countrymen, as I'd wondered about this type of 
incident when the second MS IE bug hit. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Interesting because it was painted such a convincing picture of evil
"blackmailers" who are constantly plaguing big corporations with
revelations of flaws in their software? It is curious how a programmer
who discovered a security flaw is guilty of "extortion" and "blackmailing"
according to this reporter who obviously got all of his information from
Netscape security notices. How has the information that this programmer
discovered become the property of Netscape or anyone else that wishes to
know what the bug is? If this was true blackmail, he/she would be
threatening to post the full details of how to exploit the bug to the
public. Instead, all I have seen so far is a request for adequate
compensation for his/her work. Or a person-to-person meeting with a
Netscape representative.

PD
Whatever SOD did, it certainly didnt "plea" for a job from HP. More like
demand all expense paid ski trips with Heinekin babes.. I dont think SOD
intended those as demands.. more like a joke about the lengths the company
might go to to keep the easily discovered flaws in its software secret...

-vermont@gate.net

On Sat, 14 Jun 1997, Ivor Rankin wrote:

> There's another interesting (non-technical) article about this at the following URL:
> 
> http://www.sjmercury.com/business/netscape061297.htm
> 
> Regards.
> 

Here is some potentially relevant documentation concerning the Proxy Client. It 
sounds like you can use a different client for non-WinSock apps. Tell me if the 
following doesn't answer your question and I'll continue searching.


Web Proxy Client

The term Web Proxy client refers to a client computer whose Web browser is 
configured to use the Web Proxy service on a Microsoft Proxy Server. Usually, 
this is accomplished by running the client Setup program, as described in 
Installing Clients earlier in this chapter.

If the browser proxy settings configured by client Setup are not appropriate 
for a particular client, you can reconfigure that client's Web browser (by 
using the Web browser's own configuration interface) after installing the 
client software. Also, if a client's Web browser is not Microsoft Internet 
Explorer or Netscape Navigator, or if client Setup does not successfully 
configure a client's Web browser to use the Web Proxy service, then you must 
use the Web browser's own configuration interface to specify the name of the 
appropriate Microsoft Proxy Server and the protocol port number (usually 80).

Each browser is configured through its own user interface. Typically, an 
application's relevant settings are found in menu items called "Options," 
"Preferences," or "Settings." You can configure Internet Explorer by using the 
Internet application in Control Panel.

Configuring the Internet Application in Control Panel

When you run client Setup, it will configure Microsoft Internet Explorer 2.0 as 
a client of Microsoft Proxy Server. However, you can also use the Internet 
application in Control Panel to specify the name of the Microsoft Proxy Server 
and the protocol port number. Internet Explorer 2.0 uses the settings from the 
Internet application, but other client applications may have their own property 
sheets or dialog boxes for their proxy service settings.

Web Proxy Client Considerations

Following are some considerations about Web Proxy clients:

. Do not configure Helper applications (such as RealAudio clients) as Web Proxy 
clients.

Do not configure Helper applications to use the Web Proxy service. For example, 
the RealAudio player is used with the WinSock Proxy service. Do not configure 
the RealAudio client to use Microsoft Proxy Server. When configuring the 
RealAudio player, in the Proxy tab of the Preferences dialog box, specify no 
proxy.

. Proxy Configuration on IPX-only Clients

The Web browser of a client running only IPX (not running TCP) will not be able 
to connect to the Web Proxy service on Microsoft Proxy Server if Microsoft 
Proxy Server is defined in the browser by using a domain or computer name. This 
can be remedied by editing the client's Web browser configuration to specify an 
IP address (not a computer or domain name) for the proxy.

-Or-

When installing Microsoft Proxy Server, in the server Setup program's Client 
Installation/Configuration dialog box, for Web Proxy Client type an IP address 
instead of a computer or domain name.

Then, when a client computer runs client Setup from the server's share, if the 
client browser is Microsoft Internet Explorer or Netscape Navigator, client 
Setup attempts to configure that browser to use the IP address of the specified 
Microsoft Proxy Server.

Note that when assigning multiple computers running Microsoft Proxy Server to 
clients in this manner, balance the load between Microsoft Proxy Servers by 
appropriately adjusting the number of IPX-only clients assigned to each 
computer running Microsoft Proxy Server.

. Logons with 16-bit client software

A Domain Credentials dialog box may appear when you attempt to establish a 
connection using 16-bit client software from computers running the Microsoft 
Windows 95 or Microsoft Windows for Workgroups operating systems. To complete 
this dialog box and complete the connection request, supply a valid domain 
name, user name and password.

. Gopher and Gopher Plus

When a client sends a Gopher request, if the Gopher server supports Gopher 
Plus, then Gopher Plus tags are returned to the client by the Web Proxy 
service.



WinSock Proxy Clients

The term WinSock Proxy client refers to a client computer that is configured to 
use the Web Proxy service on a Microsoft Proxy Server. The WinSock Proxy client 
components are installed by running the client Setup program, as described in 
Installing Clients earlier in this chapter. The client Setup program does not 
configure individual Windows Sockets applications. Instead, the client computer 
is configured to use the WinSock Proxy service on a server. All Windows Sockets 
applications on that computer access the Internet through the WinSock Proxy 
service on Microsoft Proxy Server.

The WinSock Proxy service supports Windows Sockets version 1.1 applications. 
Before a Windows Sockets application can access the Internet through Microsoft 
Proxy Server, the server must be configured to permit access for the required 
protocol on the required outbound and inbound ports. For details on configuring 
server support for particular Windows Sockets client applications, see Chapter 
7, "Configuring the WinSock Proxy Service."

In a private network with multiple Microsoft Proxy Server gateways, install an 
equal number of WinSock Proxy clients from each gateway to balance Internet 
traffic across all the gateways. For information about configuring multiple 
Microsoft Proxy Server gateways, see Chapter 5, "Server Administration."

WinSock Proxy Client Considerations

Following are some considerations for WinSock Proxy client computers:

. Do not set Windows Sockets client applications to use Microsoft Proxy Server

Even if the configuration parameters for the application allow it, do not set a 
Windows Sockets application on a computer configured as a WinSock Proxy client 
to use Microsoft Proxy Server.

. Do not install Microsoft Exchange Server on WinSock Proxy clients

Microsoft Exchange client software and WinSock Proxy client software can be 
installed on the same computer. However, do not install Microsoft Exchange 
Server software and WinSock Proxy client software on the same computer.

. Logon procedure with 16-bit client software

A Domain Credentials dialog box may appear when you attempt to establish a 
connection by using 16-bit client software from computers running the Microsoft 
Windows 95 or Microsoft Windows for Workgroups operating systems. To complete 
this dialog box and complete the connection request, supply a valid domain 
name, user name, and password.

. Upgrading the operating system on Windows NT clients

If the Microsoft Proxy Server client software is installed on a computer that 
runs the Windows NT operating system, and the operating system is later 
upgraded, the WinSock Proxy client software will be disabled. To re-enable the 
computer as an WinSock Proxy client, reinstall the client software by running 
the client Setup program as described in Installing Clients, earlier in this 
chapter.

This could occur, for example, if you install the Microsoft Proxy Server client 
software on a computer running the Windows NT Workstation 3.51 operating 
system, and then upgrade that computer to Windows NT Workstation version 4.0.


--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Nick Keenan [SMTP:nick@gsionline.com]
Sent: Friday, June 13, 1997 12:28 PM
To: ntsecurity@iss.net
Subject: [NTSEC] MS Proxy server and mapped links/plugs

[This is a rephrasing of an earlier question that got no responses] 

I have a client who is using MS Proxy server, and wants to use non-Windows
clients. Is it possible to set up MS Proxy server so that you don't need
to use the ms-proxy client -- i.e. to use SOCKS or mapped links?

Any clues are appreciated.

Thanks
I am working on an answer for the exact same question you posed. I haven't yet 
found a parameter in Proxy of RAS Dial-up which will disconnect after a 
predefined period of time of inactivity. I will find something soon though. The 
problem is that Proxy is so new that there aren't many things written about it 
yet.

I agree that there are many products out there for dial-up proxy use that are 
currently viable alternatives to MS Proxy. I was using WebEtc until it expired 
about a week ago.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
Sent: Saturday, June 14, 1997 5:05 AM
To: Joel W. Barrett
Cc: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA MCSE Study 
Group (E-mail)
Subject: Re: [NTSEC] MS Proxy Server



On Fri, 13 Jun 1997, Joel W. Barrett wrote:

> I installed MS Proxy Server last night and will eventually take the MS test 
for
> it. I need to learn as much about it as possible so if anyone has questions
> about it I'd be happy to figure out the answer for you.
>
> I am currently using it as a network address translation (NAT) and dial-up
> solution for a small home network with limited Internet accounts. It seems to 
> work very well. It did require MS IIS to be installed prior to its 
installation
> but that was not a major hassle.
>
> I can now do an internal FTP site, Intranet Web services, and a Gopher server 
> if I wanted.

Ok, here is one question for you! :)

On one location, I setted up MS Proxy, the same way you did. Small group
of NT stations go to internet trought dial up proxy machine. I even
enabled that auto connect thingie inside ms proxy. The problem is.... when
someone from the group want's to access some website, he contacts ms
proxy, ms proxy then dials internet, and there you have it. You are on
internet. BUT, I haven't been able to DISCONNECT it automaticaly eather
(eg. after 5 minutes of inactivity). Is this like but withing NT or MS
Proxy?

I used similar (crippled) software for same purpose: Wingate. It worked
like a dream. And it didn't cost so much. ;)


Thanx in advance
Neven
Joel,

On Sat, 14 Jun 1997, Joel W. Barrett wrote:

> found a parameter in Proxy of RAS Dial-up which will disconnect after a 
> predefined period of time of inactivity. I will find something soon though. The 
...
> I agree that there are many products out there for dial-up proxy use that are 
> currently viable alternatives to MS Proxy. I was using WebEtc until it expired 
> about a week ago.

Something that doesn't look like it will expire (prices are mentioned in
any_currency): 

linux with or w/o masquerading in its kernel : 0
squid : 0
diald : 0

Beware though: this is quite general, there is a latency between the
moment someone asks for a not-yet-cached page when the modemlink is "down"
and actually getting the page through. At least 30 seconds you should
take, for handshaking with the other modem.

Take ISDN and you won't be able to tell whether it was from the line or
from the Net.

kr=
 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)




This is the thing that has been bothering me the most. There should be some kind of "code of conduct"/ethics among this segment of the industry. If we really want to responsibly raise awareness there are better tactics. We need to soften our elitist reputations. Blackmail is not the answer. It is the least imaginative way to do it! My job would be made a thousand times easier if I could employ those kinds of techniques.

Having said that, it may be the only pressure a single entity has to exert. I had to do a lot of soul searching on this one. It think I harbor a double standard. When we flame Microsoft or expose another bug/hole, I smile. When Netscape is in trouble I fret. I have no vested interest in either. So why do I feel this way?

Maybe it has to do with culture clash; nethead vs. bellhead, academic vs. business, centralized vs. distributed. I do know.

I do know if we want people to take us seriously we need some credibility. Finding holes proves our technical prowess. How we handle that information speaks to our intent and maturity!

Singed.
Bryan "troubled" Fite
www.secure-it.net

----------
From: N. Werner Mortensen
Sent: Saturday, June 14, 1997 3:43 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Netscape Bug found by Danish Company

Hello all,

Normally I am proud to be danish and very pleased with our reputation in
the IT industry. But the recent incident and the behaviour of one of my
countrymen makes me feel ashamed.

This is no way to behave, this is doing no good for our country and any
kind of blackmail no matter the amount of $ will ever be looked upon as
something we like to be assimilated with in our normally peacefully little
country.

Personally I have never heard of the person(s) involved, I have never heard
of the company before and even though I have no permission to speak for my
employer I will never do bussiness with this company if I ever run into
them, no matter what.

Instead the alleged security bug should have been made public on this list
so that anyone interested (including NETSCAPE) could evaluate it, comment
it and suggest fixes which could benefit us all.

I'm sorry if some may look upon this message as a flame. This is not what I
normally do, but somebody just stepped way out of line.

Regards,

N. Werner Mortensen, University of Copenhagen, MFI
Blegdamsvej 3, DK-2200 Copenhagen N, Denmark
Phone: +45 3532 7520 Fax: +45 3532 7537
e-mail: werner@mfi.ku.dk (I prefer MIME & ISO-8859-1)




On Fri, 13 Jun 1997, Patrick Sanger wrote:

> that wouldn't be a netscape security hole that would be a winnt hole. 
> the netscape process is running on behalf of the user that started it, 
> so just like any other program it would have the same access rights as 
> the user running it. this doesn't lessen the risk because most of us are 
> logged on as Administrator anyway.
> 
> Patrick

Most of us aren't so foolish. You should not use an admin/root account
unless it is necessary, and never for things like web browsing. This is
not NT-specific; no good UNIX sysadmin logs in as root for non-root
activities either; this is fairly standard as a security practice.

Set up a standard user account for yourself, and only use admin
privileged accounts when you must. 

-r.w.

The timeout setting is controlled from within RAS, not the Proxy Server.
Go to Dialup Networking | More | User Preferences to set a timeout.

If you are using ISDN, I suggest using an Ascend Pipeline (with the
Secure Access Firewall) instead of an ISDN modem since it is more secure
and just works better. I have found that RAS gets broken very easily
and is therefore not as reliable. You will need an account with an ISP
that can give you 2 IP addresses, one for the Pipeline and one for the
Proxy Server. We resell fully configured units for about $1,300 if
anyone is interested.

Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
 Sent: Saturday, June 14, 1997 4:05 AM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server


 Ok, here is one question for you! :)

 On one location, I setted up MS Proxy, the same way you did.
Small group
 of NT stations go to internet trought dial up proxy machine. I
even
 enabled that auto connect thingie inside ms proxy. The problem
is.... when
 someone from the group want's to access some website, he
contacts ms
 proxy, ms proxy then dials internet, and there you have it. You
are on
 internet. BUT, I haven't been able to DISCONNECT it automaticaly
eather
 (eg. after 5 minutes of inactivity). Is this like but withing NT
or MS
 Proxy?

 I used similar (crippled) software for same purpose: Wingate. It
worked
 like a dream. And it didn't cost so much. ;)


 Thanx in advance
 Neven

To use the Winsock Proxy, the workstation must be using a Microsoft
Client and be logged in to the MS domain because it needs access to the
\\proxy\mspclnt share on the Proxy Server. A workstation can still use
the Web Proxy without using the MS Client. You can test this by
removing access rights to Users or Everyone and trying to use a Winsock
application as a Domain User, then try it as a Domain Administrator. I
discovered this by accident and confirmed it with MS tech support.
Sorry for the wrong answer!


Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Nick Keenan [SMTP:nick@gsionline.com]
 Sent: Friday, June 13, 1997 11:28 AM
 To: ntsecurity@iss.net
 Subject: [NTSEC] MS Proxy server and mapped links/plugs

 [This is a rephrasing of an earlier question that got no
responses] 

 I have a client who is using MS Proxy server, and wants to use
non-Windows
 clients. Is it possible to set up MS Proxy server so that you
don't need
 to use the ms-proxy client -- i.e. to use SOCKS or mapped links?

 Any clues are appreciated.

 Thanks


Okay...here's a good one. I recently took an abbreviated Proxy course
and one thing that was unclear to all present was....since MS Proxy is
NOT a firewall, it will in most case work in line with a firewall.
 
Question: Should the proxy server be on the outside of the firewall? 
If so, does it affect the ability of a firewall that does Network
Address Translation. In this case the firewall is passing to the Proxy
server a single IP (I presume). Is it able to keep the individual
sessions separate?

The same sort of question also exists if you put the proxy server on the
inside of the firewall. If the proxy server is passing off (the
presumed) single IP, how does the firewall keep track of the sessions of
the (800) internal clients on our network?


Noone at the session (including the instructor) had a good grasp of how
the MS Proxy fits within a traditional "Outer DMZ" architecture. If you
have any input on this, I'd be interested.....


Jack LeGrand
jackl@infi.net


****************************************

Joel W. Barrett wrote:
> 
> I installed MS Proxy Server last night and will eventually take the MS test for
> it. I need to learn as much about it as possible so if anyone has questions
> about it I'd be happy to figure out the answer for you.
> 
> I am currently using it as a network address translation (NAT) and dial-up
> solution for a small home network with limited Internet accounts. It seems to
> work very well. It did require MS IIS to be installed prior to its installation
> but that was not a major hassle.
> 
> I can now do an internal FTP site, Intranet Web services, and a Gopher server
> if I wanted.
> 
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!

-- 
Jack LeGrand
TeleGrand Technologies
jack.legrand@telegrand.com
A Strategic Business Partner of Blue Ridge Interactive
This may not apply but with RAS you can set the inactivity timer (I
believe - I am not at the server right now) under Control Panel-Modem.

jack

Joel W. Barrett wrote:
> 
> I am working on an answer for the exact same question you posed. I haven't yet
> found a parameter in Proxy of RAS Dial-up which will disconnect after a
> predefined period of time of inactivity. I will find something soon though. The
> problem is that Proxy is so new that there aren't many things written about it
> yet.
> 
> I agree that there are many products out there for dial-up proxy use that are
> currently viable alternatives to MS Proxy. I was using WebEtc until it expired
> about a week ago.
> 
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!
> 
> -----Original Message-----
> From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
> Sent: Saturday, June 14, 1997 5:05 AM
> To: Joel W. Barrett
> Cc: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA MCSE Study
> Group (E-mail)
> Subject: Re: [NTSEC] MS Proxy Server
> 
> On Fri, 13 Jun 1997, Joel W. Barrett wrote:
> 
> > I installed MS Proxy Server last night and will eventually take the MS test
> for
> > it. I need to learn as much about it as possible so if anyone has questions
> > about it I'd be happy to figure out the answer for you.
> >
> > I am currently using it as a network address translation (NAT) and dial-up
> > solution for a small home network with limited Internet accounts. It seems to
> > work very well. It did require MS IIS to be installed prior to its
> installation
> > but that was not a major hassle.
> >
> > I can now do an internal FTP site, Intranet Web services, and a Gopher server
> > if I wanted.
> 
> Ok, here is one question for you! :)
> 
> On one location, I setted up MS Proxy, the same way you did. Small group
> of NT stations go to internet trought dial up proxy machine. I even
> enabled that auto connect thingie inside ms proxy. The problem is.... when
> someone from the group want's to access some website, he contacts ms
> proxy, ms proxy then dials internet, and there you have it. You are on
> internet. BUT, I haven't been able to DISCONNECT it automaticaly eather
> (eg. after 5 minutes of inactivity). Is this like but withing NT or MS
> Proxy?
> 
> I used similar (crippled) software for same purpose: Wingate. It worked
> like a dream. And it didn't cost so much. ;)
> 
> Thanx in advance
> Neven
> 
> >From owner-bsdi-users@lists.firehouse.net Sat Jun 14 12:33:33 1997

-- 
Jack LeGrand
TeleGrand Technologies
jack.legrand@telegrand.com
A Strategic Business Partner of Blue Ridge Interactive
It is extortion. No doubt. But, it would have cost Netscape very little to 
have paid these folks for their time and saved themselves the publicity. 
Happens all the time in every type of business. Not linked to computing at 
all. Just my opinion. My last off topic message.

----------
From: Paul D. Robertson
Sent: Saturday, June 14, 1997 5:42 AM
To: James Strompolis
Cc: Meka Egwuekwe; ntsecurity@iss.net
Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug

On Sat, 14 Jun 1997, James Strompolis wrote:

> They said they wanted money. Can't say I blame them. Probably costing 
> Netscape $10,000s to find it if they can. They should have coughed up the 
> dough.

That's akin to saying that if you spot a bomb in a train station you 
should be able to collect money for warning the authorities from all of 
the potential victims families. After all, they'd certainly pay well for 
the privilige of living, and it would cost the govenrment quite a lot to 
search all the train stations within fifteen minutes.

It's simply mercenary extortion, and Netscape shouldn't "cough up". The 
logical offshoot of this is someone charging companies to protect them 
from every single buglet in every single application under NDA, so the 
vendor never learns of the vulnerability. This is *not* a good trend.

As much as I hate to see Netscape with potential holes, I applaud them for
standing their ground.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280





----------
From: owner-ntsecurity@iss.net on behalf of Paul D. Robertson
Sent: Saturday, June 14, 1997 5:42 AM
To: James Strompolis
Cc: Meka Egwuekwe; ntsecurity@iss.net
Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug

On Sat, 14 Jun 1997, James Strompolis wrote:

> They said they wanted money. Can't say I blame them. Probably costing 
> Netscape $10,000s to find it if they can. They should have coughed up the 
> dough.

That's akin to saying that if you spot a bomb in a train station you 
should be able to collect money for warning the authorities from all of 
the potential victims families. After all, they'd certainly pay well for 
the privilige of living, and it would cost the govenrment quite a lot to 
search all the train stations within fifteen minutes.

It's simply mercenary extortion, and Netscape shouldn't "cough up". The 
logical offshoot of this is someone charging companies to protect them 
from every single buglet in every single application under NDA, so the 
vendor never learns of the vulnerability. This is *not* a good trend.

As much as I hate to see Netscape with potential holes, I applaud them for
standing their ground.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280


Hello All,

This is my first mail to this list,so please 'pardon my french'.

Two things that puzzels me:

1). I've installed NT ras server in my domain, which enables 
remote users to dial into the domain and get a random
i.p from the server.
The problem is that the user cannot browse the network and use
share resorces (Disks and printers Etc...)
What should i do to enable it ?

2). I've heared that there is a way to get into any domain
by using Netbuei + WINS, if i add the desired domain name to 
the hosts file (used by WINS) and manipulate the Trust relationship in
'User manager for domain' as trusted,
then i can browse its remote resorces. 
What should i do to establish it ?

TIA,

Kahan Guy
Netware NT Sys Admin.
Netvision Wan Team.
E-mail : gkahan@netvision.net.il
web: http://www.netvision.net.il
"Some fear what they do not understand ...
I understand what they fear!"
 
> Date: Fri, 13 Jun 1997 21:14:32 +0200 (MET DST)
> From: Jaromir Dolecek 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> Bryan K. Fite wrote:
> > I have been actively looking for some verification of this exploit.
> > I'm not saying it doesn't exist. But it is very strange the way it was
> > handled. If I were the paranoid type, I would be very concerned by
> > the motivation behind the story. Why tell the press and not Netscape?
> > If indeed it effects all previous versions, we have been very slow
> > to catch it (too preoccupied with M$?). Is this how information of
> > this nature will be handled in the future? It's great that security is
> > finally getting some airtime, however, the media tend to create more
> > problems then awareness. Your comments on this matter are requested.
> >
> >
> 
> It's very very strange it goes up just in time Communicator is about
> to fully release. I wouldn't be suprised to hear it's a twist.
> Maybe it's paranoid to see M$ behind each corner, but it's clean
> they like Netscape to have as much bugs as it should - even if some
> of them have to be fake. Strange is CNNfn and PC Magazine is cooperating
> w/ it - too much people for story to be simply not true. Something is rotten
> in this issue, at least from my point of view.
> 
> I don't know of any feature of Netscape 1.0 which should
> be used for exploit. No JavaScript, no Java, no file upload, just
> HTTP/1.0 compliance. It hasn't have even bookmarks and it has had
> just a small configation file and cache. And this bug should affect
> all Netscape browsers ... it's strange.
> 
> jd
> - -- 
> Jaromir Dolecek 
> dolecek@ics.muni.cz
> http://www.ics.muni.cz/~dolecek/
> 
> ------------------------------
> 
> Date: Sat, 14 Jun 1997 00:04:23 +-200
> From: Ivor Rankin 
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> There's another interesting (non-technical) article about this at the following URL:
> 
> http://www.sjmercury.com/business/netscape061297.htm
> 
> Regards.
> 
> ------------------------------
> 
> Date: Fri, 13 Jun 1997 17:02:25 PDT
> From: "Patrick Sanger" 
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> that wouldn't be a netscape security hole that would be a winnt hole. 
> the netscape process is running on behalf of the user that started it, 
> so just like any other program it would have the same access rights as 
> the user running it. this doesn't lessen the risk because most of us are 
> logged on as Administrator anyway.
> 
> Patrick
> 
> >
> >One question not answered is: which files? Can they get files
> >that current user cannot read, etc. due to ACL entries? If they
> >could, that would be a big deal.
> >
> >John
> >
> >Center for High Assurance Computer Systems
> >Naval Research Laboratory
> >
> ------------------------------
> 
> Date: Fri, 13 Jun 1997 18:01:21 -0700
> From: Chris Plunkett 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> > >I have been actively looking for some verification of this exploit.
> > >I'm not saying it doesn't exist. But it is very strange the way it
> > >was handled.
> > 
> > I was able to find links from the CNN home page http://cnn.com and
> > Netscape's home page... There seems to be something there worth
> > looking
> > closer... how much remains to be seen. Here are the articles I found
> > (URLs
> > may have a very short life)...
> > 
> > Netscape Security Update:
> > http://home.netscape.com/misc/security_update.html
> > 
> > CNNfn: Netscape bug uncovered: Danish software firm finds flaw that
> > could
> > let sites see data stored on PCs
> > http://cnnfn.com/digitaljam/9706/12/netscape_pkg/
> > 
> > PC Magazine Online: Netscape Security Flaw: A bug lets curious
> > webmasters
> > read files from your hard disk when you surf with Navigator.
> > http://www8.zdnet.com/pcmag/news/trends/t970612b.htm
> > 
> > 
> > ps. It may be tradition that firms rush to market with often buggy
> > products, to maximize their profits, and their customers hassle with
> > (and
> > pay for) the impact of the bugs. My heart goes out to anybody who says
> > "hey-wait a minute!"
> 
> There seems to be another link that I have found that mentions this,
> It is from Mercury Center, however I'm not sure what Mercury Center is
> http://www.sjmercury.com/business/netscape061297.htm

 The Mercury Center is the online edition/department of the
 San Jose Mercury News -- from the San Jose, California
 area (near the silicon valley -- the heart of the microcomputer
 industry).

 They have just about the best coverage of the field that you 
 can find in a mainstream daily newspaper.

> It tends to put the story is a slightly different light that the others
> from PC Magazine and CNN.
> 
> By the way, has anyone considered the possibility of the javascript
> "mailto:" function attaching a file without any user input?
> - -- 
> - ------------------------------------------------------------
> Chris Plunkett System Technician
> Breakwater Technologies Inc.
> phone:(425)803-5002x112 Fax:(425)803-5001
> http://www.breakwater.net mailto:chris@breakwater.net
> 
> ------------------------------
> 
> Date: Fri, 13 Jun 1997 19:01:21 -0700
> From: randall g 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> At 11:25 AM 6/13/97 -0400, you wrote:
> >I too think that it is quite strange the way this was handled. And I
> >have a slew of questions. Perhaps that Danish company was trying to get
> >it's name out there? Perhaps they want to embarass Netscape for some
> >reason? Since the details of the bug are not being released yet, how
> >can it be verified? So why go to the press instead of a forum like this
> >one? Surely there was some motive.
> >
> >Meka Egwuekwe
> 
> 
> Here's my take:
> 
> This Cabocomm guy finds or invents a bug in Netscape. (I'm still skeptical
> there is one - the file upload capability should be controlled only by the
> user, not on command of the server. If it turns out that Netscape can be
> made to upload files on command of the server, it's probably not a bug, but
> intentional, which is a chilling thought.)
> 
> He already knows Netscape's reward for such is $1000 which is pitifully
> stupid on Netscape's part IMO. It should be $100,000 for a bug like this.
> 
> So he does the best thing. He calls CNN which now has a world wide scoop on
> a Netscape bug, just as the Intenet and Netscape and Microsoft are getting
> more and more public interest. That's where I heard it first. This list
> usually knows about stuff like this before the press gives a shit.
> 
> CNN pays for that sort of thing. All news agencies do. I have no idea how
> much but I bet it's a hell of a lot more than $1000.
> 
> Any thoughts?

 I don't believe that CNN or "all news agencies" pays people
 who are involved in news stories. This would seriously 
 undermine the credibility of the organization -- and is 
 definitely against the ethics of journalism.

 (Not that I think the field of journalism attracts people
 of a high ethical caliber -- but they are generally several
 notches above the typical politician in this regard).

> ------------------------------
> 
> Date: Sat, 14 Jun 97 02:57:35 UT
> From: "James Strompolis" 
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> They said they wanted money. Can't say I blame them. Probably costing 
> Netscape $10,000s to find it if they can. They should have coughed up the 
> dough.
> 
> - ----------
> From: owner-ntsecurity@iss.net on behalf of Meka Egwuekwe
> Sent: Friday, June 13, 1997 10:25 AM
> To: Bryan K. Fite
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> I too think that it is quite strange the way this was handled. And I
> have a slew of questions. Perhaps that Danish company was trying to get
> it's name out there? Perhaps they want to embarass Netscape for some
> reason? Since the details of the bug are not being released yet, how
> can it be verified? So why go to the press instead of a forum like this
> one? Surely there was some motive.
> 
> Meka Egwuekwe
> 
> Bryan K. Fite wrote:
>> 
>> I have been actively looking for some verification of this exploit. I'm
> not saying it doesn't exist. But it is very strange the way it was
> handled. If I were the paranoid type, I would be very concerned by
> the motivation behind the story. Why tell the press and not Netscape?
> If indeed it effects all previous versions, we have been very slow
> to catch it (too preoccupied with M$?). Is this how information of
> this nature will be handled in the future? It's great that security
> is finally getting so > > Thanks, > Bryan K. Fite > www.secure-it.net

> ------------------------------

> Date: Sat, 14 Jun 1997 00:45:30 -0400 From: "Jeff Fry" 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

> This is the information that I have on the Netscape story. It seems =
> that they do not want to let him talk to the person that is in charge
> of the Bug Reward that Netscape has...

> MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1997 JUN 13 (NB) -- By Patrick =
> McKenna. "Let me talk to the guy with the checkbook," wrote an unnamed =
> Danish programmer who created a non-public World Wide Web site which =
> allows the site operator to copy files from the hard disk of any user of
> Netscape's [NASDAQ:NSCP ] Web browser Navigator accessing the site. He
> contacted Netscape through e-mail earlier this week, but refused to =
> divulge his Navigator bug-find for a customary Netscape fee of $1,000.
> "We want all Navigator users to know that we take all bug reports =
> seriously and our engineers are working on this problem right now,"
> began Netscape spokesperson, Jennifer O'Mahoney. "At this time,
> there are no reported incidents of this reported bug affecting
> any Navigator user accessing public or intranet Web sites. The
> probability of it affecting these users is very low. " According
> to Netscape, communication with the programmer has been limited to
> e-mail. After refusing to put him in touch with the "guy with the
> checkbook," Netscape was warned the information would be revealed to =
> the media. Cable News Network (CNN) was contacted by the programmer
> and given a demonstration of the bug through a non-public Web site
> designed by the programmer. The bug was confirmed by PC Magazine.
> Although Netscape has not been able to internally examine and confirm =
> the "briber bug," the Internet/intranet software developer has assumed
> the CNN demonstration was successfully completed. According to
> reports, from the programmer and CNN, a navigator user visiting the
> site in question opens his or her hard disk to the operator. The
> site operator, however, must know specific file names to access
> any information on a user's hard disk. Which version or versions of
> Navigator are susceptible to the bug are currently unknown, but one =
> report says the Dane claims version 2.0 and all later versions contain =
> the programming flaw. The Dane chose to pressure Netscape during the
> company's developer conference in San Jose, California. In spite of
> the timing, Netscape remained adamant in its response. "We will not
> be blackmailed or allow an individual or group to hold us hostage,"
> added O'Mahoney. She also told Newsbytes, "We will keep everyone
> posted of this situation throughout today and following days on
> our Web site (http://home.netscape.com )." Once on Netscape's home
> page click on "Flash Items." No discussions of specific amounts of
> money have occurred between the unnamed programmer and Netscape.
> (19970612/Press Contact: Jennifer O'Mahoney, Netscape, tel 415-528- =
> 2619; Reported by Newsbytes News Network: http://www.newsbytes.com =
> /NETSCAPELOGO/PHOTO)

> "The Pulse of the Information Age" Newsbytes News Network =
> http://www.newsbytes.com 24-hour computer, telecom and online news =A9
> 1997 Newsbytes =20 Jeffrey Fry CNA, A+ Certified Technician chec@itw.com
> fry@mapeaston.com http://www.itw.com/~chec
> ----
> From: Meka Egwuekwe To: Bryan K. Fite
> Cc: ntsecurity@iss.net Date: Friday, June
> 13, 1997 22:31 Subject: Re: [NTSEC] FW: Danish software firm finds
> Netscape bug

> I too think that it is quite strange the way this was handled. And I
> have a slew of questions. Perhaps that Danish company was trying to
> get it's name out there? Perhaps they want to embarass Netscape for
> some reason? Since the details of the bug are not being released yet,
> how can it be verified? So why go to the press instead of a forum
> like this one? Surely there was some motive.

> Meka Egwuekwe


 I think it's clear that the the Dane is trying blackmail.
 Contacting CNN and other journalists is for notoriety and
 to put on the pressure.

 I agree with Netscape -- the bug must be found -- but the
 blackmailer must not be payed.

 (BTW: There are ways to tactfully open negotiations with a
 company if you have a legitimate item of interest to them
 -- and they don't involve the use of phrases like:
 "they guy with the checkbook").


> Date: Sat, 14 Jun 1997 00:54:04 -0400 From: "Jeff Fry" 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

> http://www.newsbytes.com/3.html Full story at that address, also =
> http://home.netscape.com/misc/security_update.html is where the =
> information that Netscape has provided on the subject is posted.
> It is said to affect Netscapes version 2.0 and above.

> Jeffrey Fry CNA, A+ Certified Technician chec@itw.com fry@mapeaston.com
> http://www.itw.com/~chec




 
> Date: Fri, 13 Jun 1997 21:14:32 +0200 (MET DST)
> From: Jaromir Dolecek 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> Bryan K. Fite wrote:
> > I have been actively looking for some verification of this exploit.
> > I'm not saying it doesn't exist. But it is very strange the way it was
> > handled. If I were the paranoid type, I would be very concerned by
> > the motivation behind the story. Why tell the press and not Netscape?
> > If indeed it effects all previous versions, we have been very slow
> > to catch it (too preoccupied with M$?). Is this how information of
> > this nature will be handled in the future? It's great that security is
> > finally getting some airtime, however, the media tend to create more
> > problems then awareness. Your comments on this matter are requested.
> >
> >
> 
> It's very very strange it goes up just in time Communicator is about
> to fully release. I wouldn't be suprised to hear it's a twist.
> Maybe it's paranoid to see M$ behind each corner, but it's clean
> they like Netscape to have as much bugs as it should - even if some
> of them have to be fake. Strange is CNNfn and PC Magazine is cooperating
> w/ it - too much people for story to be simply not true. Something is rotten
> in this issue, at least from my point of view.
> 
> I don't know of any feature of Netscape 1.0 which should
> be used for exploit. No JavaScript, no Java, no file upload, just
> HTTP/1.0 compliance. It hasn't have even bookmarks and it has had
> just a small configation file and cache. And this bug should affect
> all Netscape browsers ... it's strange.
> 
> jd
> - -- 
> Jaromir Dolecek 
> dolecek@ics.muni.cz
> http://www.ics.muni.cz/~dolecek/
> 
> ------------------------------
> 
> Date: Sat, 14 Jun 1997 00:04:23 +-200
> From: Ivor Rankin 
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> There's another interesting (non-technical) article about this at the following URL:
> 
> http://www.sjmercury.com/business/netscape061297.htm
> 
> Regards.
> 
> ------------------------------
> 
> Date: Fri, 13 Jun 1997 17:02:25 PDT
> From: "Patrick Sanger" 
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> that wouldn't be a netscape security hole that would be a winnt hole. 
> the netscape process is running on behalf of the user that started it, 
> so just like any other program it would have the same access rights as 
> the user running it. this doesn't lessen the risk because most of us are 
> logged on as Administrator anyway.
> 
> Patrick
> 
> >
> >One question not answered is: which files? Can they get files
> >that current user cannot read, etc. due to ACL entries? If they
> >could, that would be a big deal.
> >
> >John
> >
> >Center for High Assurance Computer Systems
> >Naval Research Laboratory
> >
> ------------------------------
> 
> Date: Fri, 13 Jun 1997 18:01:21 -0700
> From: Chris Plunkett 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> > >I have been actively looking for some verification of this exploit.
> > >I'm not saying it doesn't exist. But it is very strange the way it
> > >was handled.
> > 
> > I was able to find links from the CNN home page http://cnn.com and
> > Netscape's home page... There seems to be something there worth
> > looking
> > closer... how much remains to be seen. Here are the articles I found
> > (URLs
> > may have a very short life)...
> > 
> > Netscape Security Update:
> > http://home.netscape.com/misc/security_update.html
> > 
> > CNNfn: Netscape bug uncovered: Danish software firm finds flaw that
> > could
> > let sites see data stored on PCs
> > http://cnnfn.com/digitaljam/9706/12/netscape_pkg/
> > 
> > PC Magazine Online: Netscape Security Flaw: A bug lets curious
> > webmasters
> > read files from your hard disk when you surf with Navigator.
> > http://www8.zdnet.com/pcmag/news/trends/t970612b.htm
> > 
> > 
> > ps. It may be tradition that firms rush to market with often buggy
> > products, to maximize their profits, and their customers hassle with
> > (and
> > pay for) the impact of the bugs. My heart goes out to anybody who says
> > "hey-wait a minute!"
> 
> There seems to be another link that I have found that mentions this,
> It is from Mercury Center, however I'm not sure what Mercury Center is
> http://www.sjmercury.com/business/netscape061297.htm

 The Mercury Center is the online edition/department of the
 San Jose Mercury News -- from the San Jose, California
 area (near the silicon valley -- the heart of the microcomputer
 industry).

 They have just about the best coverage of the field that you 
 can find in a mainstream daily newspaper.

> It tends to put the story is a slightly different light that the others
> from PC Magazine and CNN.
> 
> By the way, has anyone considered the possibility of the javascript
> "mailto:" function attaching a file without any user input?
> - -- 
> - ------------------------------------------------------------
> Chris Plunkett System Technician
> Breakwater Technologies Inc.
> phone:(425)803-5002x112 Fax:(425)803-5001
> http://www.breakwater.net mailto:chris@breakwater.net
> 
> ------------------------------
> 
> Date: Fri, 13 Jun 1997 19:01:21 -0700
> From: randall g 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> At 11:25 AM 6/13/97 -0400, you wrote:
> >I too think that it is quite strange the way this was handled. And I
> >have a slew of questions. Perhaps that Danish company was trying to get
> >it's name out there? Perhaps they want to embarass Netscape for some
> >reason? Since the details of the bug are not being released yet, how
> >can it be verified? So why go to the press instead of a forum like this
> >one? Surely there was some motive.
> >
> >Meka Egwuekwe
> 
> 
> Here's my take:
> 
> This Cabocomm guy finds or invents a bug in Netscape. (I'm still skeptical
> there is one - the file upload capability should be controlled only by the
> user, not on command of the server. If it turns out that Netscape can be
> made to upload files on command of the server, it's probably not a bug, but
> intentional, which is a chilling thought.)
> 
> He already knows Netscape's reward for such is $1000 which is pitifully
> stupid on Netscape's part IMO. It should be $100,000 for a bug like this.
> 
> So he does the best thing. He calls CNN which now has a world wide scoop on
> a Netscape bug, just as the Intenet and Netscape and Microsoft are getting
> more and more public interest. That's where I heard it first. This list
> usually knows about stuff like this before the press gives a shit.
> 
> CNN pays for that sort of thing. All news agencies do. I have no idea how
> much but I bet it's a hell of a lot more than $1000.
> 
> Any thoughts?

 I don't believe that CNN or "all news agencies" pays people
 who are involved in news stories. This would seriously 
 undermine the credibility of the organization -- and is 
 definitely against the ethics of journalism.

 (Not that I think the field of journalism attracts people
 of a high ethical caliber -- but they are generally several
 notches above the typical politician in this regard).

> ------------------------------
> 
> Date: Sat, 14 Jun 97 02:57:35 UT
> From: "James Strompolis" 
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> They said they wanted money. Can't say I blame them. Probably costing 
> Netscape $10,000s to find it if they can. They should have coughed up the 
> dough.
> 
> - ----------
> From: owner-ntsecurity@iss.net on behalf of Meka Egwuekwe
> Sent: Friday, June 13, 1997 10:25 AM
> To: Bryan K. Fite
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> I too think that it is quite strange the way this was handled. And I
> have a slew of questions. Perhaps that Danish company was trying to get
> it's name out there? Perhaps they want to embarass Netscape for some
> reason? Since the details of the bug are not being released yet, how
> can it be verified? So why go to the press instead of a forum like this
> one? Surely there was some motive.
> 
> Meka Egwuekwe
> 
> Bryan K. Fite wrote:
>> 
>> I have been actively looking for some verification of this exploit. I'm
> not saying it doesn't exist. But it is very strange the way it was
> handled. If I were the paranoid type, I would be very concerned by
> the motivation behind the story. Why tell the press and not Netscape?
> If indeed it effects all previous versions, we have been very slow
> to catch it (too preoccupied with M$?). Is this how information of
> this nature will be handled in the future? It's great that security
> is finally getting so > > Thanks, > Bryan K. Fite > www.secure-it.net

> ------------------------------

> Date: Sat, 14 Jun 1997 00:45:30 -0400 From: "Jeff Fry" 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

> This is the information that I have on the Netscape story. It seems =
> that they do not want to let him talk to the person that is in charge
> of the Bug Reward that Netscape has...

> MOUNTAIN VIEW, CALIFORNIA, U.S.A., 1997 JUN 13 (NB) -- By Patrick =
> McKenna. "Let me talk to the guy with the checkbook," wrote an unnamed =
> Danish programmer who created a non-public World Wide Web site which =
> allows the site operator to copy files from the hard disk of any user of
> Netscape's [NASDAQ:NSCP ] Web browser Navigator accessing the site. He
> contacted Netscape through e-mail earlier this week, but refused to =
> divulge his Navigator bug-find for a customary Netscape fee of $1,000.
> "We want all Navigator users to know that we take all bug reports =
> seriously and our engineers are working on this problem right now,"
> began Netscape spokesperson, Jennifer O'Mahoney. "At this time,
> there are no reported incidents of this reported bug affecting
> any Navigator user accessing public or intranet Web sites. The
> probability of it affecting these users is very low. " According
> to Netscape, communication with the programmer has been limited to
> e-mail. After refusing to put him in touch with the "guy with the
> checkbook," Netscape was warned the information would be revealed to =
> the media. Cable News Network (CNN) was contacted by the programmer
> and given a demonstration of the bug through a non-public Web site
> designed by the programmer. The bug was confirmed by PC Magazine.
> Although Netscape has not been able to internally examine and confirm =
> the "briber bug," the Internet/intranet software developer has assumed
> the CNN demonstration was successfully completed. According to
> reports, from the programmer and CNN, a navigator user visiting the
> site in question opens his or her hard disk to the operator. The
> site operator, however, must know specific file names to access
> any information on a user's hard disk. Which version or versions of
> Navigator are susceptible to the bug are currently unknown, but one =
> report says the Dane claims version 2.0 and all later versions contain =
> the programming flaw. The Dane chose to pressure Netscape during the
> company's developer conference in San Jose, California. In spite of
> the timing, Netscape remained adamant in its response. "We will not
> be blackmailed or allow an individual or group to hold us hostage,"
> added O'Mahoney. She also told Newsbytes, "We will keep everyone
> posted of this situation throughout today and following days on
> our Web site (http://home.netscape.com )." Once on Netscape's home
> page click on "Flash Items." No discussions of specific amounts of
> money have occurred between the unnamed programmer and Netscape.
> (19970612/Press Contact: Jennifer O'Mahoney, Netscape, tel 415-528- =
> 2619; Reported by Newsbytes News Network: http://www.newsbytes.com =
> /NETSCAPELOGO/PHOTO)

> "The Pulse of the Information Age" Newsbytes News Network =
> http://www.newsbytes.com 24-hour computer, telecom and online news =A9
> 1997 Newsbytes =20 Jeffrey Fry CNA, A+ Certified Technician chec@itw.com
> fry@mapeaston.com http://www.itw.com/~chec
> ----
> From: Meka Egwuekwe To: Bryan K. Fite
> Cc: ntsecurity@iss.net Date: Friday, June
> 13, 1997 22:31 Subject: Re: [NTSEC] FW: Danish software firm finds
> Netscape bug

> I too think that it is quite strange the way this was handled. And I
> have a slew of questions. Perhaps that Danish company was trying to
> get it's name out there? Perhaps they want to embarass Netscape for
> some reason? Since the details of the bug are not being released yet,
> how can it be verified? So why go to the press instead of a forum
> like this one? Surely there was some motive.

> Meka Egwuekwe


 I think it's clear that the the Dane is trying blackmail.
 Contacting CNN and other journalists is for notoriety and
 to put on the pressure.

 I agree with Netscape -- the bug must be found -- but the
 blackmailer must not be payed.

 (BTW: There are ways to tactfully open negotiations with a
 company if you have a legitimate item of interest to them
 -- and they don't involve the use of phrases like:
 "they guy with the checkbook").


> Date: Sat, 14 Jun 1997 00:54:04 -0400 From: "Jeff Fry" 
> Subject: Re: [NTSEC] FW: Danish software firm finds Netscape bug

> http://www.newsbytes.com/3.html Full story at that address, also =
> http://home.netscape.com/misc/security_update.html is where the =
> information that Netscape has provided on the subject is posted.
> It is said to affect Netscapes version 2.0 and above.

> Jeffrey Fry CNA, A+ Certified Technician chec@itw.com fry@mapeaston.com
> http://www.itw.com/~chec





 Thanks for all your help in the past. This is my major source of
 answers when books don't help.

 A couple more questions:

 1) Are ids with an account type of 'server' or 'workstation'
 interactive? Could you logon to them from a terminal if you knew the
 password?

 2) Do all servers need to be defined to the PDC with and account type
 of 'user'? And do they need Domain Admin access?

 Thanks Again!

 Connie
 (cmbalodimos-barry@bkb.com)
Some recent posts to the NT Security mailing list have been riddled with stupid 
HTML coding (and generally this also results in more-than-doubling the size of 
the posts... one copy "normal", then one copy with lots of dumb HTML codes in 
it). This makes it even more difficult than it already is to figure out who is 
saying what, which are quotes of previous postings, etc. etc.

E-mail ought to be a PLATFORM-INDEPENDENT mechanism for people who want to 
exchange _information_! If you feel for some perverse reason that you MUST 
format your information using HTML codes, Adobe Acrobat, or whatever else, than 
please include a URL to your (formatted as much as you like) Web page, or file 
on an FTP site, or something else. PLEASE turn off the option on your mail 
software that causes it to stick all these offensive HTML codes into your 
outgoing messages.

THANK YOU!

Gordon Peterson
http://www.computek.net/public/gep2/
Support the Anti-SPAM Amendment! Join at http://www.cauce.org/

Thanks for the suggestion. I did find the Idle Seconds before Hanging Up 
selection. I set mine to 480 secs (8 mins). I'll have to see how that works and 
adjust it up or down depending on convenience.

As far as the Ascend Pipeline ISDN router goes... I still have to get ISDN 
first and then I would probably implement a Cisco ISDN Router over the Ascend 
due to personal preferences. I really like how you slipped that plug in there 
for your company... not.

Joel

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: David Tyree [SMTP:davetyree@youngtree.com]
Sent: Saturday, June 14, 1997 4:50 PM
To: 'Neven Jacmenovic'
Cc: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] MS Proxy Server (RAS not disconnecting)

The timeout setting is controlled from within RAS, not the Proxy Server.
Go to Dialup Networking | More | User Preferences to set a timeout.

If you are using ISDN, I suggest using an Ascend Pipeline (with the
Secure Access Firewall) instead of an ISDN modem since it is more secure
and just works better. I have found that RAS gets broken very easily
and is therefore not as reliable. You will need an account with an ISP
that can give you 2 IP addresses, one for the Pipeline and one for the
Proxy Server. We resell fully configured units for about $1,300 if
anyone is interested.

Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
 Sent: Saturday, June 14, 1997 4:05 AM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server


 Ok, here is one question for you! :)

 On one location, I setted up MS Proxy, the same way you did.
Small group
 of NT stations go to internet trought dial up proxy machine. I
even
 enabled that auto connect thingie inside ms proxy. The problem
is.... when
 someone from the group want's to access some website, he
contacts ms
 proxy, ms proxy then dials internet, and there you have it. You
are on
 internet. BUT, I haven't been able to DISCONNECT it automaticaly
eather
 (eg. after 5 minutes of inactivity). Is this like but withing NT
or MS
 Proxy?

 I used similar (crippled) software for same purpose: Wingate. It
worked
 like a dream. And it didn't cost so much. ;)


 Thanx in advance
 Neven

On Sat, 14 Jun 1997, David Tyree wrote:

> The timeout setting is controlled from within RAS, not the Proxy Server.
> Go to Dialup Networking | More | User Preferences to set a timeout.

heh, this is where the problem is. i can enter *ANYTHING* there, but my
modem just won't hangup damn connection... what would happen if my modem
wouldn't be extern modem so I couldn't see those little flashing lights? I
would have to connect with ras administrator every not and then?

I checked my modem settings, and everything is allright... it just seems,
like proxy just won't IDLE... I haven't sniff any packets, but I supose
that is the next logical step to do... Any help STILL needed :)

Thanx in advance
Neven

-----BEGIN PGP SIGNED MESSAGE-----

First off, this is off topic. It ought to end with this post. 
Inasmuch as I am proud to an American, it really has nothing to do 
with anything whether or not another Dane wishes to charge Netscape 
more money for the bugs they found.

There is no contract acceptance by the Dane that governs whether he 
cannot get more money than Netscape offered. It is called CAPITOLISM 
and I applaud the Dane for practicing it.

Should Netscape decide to pay, then a contract between the two 
parties will have occurred and it really isn't anyone's business but 
the two parties.

Get over it.


At 09:43 AM 6/14/97 +0200, N. Werner Mortensen wrote:
>Hello all,
>
>Normally I am proud to be danish and very pleased with our 
reputation in
>the IT industry. But the recent incident and the behaviour of one of 
my
>countrymen makes me feel ashamed.


>
>This is no way to behave, this is doing no good for our country and 
any
>kind of blackmail no matter the amount of $ will ever be looked 
upon as
>something we like to be assimilated with in our normally peacefully 
little
>country.
>
>Personally I have never heard of the person(s) involved, I have 
never heard
>of the company before and even though I have no permission to speak 
for my
>employer I will never do bussiness with this company if I ever run 
into
>them, no matter what.
>
>Instead the alleged security bug should have been made public on 
this list
>so that anyone interested (including NETSCAPE) could evaluate it, 
comment
>it and suggest fixes which could benefit us all.
>
>I'm sorry if some may look upon this message as a flame. This is not 
what I
>normally do, but somebody just stepped way out of line.
>
>Regards,
>
>N. Werner Mortensen, University of Copenhagen, MFI
>Blegdamsvej 3, DK-2200 Copenhagen N, Denmark
>Phone: +45 3532 7520 Fax: +45 3532 7537
>e-mail: werner@mfi.ku.dk (I prefer MIME & ISO-8859-1)
>
>
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQEVAwUBM6RwiMdkzYGunyULAQF5iQgAgVx5Tmauf+pGKmsAxfY4jRh+mIPvUcn0
xRRGEQot+yv9BDZNHbFrFkyn9fC+WjZC20806PnlKr/ZlFExRlo86F61ZqbEJqoY
vsG9Q3m3JDYjNOLr1/cIEcPTK8lkyATQXm2geBy4kkqqXtOR20t9Gl9OnqD7rP4I
GwIfuVdbFDZtDbrQTFShWqQyc6HX+b3jQQh4ENLIAq8uXrG0JPB4v90z9ZV/9hWt
MnKksvzqqelP99dQqoEHQ5acPcK/ZCOXiI3W7jTvue6Cn/9ogFxcgULhIgRGV2c2
AFIdemAGXqacU6P1WNh/+45SyGWWvl3yNTc/jXrAgB0D+NlKp7d1eA==
=Ismt
-----END PGP SIGNATURE-----

Any way to get this info to display at user login time?

> -----Original Message-----
> From: Michael Gillespie [SMTP:michaelg@southwind.net]
> Sent: June 10, 1997 11:19
> To: 'cmbalodimos-barry@bkb.com'
> Cc: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Last Login Date/Time
> 
> If you have access to the NT Server Resource Kit you can use a
> Microsoft utility:
> 
> Excerpt from Knowledge base article Q158388
> Usrstat.exe Displays username, fullname, and last login date
> and time for
> each user account across all domain controllers.
> 
> I hope this helps.
> 
> Michael Gillespie
> 
> -----Original Message-----
> From: cmbalodimos-barry@bkb.com [SMTP:cmbalodimos-barry@bkb.com]
> Sent: Tuesday, June 10, 1997 8:59 AM
> To: ntsecurity(a)iss.net
> Subject: [NTSEC] Last Login Date/Time
> 
> 
> How can I get the last login date and time for users without any
> third
> party packages (e.g., NO Somar dumpacl)?
> 
> Please let me know!
> 
> Thanks!
> 
> Connie
 Extortion? Blackmail? Are these not harsh words?

> I think, Profiteer, Ambulance chaser, Opportunist, or Whore are
> perhaps more appropriate.
> 
> At least there are a few people out there with a higher sense of
> responsibility.
> 
> On the other hand, You've got to give the guy an A for creativity!
> And don't think for a minute that if the shoe were on the other foot,
> the big boys wouldn't stoop even lower to milk it for all the bucks
> and publicity it was worth.
> 
> Waxing philosophicly...
> 
> 
On Sat, 14 Jun 1997, Kevin Manderson wrote:

> Query:
> 
> If a server is running Bind V4.9.4 P1 can it be set to non recursive
> responses to fix the problem?
Yes. But you may do it only on root servers...
:)

 Best wishes, Eugeny Kuzakov
 Laboratory 321 ( Omsk, Russia )
 kev@lab321.ru

 Is there some reason the set-up of the initial TCP packet (Syn-Ack)
can not include an Initial Sequence Number (ISN) which is varied by some
random or pseudo-random incriment from the previous ISN?

 An unpredicable ISN would obviously foil "blind" (non-sniffing)
sequence number attacks -- and all other attacks which presume the
incrimental change in the ISN is predictable. (The PRN generator might
also be constrained by some formula that minimizes the potential for
simultaneous sessions using packets with identical ISNs.)

 Comments, pedantic or otherwise, would be welcome.

 A friend of Curious George,

 _Vin
-------------
David LeBlanc wrote:

>I had previously stated that NT was TCP sequence predictable. In response
>to a question, I did a bit of research on our network and found the following:
>
>This is largely fixed in SP3. Instead of being from 15-85% predictable, it
>is now from 5% to ~20% predictable. This is fairly reasonable.
>
>For comparison, IRIX, HP-UX, SunOS, and AIX are all _extremely_ predictable
>- 50% or better on a consistent basis. BSD is typically very predictable.
>
>However, Linux and Solaris are best at this, and are consistently 5%
>predictable or less. I would like to see NT join this group, but SP3 shows
>a substantial improvement.


 Vin McLellan + The Privacy Guild + 
 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548
 -- <@><@> --


Is it possible that the card send physical a lots of interrupts ?

-----Original Message-----
From: Paul Robichaux [SMTP:paul@ljl.com]
Sent: Freitag, 13. Juni 1997 23:20
To: Nash, Jason X
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] New RPC 100% CPU Bug?

>We have some computers showing 99-100% CPU utilization on the RPC
>service again. These are NT 4.0 w/ Service Pack 3. Anyone know of any
>new exploits on this? I haven't heard of anything.

I had this problem when I booted an NTW 4/SP3 machine with a specialty PC
card in its reader. The card didn't have a driver installed. WHAM! As soon
as I logged in, RPC started using 100% of CPU. If I logged in without the
card, no problem. Once I installed the driver, everything was normal.

The machine was a Dell Optiplex with their SMC internal card cage, running
NT4 1381 with SP3 and no hotfixes. Beats me why it was doing that; I'm just
glad it stopped.

Cheers,
-Paul

--
Paul Robichaux | LJL Enterprises, Inc.
paul@ljl.com | We didn't invent e-mail; we just make it secure.
 |
Author, _Windows NT Server 4 Administrator's Guide_, ISBN 0761507515 (Prima)

Hi I have here some users they running a Netscape version of browser, 
do u know how I can "test" these bug ? 
Somebody say u have to be a administrator to do that, why ?
If these hole really exist, I think it's better to move to ie :-( !?!?

Tnx, hand have a nice day
Patrik

-----Original Message-----
From: Patrick Sanger [SMTP:pcslist@hotmail.com]
Sent: Samstag, 14. Juni 1997 02:02
To: ntsecurity@iss.net
Cc: mcdermott@itd.nrl.navy.mil
Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug

that wouldn't be a netscape security hole that would be a winnt hole. 
the netscape process is running on behalf of the user that started it, 
so just like any other program it would have the same access rights as 
the user running it. this doesn't lessen the risk because most of us are 
logged on as Administrator anyway.

Patrick


>From owner-ntsecurity@iss.net Fri Jun 13 15:24:41 1997
>Received: (qmail 27266 invoked by alias); 13 Jun 1997 15:46:27 -0000
>Delivered-To: nt-out-link@iss.net
>Received: (qmail 27259 invoked by alias); 13 Jun 1997 15:46:25 -0000
>Delivered-To: nt-out@iss.net
>Received: (qmail 27253 invoked by uid 15); 13 Jun 1997 15:46:24 -0000
>Received: (qmail 27242 invoked from network); 13 Jun 1997 15:46:20 
-0000
>Received: from arden.iss.net (root@208.21.0.8)
> by phoenix.iss.net with SMTP; 13 Jun 1997 15:46:20 -0000
>Received: from itd.nrl.navy.mil (itd.nrl.navy.mil [132.250.81.2]) by 
arden.iss.net (8.8.5/8.7.3) with SMTP id LAA08204 for 
; Fri, 13 Jun 1997 11:46:18 -0400
>Received: from wallace (wallace.itd.nrl.navy.mil) by itd.nrl.navy.mil 
(4.1/SMI-4.1)
> id AA00422; Fri, 13 Jun 97 11:46:16 EDT
>Received: by localhost with Microsoft MAPI; Fri, 13 Jun 1997 11:43:07 
-0400
>Message-Id: <01BC77EE.F65CCD10@mcdermott@itd.nrl.navy.mil>
>From: John McDermott 
>To: "'ntsecurity@iss.net'" 
>Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
>Date: Fri, 13 Jun 1997 11:43:06 -0400
>Organization: Naval Research Laboratory
>X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4008
>Sender: owner-ntsecurity@iss.net
>Precedence: bulk
>Reply-To: John McDermott 
>X-Loop: ntsecurity
>X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to 
majordomo@iss.net
>X-Comment: DO NOT send subscribe/unsubscribe messages to 
ntsecurity@iss.net
>
>One question not answered is: which files? Can they get files
>that current user cannot read, etc. due to ACL entries? If they
>could, that would be a big deal.
>
>John
>
>Center for High Assurance Computer Systems
>Naval Research Laboratory
>



---------------------------------------------------------
Get Your *Web-Based* Free Email at http://www.hotmail.com
---------------------------------------------------------
Has anyone ever heard anything bad about this proxy server?
( like ways to break into a system using it? )
WinProxy http://www.lanprojekt.cz/winproxy/

I've been using it at home for about 6 months, and it works great, but with
the 
recent 'Netscape' discoveries, my company feels a more well known 
(ie: more expensive and harder to configure) proxy / firewall would be a
safer choice.

We would use Microsoft's proxy if it had a POP/SMTP gateway.
As far as I know, you have to install exchange server to get mail to work,
and really don't need exchange server.

Thanks..
Ken Anthony
There is no need to test this bug, as all versions of netscape are
vulnerable. What you need to do is make sure that when you are browsing
the web that you use a user with very little permissions, I would also
suggest that when creating this user you give it its own group. One of
the huge problems is that most admins browse the web logged in as
Administrator so once they run Netscape it then inherits thier
permissions and becomes god of that computer, thus allowing the attacker
at www.evil.org to grab virtually any file off browserbox.victim.com. 

0x486578


Eigenheer Patrik, EIP wrote:
> 
> Hi I have here some users they running a Netscape version of browser,
> do u know how I can "test" these bug ?
> Somebody say u have to be a administrator to do that, why ?
> If these hole really exist, I think it's better to move to ie :-( !?!?
> 
> Tnx, hand have a nice day
> Patrik
> 
> -----Original Message-----
> From: Patrick Sanger [SMTP:pcslist@hotmail.com]
> Sent: Samstag, 14. Juni 1997 02:02
> To: ntsecurity@iss.net
> Cc: mcdermott@itd.nrl.navy.mil
> Subject: RE: [NTSEC] FW: Danish software firm finds Netscape bug
> 
> that wouldn't be a netscape security hole that would be a winnt hole.
> the netscape process is running on behalf of the user that started it,
> so just like any other program it would have the same access rights as
> the user running it. this doesn't lessen the risk because most of us are
> logged on as Administrator anyway.
> 
> Patrick
>
I dont know if the proxy software itself has security holes. Any
software misconfigured has the potential to do so. The problem with any
proxy, is not so much in the proxy software of choice but in the
security of the security of the system as a whole. If I can hack into
your proxy server with a filesharing hole then your proxy is useless. 
Also I could be wrong on this (But most likely not), but a proxy will
not safeguard you against most web browser attacks. I personally use a
proxy on my local system for HTTP. This proxy allows me to stop people
from obtaining information from my browser such as what browser it is
what OS i am using and where I am comming from. This proxy, and many
others as well, is also designed to stop others from tracking you
through the use of cookies. This however, can and is overcome by many
cleaver web developers who have found other ways of sending you cookies
which are not as easy to filter. As with the recient Internet Explorer
and Netscape bugs, these can be even more difficult to stop. For
example the IE password grabbing scemes you can stop them by preventing
traffic through ports 137-139 (SMB over TCP). Now with the newly
discovered Netscape hole the problem gets even more tricky. For the
moment we are missing most all key technical details, but we do know
that the problem exhists in clever usage of RAW HTML, which would defeat
the security mechinisms of any known proxy. This will be filterable but
by the time anyone knows what to filter out, netscape will be patched.
So in closing, you really dont have to worry about your current proxy
for there really isnt a feasable solution to many of these problems
other than to sit and wait for the patches to come out.

0x486578

Ken Anthony wrote:
> 
> Has anyone ever heard anything bad about this proxy server?
> ( like ways to break into a system using it? )
> WinProxy http://www.lanprojekt.cz/winproxy/
> 
> I've been using it at home for about 6 months, and it works great, but with
> the
> recent 'Netscape' discoveries, my company feels a more well known
> (ie: more expensive and harder to configure) proxy / firewall would be a
> safer choice.
> 
> We would use Microsoft's proxy if it had a POP/SMTP gateway.
> As far as I know, you have to install exchange server to get mail to work,
> and really don't need exchange server.
> 
> Thanks..
> Ken Anthony
You don't need to goto IE because the bug. In security, there is no one
who can claim he is safe :-) Just make sure you don't have any impact
>from this bug.

Just follow netscape instruction to disable this bug. Not really disable,
but at least to know when someone try to get anything from your computer.

This is the URL:
http://home.netscape.com/misc/security_update.html

Some days ago some people did ask for command line tools for 
evaluating the eventlogs. So I think it is not off-topic to announce 
a new tool on this list ;-)

R529.exe evaluates the events 529 and 528 of the Security log. The
program does tell you with which account name on what machine on what
time somebody failed to logon. It tells you if it the attempt was made
local or via the network. It does tell you how many attempts made
an attack and how long it was going on. To count 2 attempts to
the same attack, they must proceed from the same computer and the
time difference between them must be less then 5 minutes. The
program does tell you if the attack was successful or not. To
consider an attack successful, there must be a successful logon
(event 528) from the same machine within the time window of 5
minutes after the last failed attempt. Sometimes an event 529
will occur because of a typo or because the user did forget to
change the last used name into his own. So there is an option to
skip assumed mistakes. A successful logon after one failed
attempt is assumed to be a mistake by most people. You can download
the evaluation copy of version 1.0 of R529E.zip (39 kB) from
http://rcswww.urz.tu-dresden.de/~fh/nt/eventlog/#Evaluate

Greetings

Frank Heyne
http://rcswww.urz.tu-dresden.de/~fh/
 The bug in Netscape is purported to rely on HTML... which gets through any 
proxy/firewall that is configured to allow web browsing and doesn't use any 
special filtering of HTML content.

 Assuming you're using NT, we've used WinGate (www.deerfield.com) and MS 
Proxy on various client's systems and have found both to be reliable and as 
safe as we so far know. Can't speak from any experience regarding WinProxy. 
We haven't logged any confirmed penetrations... yet. Definitely block access 
to ports 137-139 with some type of filtering router in front of the NT box and 
most of the serious problems found so far will be blocked. I'd block access 
to everything but HTTP, FTP and SMTP to start and then open things up as you 
hear complaints, assuming they're justifiable relating to security and 
business use of your network. Block source routing and block incoming (from 
the net) packets that claim to be from your internal subnet. The router is a 
better place to spend your company's money if you don't yet have one and then 
get it properly configured by someone that has experience with that particular 
brand of equipment. Your ISP may be of some help there. Just my opinion.

----------
From: owner-ntsecurity@iss.net on behalf of Ken Anthony
Sent: Monday, June 16, 1997 1:22 AM
To: ntsecurity@iss.net
Subject: [NTSEC] *Safe* Proxy server?


Has anyone ever heard anything bad about this proxy server?
( like ways to break into a system using it? )
WinProxy http://www.lanprojekt.cz/winproxy/

I've been using it at home for about 6 months, and it works great, but with
the 
recent 'Netscape' discoveries, my company feels a more well known 
(ie: more expensive and harder to configure) proxy / firewall would be a
safer choice.

We would use Microsoft's proxy if it had a POP/SMTP gateway.
As far as I know, you have to install exchange server to get mail to work,
and really don't need exchange server.

Thanks..
Ken Anthony

> ----------------------------------------------------------------------
> 
> Date: Sun, 15 Jun 1997 23:50:13 -0500
> From: Vin McLellan 
> Subject: Re: [NTSEC] sequence predictability
> 
> Is there some reason the set-up of the initial TCP packet (Syn-Ack)
> can not include an Initial Sequence Number (ISN) which is varied by some
> random or pseudo-random incriment from the previous ISN?

 There is no reason this can't be done and every reason it
 should be.

 However it should not use simple psuedo-random increments.
 It should use cryptographic quality random numbers.
 (see below).
 
> An unpredicable ISN would obviously foil "blind" (non-sniffing)
> sequence number attacks -- and all other attacks which presume the
> incrimental change in the ISN is predictable. (The PRN generator might
> also be constrained by some formula that minimizes the potential for
> simultaneous sessions using packets with identical ISNs.)
> 
> Comments, pedantic or otherwise, would be welcome.
> 
> A friend of Curious George,
> 
> _Vin
> - -------------
> David LeBlanc wrote:
> 
>> I had previously stated that NT was TCP sequence predictable.
>> In response to a question, I did a bit of research on our network
>> and found the following:

>> This is largely fixed in SP3. Instead of being from 15-85%
>> predictable, it is now from 5% to ~20% predictable. This is fairly
>> reasonable.

>> For comparison, IRIX, HP-UX, SunOS, and AIX are all _extremely_
>> predictable - 50% or better on a consistent basis. BSD is typically
>> very predictable.

>> However, Linux and Solaris are best at this, and are consistently 5%
>> predictable or less. I would like to see NT join this group, but
>> SP3 shows a substantial improvement.

 Last I heard Linux was using /dev/random as the seed for it's
 TCP sequencing. /dev/random is a psuedo device under Linux
 (and (Free|Net|Open)BSD if I recall correctly) that combines
 measurements from a number of nondetermistic events
 (such as inter-keystroke timings, and ethernet collision
 frequencies) to form a non-repeating number sequence that is
 suitable for cryptographic applications.

 So the predictability should be very low. If there's enough
 interest I could ask a couple of cryptographers that I 
 know.

> Vin McLellan + The Privacy Guild + 
> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548
> -- <@><@> --
 

--
Jim Dennis, info@mail.starshine.org
Proprietor, consulting@mail.starshine.org
Starshine Technical Services http://www.starshine.org

 PGP 1024/2ABF03B1 Jim Dennis 
 Key fingerprint = 2524E3FEF0922A84 A27BDEDB38EBB95A 
> ----------------------------------------------------------------------
> 
> Date: Sun, 15 Jun 1997 23:50:13 -0500
> From: Vin McLellan 
> Subject: Re: [NTSEC] sequence predictability
> 
> Is there some reason the set-up of the initial TCP packet (Syn-Ack)
> can not include an Initial Sequence Number (ISN) which is varied by some
> random or pseudo-random incriment from the previous ISN?

 There is no reason this can't be done and every reason it
 should be.

 However it should not use simple psuedo-random increments.
 It should use cryptographic quality random numbers.
 (see below).
 
> An unpredicable ISN would obviously foil "blind" (non-sniffing)
> sequence number attacks -- and all other attacks which presume the
> incrimental change in the ISN is predictable. (The PRN generator might
> also be constrained by some formula that minimizes the potential for
> simultaneous sessions using packets with identical ISNs.)
> 
> Comments, pedantic or otherwise, would be welcome.
> 
> A friend of Curious George,
> 
> _Vin
> - -------------
> David LeBlanc wrote:
> 
>> I had previously stated that NT was TCP sequence predictable.
>> In response to a question, I did a bit of research on our network
>> and found the following:

>> This is largely fixed in SP3. Instead of being from 15-85%
>> predictable, it is now from 5% to ~20% predictable. This is fairly
>> reasonable.

>> For comparison, IRIX, HP-UX, SunOS, and AIX are all _extremely_
>> predictable - 50% or better on a consistent basis. BSD is typically
>> very predictable.

>> However, Linux and Solaris are best at this, and are consistently 5%
>> predictable or less. I would like to see NT join this group, but
>> SP3 shows a substantial improvement.

 Last I heard Linux was using /dev/random as the seed for it's
 TCP sequencing. /dev/random is a psuedo device under Linux
 (and (Free|Net|Open)BSD if I recall correctly) that combines
 measurements from a number of nondetermistic events
 (such as inter-keystroke timings, and ethernet collision
 frequencies) to form a non-repeating number sequence that is
 suitable for cryptographic applications.

 So the predictability should be very low. If there's enough
 interest I could ask a couple of cryptographers that I 
 know.

> Vin McLellan + The Privacy Guild + 
> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548
> -- <@><@> --
 

--
Jim Dennis, info@mail.starshine.org
Proprietor, consulting@mail.starshine.org
Starshine Technical Services http://www.starshine.org

 PGP 1024/2ABF03B1 Jim Dennis 
 Key fingerprint = 2524E3FEF0922A84 A27BDEDB38EBB95A 
I think this has something to do with security, although it may be a bug!

After printing from IE 3.02, I find that I can no longer print from a DOS
box. I get the error message Access is denied. Printing from a windows
program works OK.
Logging off and then back on has no effect. This problem then occurs for
every user, including the Administrator! The only way I can find to
re-enable printing from a DOS box is to reboot the machine.

Has anybody else come across this problem? Anybody have any thoughts?

Thanks for your time

John Taylor
john@carrhouse.force9.net
 I am new to the group, so I apologize if this question has come up. My 
company works on the belief if it can't be replicated it isn't a problem. 
Consequently, I am interested in testing the Anonymous Logon reported by 
MS for 3.51 and 4.0. Does anyone have any detailed knowledge on how it 
works to prove its threat?

Thanks,
Keith
NT System Engineer
Keith-Lynch@mssc.com 
This is my first post to the list but, I have been a reader for a while. I hope this isn't too far off topic.
I have set up PPPT on a PDC and a Stand alone server within a single domain in an attempt to allow remote users to access the domain over the internet. These machines are both only running TCP/IP. I am able to connect and athenticate but, when I try to map network drives it returns network path not found. I have added lines to the hosts file:
xxx.xxx.xxx.xxx mymachine
and the LMHosts file:
xxx.xxx.xxx.xxx mymachine #PRE
and I also tried 
xxx.xxx.xxx.xxx mymachine #PRE #DOM:mydomain
it is my understanding that the #PRE setting in the LMHosts file will be used before DNS or WINS for name reselution.
Has anyone had any similar experiences? Solutions?
-TIA
John Surprenant
john@intergate.net
Internet Gateway Communications, Inc.
http://www.intergate.net

-----BEGIN PGP SIGNED MESSAGE-----

On 16 Jun 97 at 4:07, 0x486578 wrote about: Re: [NTSEC] *Safe* Proxy
server?

> [...]
> security of the security of the system as a whole. If I can hack
> into your proxy server with a filesharing hole then your proxy is
> useless. Also I could be wrong on this (But most likely not), but a
> [...]


Beside NetBIOS ports, MS Proxy server keep two ports open...one I know
for sure and that is the one you specified in the mspclnt.ini file
(default is 1745). I think it also keeps port 47 open, but I have not
investigate to see if it is the Proxy server or some other component.

Whenever you install a site, do a netstat and preferably portscan to
see what is open. Then close what needs to be closed. I prefer to
close everything and open only needed ports (i.e. 80, 20, 21, 25, 110,
70, >1023). Sometimes, though, with small routers you have to
compromise and leave everything open, but block 135, 137, 138, 139 and
whatever else is open.

If you run MS Proxy, block 47 and 1745 (or whatever you configured the
Proxy for). Otherwise folks from Internet might be able to connect to
your proxy and proxy back out, using your proxy's IP address as a
disguise for hacking purposes. I know, they shouldn't be able to
because they are not specified in your LAT, but who knows what bugs
are still lurking in MS Proxy... :)


Frank




-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM6VZEMZP3ocmY5AlAQFxjQP/Xxo7aOY6UUqZtdsx+CNYIQIbQUP3CnII
I/ezOJwpCrAfJK9UwdXa9tRfTKxc8OZVKa7dfnn4iEeAkc1Yt+JIwO83CPjMod4Q
MHG2V8C9e62X4fSDh/FL/AQHFXlR4pAI4qPuNLmtYtZ2OhWgdmeUSwVVrEujsFtS
lMM11LCxoRg=
=G9Ge
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
I do not have Exchange server installed. I have IIS and Proxy Server installed. 
I have no problems with sending and receiving POP/SMTP email to and from the 
Internet. Also, I left Outlook configured as it was on all machines before I 
installed Proxy (that is, pointed to Internet email servers). I also had to 
install the MS Proxy Client on each machine... that took about 30 secs.


--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Ken Anthony [SMTP:ntsec@smtsecure.com]
Sent: Monday, June 16, 1997 2:23 AM
To: ntsecurity@iss.net
Subject: [NTSEC] *Safe* Proxy server?


Has anyone ever heard anything bad about this proxy server?
( like ways to break into a system using it? )
WinProxy http://www.lanprojekt.cz/winproxy/

I've been using it at home for about 6 months, and it works great, but with
the
recent 'Netscape' discoveries, my company feels a more well known
(ie: more expensive and harder to configure) proxy / firewall would be a
safer choice.

We would use Microsoft's proxy if it had a POP/SMTP gateway.
As far as I know, you have to install exchange server to get mail to work,
and really don't need exchange server.

Thanks..
Ken Anthony

What firewall are you using? Do you know anything about EAGLE NT
Raptor?
ConnieDarr Emery
Email/Network Administrator
Florida Gulf Coast University
cedar@fgcu.edu

 -----Original Message-----
 From: Jack LeGrand [SMTP:jackl@infi.net]
 Sent: Saturday, June 14, 1997 5:54 PM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server

 Okay...here's a good one. I recently took an abbreviated Proxy
course
 and one thing that was unclear to all present was....since MS
Proxy is
 NOT a firewall, it will in most case work in line with a
firewall.
 
 Question: Should the proxy server be on the outside of the
firewall? 
 If so, does it affect the ability of a firewall that does
Network
 Address Translation. In this case the firewall is passing to
the Proxy
 server a single IP (I presume). Is it able to keep the
individual
 sessions separate?

 The same sort of question also exists if you put the proxy
server on the
 inside of the firewall. If the proxy server is passing off (the
 presumed) single IP, how does the firewall keep track of the
sessions of
 the (800) internal clients on our network?


 Noone at the session (including the instructor) had a good grasp
of how
 the MS Proxy fits within a traditional "Outer DMZ" architecture.
If you
 have any input on this, I'd be interested.....


 Jack LeGrand
 jackl@infi.net


 ****************************************

 Joel W. Barrett wrote:
 > 
 > I installed MS Proxy Server last night and will eventually
take the MS test for
 > it. I need to learn as much about it as possible so if anyone
has questions
 > about it I'd be happy to figure out the answer for you.
 > 
 > I am currently using it as a network address translation (NAT)
and dial-up
 > solution for a small home network with limited Internet
accounts. It seems to
 > work very well. It did require MS IIS to be installed prior to
its installation
 > but that was not a major hassle.
 > 
 > I can now do an internal FTP site, Intranet Web services, and
a Gopher server
 > if I wanted.
 > 
 > --
 > Joel W. Barrett, Internetworking Consultant
 > RPM Associates, Inc. http://www.rpm.com
 > email: jbarrett@rpm.com, pager: 888-602-4566
 > http://www.mindspring.com/~cnebody (12/17/96)
 > Do Something Digital!

 -- 
 Jack LeGrand
 TeleGrand Technologies
 jack.legrand@telegrand.com
 A Strategic Business Partner of Blue Ridge Interactive

First, this "bug" is not directly related to Windows NT: the only way
to prevent the sending of files is to prevent read access to them.

Second, since the httpd server is specifying the name of the file, it has
to know it either (1)absolutely (full path) or (2) relative to the current
path of the executing Netscape app. If you're really worried about files
being retrieved which shouldn't be, put them in nonstandard locations and
make sure there are no references to that location in files which have a
standard location (i.e. don't put your word/wordperfect docs in the same
dir as the executable, don't specify confidential files in an INI).

The biggest worry you should have is if someone grabs your registry or other
password/access-specifications containing file- so take the advice of a person
who posted to this list awhile back (sorry, forgot your name!):
 DON'T BROWSE WHEN YOU'RE LOGGED IN AS ADMIN!
 DON'T BROWSE WHEN YOU HAVE READ/WRITE ACCESS TO SENSITIVE FILES!
 PUT FILES IN NONSTANDARD LOCATIONS!

And *definitely* don't store sensitive info in any of the standard Netscape
configs, like site passwords or automatic access control.

As to the nature of the bug, ponder this:
 Javascript allows you to submit a form without user intervention
 Javascript allows you to specify the values of a form's fields
 File uploading is implemented as a input field in a form
 You can hide almost anything in a frame of 0 or 1pixel width/height

Keeping in mind that I'm not a Javascript expert, this is still an interesting
"bug"/feature to ponder on. The fix is just as obvious: don't let Javascript
set the value (file reference) of a file-input on a form.

If I'm right about the bug (my Javascript ref is currently on loan, I haven't
got it memorized, and Netscape's homepage is a little too slow due to the hits
right now to look info up online, so this idea is untested), then I'll buy
myself a cookie, which, IMHO, is more of a threat to (personal) security and
privacy than this file uploading stuff.

One last bit: the person from Denmark has a point- if your company spent
$5,000+ tracking down a bug which was actually in third-party code, and the
other company offered $1,000, I would feel a bit cheated too. But Netscape Co.
also has a point: the Denmark Co. should have contacted them first, rather
than the press. Netscape has probably spent $5,000+ in damage control alone.
Not to say that bugs should not be brought out into the open and an acknowledged
by those who are responsible for them- I just think that both sides have taken
the wrong approach from the start.
And I do think that $1000 is pretty pitiful in this case.

End of story. Now how about getting back to regular NT issues, eh?
-----BEGIN PGP SIGNED MESSAGE-----

On 16 Jun 97 at 10:29, Joel W. Barrett wrote about: RE: [NTSEC] 
*Safe* Proxy server?

> I do not have Exchange server installed. I have IIS and Proxy Server
> installed. I have no problems with sending and receiving POP/SMTP
> email to and from the Internet. Also, I left Outlook configured as
> it was on all machines before I installed Proxy (that is, pointed to
> Internet email servers). I also had to install the MS Proxy Client
> on each machine... that took about 30 secs.


I think he was talking about the incoming mail via SMTP. Usually mail
hosts are bastion servers and not channeled through a proxy. Some
proxies will allow for so called 'conduits', the Cisco PIX (which is
more a firewall, not a proxy, but is LAT capable) for example. The
conduit will allow the incoming packet to get routed through the
proxy.

Well, you could turn on routing on your NT proxy server, but I don't
think that is you want :)

I would install the EMWAC smtp relay daemon. It will fetch the 
incoming email on port 25 on the proxy and forward it to another
machine. This other machine can be in the internal net. The NT server
does not route, but the daemon (well, service... :) will do a higher
level route of the email, and only email. Make sure you have the
appropiate host names in your hosts files on the proxy.

Outgoing email gets proxies out, incoming email gets forwarded via
smtp relay.

Or, again, as most people do, set up your mail server with one NIC in
the demil zone, the other NIC on the internal net. Disable routing and
do all that good security stuff you did on the proxy and router.


Regards,
Frank


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM6Vz+MZP3ocmY5AlAQHMxwP/UN4FvcGh0ss7AO+jNSM5uX0Q80HHLUOn
9cQ/SEDrdNdO61oz8qmdfrC/Tk8iugm85ciPbH4xuolCm2AQjOk+XmUoWvkkWCFO
qum6fAASYL5Pb2ehbw5uUH2Y7FeuCXmcIPfg3Nq2CdMyfQtOupYRmAlnZrWdMDe8
Uo1gSWJDM7g=
=kFca
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
































































































































































































































































































































































































































































































































































































































































































































































































































I dont know if the proxy software itself has security holes. Any
software misconfigured has the potential to do so. The problem with any
proxy, is not so much in the proxy software of choice but in the
security of the security of the system as a whole. If I can hack into
your proxy server with a filesharing hole then your proxy is useless.
Also I could be wrong on this (But most likely not), but a proxy will
not safeguard you against most web browser attacks. I personally use a
proxy on my local system for HTTP. This proxy allows me to stop people
from obtaining information from my browser such as what browser it is
what OS i am using and where I am comming from. This proxy, and many
others as well, is also designed to stop others from tracking you
through the use of cookies. This however, can and is overcome by many
cleaver web developers who have found other ways of sending you cookies
which are not as easy to filter. As with the recient Internet Explorer
and Netscape bugs, these can be even more difficult to stop. For
example the IE password grabbing scemes you can stop them by preventing
traffic through ports 137-139 (SMB over TCP). Now with the newly
discovered Netscape hole the problem gets even more tricky. For the
moment we are missing most all key technical details, but we do know
that the problem exhists in clever usage of RAW HTML, which would defeat
the security mechinisms of any known proxy. This will be filterable but
by the time anyone knows what to filter out, netscape will be patched.
So in closing, you really dont have to worry about your current proxy
for there really isnt a feasable solution to many of these problems
other than to sit and wait for the patches to come out.
0x486578
Ken Anthony wrote:
>
> Has anyone ever heard anything bad about this proxy server?
> ( like ways to break into a system using it? )
> WinProxy http://www.lanprojekt.cz/winproxy/
>
> I've been using it at home for about 6 months, and it works great, but
with
> the
> recent 'Netscape' discoveries, my company feels a more well known
> (ie: more expensive and harder to configure) proxy / firewall would be a
> safer choice.
>
> We would use Microsoft's proxy if it had a POP/SMTP gateway.
> As far as I know, you have to install exchange server to get mail to
work,
> and really don't need exchange server.
>
> Thanks..
> Ken Anthony









































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































I dont know if the proxy software itself has security holes. Any
software misconfigured has the potential to do so. The problem with any
proxy, is not so much in the proxy software of choice but in the
security of the security of the system as a whole. If I can hack into
your proxy server with a filesharing hole then your proxy is useless.
Also I could be wrong on this (But most likely not), but a proxy will
not safeguard you against most web browser attacks. I personally use a
proxy on my local system for HTTP. This proxy allows me to stop people
from obtaining information from my browser such as what browser it is
what OS i am using and where I am comming from. This proxy, and many
others as well, is also designed to stop others from tracking you
through the use of cookies. This however, can and is overcome by many
cleaver web developers who have found other ways of sending you cookies
which are not as easy to filter. As with the recient Internet Explorer
and Netscape bugs, these can be even more difficult to stop. For
example the IE password grabbing scemes you can stop them by preventing
traffic through ports 137-139 (SMB over TCP). Now with the newly
discovered Netscape hole the problem gets even more tricky. For the
moment we are missing most all key technical details, but we do know
that the problem exhists in clever usage of RAW HTML, which would defeat
the security mechinisms of any known proxy. This will be filterable but
by the time anyone knows what to filter out, netscape will be patched.
So in closing, you really dont have to worry about your current proxy
for there really isnt a feasable solution to many of these problems
other than to sit and wait for the patches to come out.
0x486578
Ken Anthony wrote:
>
> Has anyone ever heard anything bad about this proxy server?
> ( like ways to break into a system using it? )
> WinProxy http://www.lanprojekt.cz/winproxy/
>
> I've been using it at home for about 6 months, and it works great, but
with
> the
> recent 'Netscape' discoveries, my company feels a more well known
> (ie: more expensive and harder to configure) proxy / firewall would be a
> safer choice.
>
> We would use Microsoft's proxy if it had a POP/SMTP gateway.
> As far as I know, you have to install exchange server to get mail to
work,
> and really don't need exchange server.
>
> Thanks..
> Ken Anthony









































































































































































































The ethical dilemma: If a company has a problem, and you have a solution, do
you charge for it? If the users of a companys' product have a problem, do
you charge to solve that? When do you consult and when do you volunteer
information?

Sunday, San Jose Mercury News defined hackers in 'Black Hat' and 'White Hat'
catagories, both types giving 'Security Managers' fits. Both hacker types
look for security flaws. 'Black Hats' use vulnerabilities for exploitation,
and 'White Hats' announce vulnerabilities to prevent exploitation.
'Security Managers' keep vulnerabilities to themselves until fixes are
released. I would say I and most others on this list fit in the 'White Hat'
catagory, since I and others strongly believe (from personal ethics) that
users/admins should share flaws as they are discovered, and not cluelessly
drive on with open holes. 

Being legal does not equate to being ethical. (Whitewater, Travelgate,
Chinagate, Lippogate, Paulagate, Coscogate, Jennifer_Flowers-gate,
AntiCalifoniaVoterGate, (and on, and on) and BigmonopolyGates.) Our system
of Law is not based on morals or ethics, just special interest pressure
tempered by (very) delayed Constitutionality rulings. Morals and ethics are
left to various religions, which in the end are very similar.

Bill Stout

P.S. What defines a Country? - Borders, Culture, and a Common Language. The
loss of any of these is a clue you've been invaded.



>Anyway, last week a friend of mine called me and asked for my IP address =
>of my machine. 10 minutes later, one of my shared folders had been =
>renamed, and a bunch of bogus files dumped in to it. He told me that it =
>is possible, using NT, to map a network drive by just using the IP =
>address, and gain access to any shared folders that do not have =
>passwords. Correct me if I am wrong, but don't a lot of businesses =
>created shared directories, and eliminate the password, just so everyone =
> inside the LAN can get to it effortlessly? ......................

Only really grey-matter-challenged ones.

> inside the LAN can get to it effortlessly? Is there anyway to get =
>around this "bug" if it is indeed a bug. I really do not want people =

This is not a bug. It is a feature.....

>outside my LAN gaining access, or even just looking at the drives on our =
>machines here.

To protect your network against such misteaks (sic) as sharing a folder
without using a share-level password (or NT user authentication) one 
thing you can do is to filter out access to the SMB TCP port 139
in the border router which connects you to the Internet or other hostile net.
I'd actually recommend filtering out UDP port 139 as well as the TCP and
UDP ports 137 (the Netbios name server port) and 138 (the Netbios datagram
port).

H. Morrow Long, Yale Univ IT ISO -Info Technology Services Info Security Officer
P.O. Box 208276, 175 Whitney Avenue, New Haven, CT 06520-8276,
VOICE: (203)-432-1248 FAX: (203)-432-0593
INTERNET: http://pantheon.yale.edu/~long/ mailto:Morrow.Long@yale.edu

Hey all...

Just joined the list this morning because of a question that I had. This may or may not have been addressed before, but as I said, I'm new here.

Anyway, last week a friend of mine called me and asked for my IP address of my machine. 10 minutes later, one of my shared folders had been renamed, and a bunch of bogus files dumped in to it. He told me that it is possible, using NT, to map a network drive by just using the IP address, and gain access to any shared folders that do not have passwords. Correct me if I am wrong, but don't a lot of businesses created shared directories, and eliminate the password, just so everyone inside the LAN can get to it effortlessly? Is there anyway to get around this "bug" if it is indeed a bug. I really do not want people outside my LAN gaining access, or even just looking at the drives on our machines here.

Thanx!
Charlie

-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
 Phone: (610) 746-0807 Fax: (610) 746-3688

If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
the doors?


Many thanks to those who helped me get my network backup system
running--the key was to start the scheduler service under the user ID of
my backup operator, then give read permissions to the backup operator
throughout my WIN95 network.

Unfortunately, the only way I can get the scheduler to start is by
giving the new backup operator administrative group rights. Just
"backup" or "server operator" rights are not enough--the scheduler dies
with message "access denied."

My NT4/SP3 server will not allow any of my "backup" or "server
operators" users to log into the console unless they have administrative
rights.

I guess this has something to do with "profiles", and I am sorry if this
is a beginner's question, but what do I do to allow a less privlidged
user to log into the console, or even just start the scheduler service
automatically.
This is not a bug at all. It is behaving exactly as it is configured to. If the 'Everyone' group has permissions on the share and the filesystem (if using NTFS), then access will be granted to absolutely anyone who tries to connect to the resource. The best method of disabling this is to block TCP/UDP ports 137-139 at your Internet gateway/router. Beyond that, some degree of security should be in place. For starters, when granting permissions on objects, if you are inclined to use the 'Everyone' group, don't. Instead use the 'Domain Users' group (making sure all users belong to that group), or, on NT 4 SP3 or later, use the 'Authenticated Users' group. This will close this particular hole, but there may be many more you are unaware of...

Sean Mathias, MCSE
President, Prosolve Technical Solutions Group
Vice President of Technology, BackOffice Professionals Association
Director or Network Services, Online Interactive
seanm@prosolve.com
0 1 206 362 6398 (GMT -8:00)


-----Original Message-----
From: Charles R. Derk, Jr [SMTP:charlie@eaki.net]
Sent: Monday, June 16, 1997 9:37 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] Shared Folders Across Internet

Hey all...

Just joined the list this morning because of a question that I had. This may or may not have been addressed before, but as I said, I'm new here.

Anyway, last week a friend of mine called me and asked for my IP address of my machine. 10 minutes later, one of my shared folders had been renamed, and a bunch of bogus files dumped in to it. He told me that it is possible, using NT, to map a network drive by just using the IP address, and gain access to any shared folders that do not have passwords. Correct me if I am wrong, but don't a lot of businesses created shared directories, and eliminate the password, just so everyone inside the LAN can get to it effortlessly? Is there anyway to get around this "bug" if it is indeed a bug. I really do not want people outside my LAN gaining access, or even just looking at the drives on our machines here.

Thanx!
Charlie

-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
 Phone: (610) 746-0807 Fax: (610) 746-3688

If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
the doors?


This is the main reason NOT to use blank passwords and really not to use 
share level security at all. If you have a Novell or NT server you can 
setup User level security with users permissions from one of those 
servers. 
All you need is an IP address and a local machine name. Just make an 
entry in your lmhosts file
##.###.##.## machine_name
and if you know the name of a share which the majority are the root 
drives (C, D, etc) or something like projects or My Documents and all you 
have to do is do a net use x: \\machine_name\share_name.
This is actually a very handy feature for legit purposes though I would 
never leave my machines open like this if they were connected to the 
internet
---------------------------------------------------
Anyway, last week a friend of mine called me and asked for my IP address 
of my machine. 10 minutes later, one of my shared folders had been 
renamed, and a bunch of bogus files dumped in to it. He told me that it 
is possible, using NT, to map a network drive by just using the IP 
address, and gain access to any shared folders that do not have 
passwords. Correct me if I am wrong, but don't a lot of businesses 
created shared directories, and eliminate the password, just so everyone 
inside the LAN can get to it effortlessly? Is there anyway to get around 
this "bug" if it is indeed a bug. I really do not want people outside my 
LAN gaining access, or even just looking at the drives on our machines 
here.

Thanx!
Charlie

-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
 Phone: (610) 746-0807 Fax: (610) 746-3688

If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
the doors?






----------------------------------------------
Eric Roberson
MCSE/Email Administrator
Relational Managment Services
eroberson@rmsys.com

A)bort, (R)etry, (G)et out the .45?
 


More than one person wrote:

>DON'T BROWSE WHEN YOU'RE LOGGED IN AS ADMIN!
>DON'T BROWSE WHEN YOU HAVE READ/WRITE ACCESS TO SENSITIVE FILES!

My question is, has anyone asked the browser companies to have their
browsers check with the operating system (eg, Windows NT) if you are
running as ADMIN or in some other privileged mode and at least WARN you
that you are taking an additional risk? I was not even aware of this
warning until today, though it makes perfect sense now. (But in my case
I don't have Admin privileges, fortunately ;-).)

Why haven't I seen this discussed anywhere before? Isn't this a simple,
useful security feature that can be added to browsers?

Don
dgpeters@cse.dnd.ca

P.S. I won't charge any of the browser companies over $1000 for this
security-related bugfix. (Though US$1000 is actually over CAN$1000. ;-)

My experience (painful at that) has been to not install PPTP on a DC, only on member servers. I have experienced various problems from not being able to get PPTP to work at all, to having all connection and authentication attempts refused with an error such as 'A connection cannot be established at this time. This computer already has as many connections as it can accept.' 

With regards to the above error, I found that all internal connections were being mapped to a VPN which very quickly exhausted the available VPN pool at which time connections were subsequentially refused. If the 'Enable PPTP Filtering' option was selected, all connections were refused. 

The only functional solution I have found is to only use PPTP on members servers, not DC's.



-----Original Message-----
From: John Surprenant [SMTP:john@intergate.net]
Sent: Monday, June 16, 1997 6:43 AM
To: 'NT Security List'
Subject: [NTSEC] PPTP

This is my first post to the list but, I have been a reader for a while. I hope this isn't too far off topic.
I have set up PPPT on a PDC and a Stand alone server within a single domain in an attempt to allow remote users to access the domain over the internet. These machines are both only running TCP/IP. I am able to connect and athenticate but, when I try to map network drives it returns network path not found. I have added lines to the hosts file:
xxx.xxx.xxx.xxx mymachine
and the LMHosts file:
xxx.xxx.xxx.xxx mymachine #PRE
and I also tried 
xxx.xxx.xxx.xxx mymachine #PRE #DOM:mydomain
it is my understanding that the #PRE setting in the LMHosts file will be used before DNS or WINS for name reselution.
Has anyone had any similar experiences? Solutions?
-TIA
John Surprenant
john@intergate.net
Internet Gateway Communications, Inc.
http://www.intergate.net

Neven Jacmenovic wrote:
> ...
> On one location, I setted up MS Proxy, the same way you did. Small group
> of NT stations go to internet trought dial up proxy machine. I even
> enabled that auto connect thingie inside ms proxy. The problem is.... when
> someone from the group want's to access some website, he contacts ms
> proxy, ms proxy then dials internet, and there you have it. You are on
> internet. BUT, I haven't been able to DISCONNECT it automaticaly eather
> (eg. after 5 minutes of inactivity). Is this like but withing NT or MS
> Proxy?

Heh. I have the opposite problem. Despite valid RAS entries, I can't
get the stupid thing to dial out. 

Supposedly you can fix the no hangup problem by setting the logon
inactivity timeout from the phonebook window (My Computer|Dial-Up
Networking|More|Logon Preferences).

Paul

Netters,

All the machines in our network are running NT4.0. Some run
SP2, some SP3, and some don't run any patches. Lately, some
of the machines seem to have a wierd problem - drap-n-drop
just doesn't work anymore. We have tried it from Explorer
and from any application that supports drag-n-drop. Drag-n-drop
just doesn't work. Rebooting the machines doesn't help either.
We have to reinstall the OS.

I have looked through the registry to see if there is any
setting available to turn off drag-n-drop. Couldn't find one.
Is there such a registry setting or is this some kind of virus?

Thank you in advance for your help.

Pradeep
pradeep@nuview.com


All good points, Paul. DLL's are far too valuable to deny them to
regular users.

I guess the point that I'd add is that security features in any
operating system are not enough. There need to be certain (let me use
the trite phrase) "metaphors" (i.e., accepted practices, procedures,
etc.) for how the features are used. These are much harder to implement
and enforce because a security design team like NT's has little control
over how the far-flung arms of the mightly MS and their legions of 3rd
party suppliers use the features.

Like most people seem to be, I'm uncomfortable about the great
intermingling of highly sensitive files and the "chaff" that seems to
clutter SYSTEM32 and its neighborhood. (Although I grant that the WINNT
directory does have a degree of security organization). For example, I
recently noted a "readme" file that my C++ compiler install placed in
SYSTEM32. (Why it was not happy putting it in the program's main
directory is a mystery to me!) 

I'm doing a bit of programming these days myself, and I really wish MSDN
had a document (maybe it does!) that explains each subdirectory in WINNT
vis-a-vis its security purpose, propa' protection, etc. A nice little
"this is how you should organize 3rd party stuff" from someone who
understands how it should be done (within MS's original design intent)
would be wonderful. While not all 3rd party apps will follow it, it
would be a good start.

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/

These are 16-bit windows apps... Originally designed for win 3.1

Sameer Khosla - labtec@netcom.ca
 ----
From: Franz Josef Katterbach 
To: Sameer Khosla 
Date: Monday, June 16, 1997 3:14 AM
Subject: [NTSEC] Multiple instances of NTVDM

>Sometimes I found similar problems when using MS Word for DOS.
>1. It may help if you start these apps via the forcedos.exe and a batch
>file.
>2. Connect and release any net resource in that batch file.
>3. I would highly recommend to use a full screen text mode for these
>applications.
>
>In File Manager: File\Properties forcedos.exe your_app.bat
>
>and the batch looks like this:
>
>...
>clmode 3 (cirrus logic vga, text mode)
>mode mono|co80
>net use ....
>your_app.exe
>net use ... /delete
>
>Hope this helps.
>
>Greetings,
> Franz Josef
>--
>======================================================================
>Klinikum Aachen ! Tel: ++49 (0)241 80-88518 
>Dept. Radiology ! Fax: ++49 (0)241 8888-480 
>DI Franz Josef Katterbach ! 
>Pauwelsstr. 30 ! 
>52057 AACHEN ! email: 
>Germany ! katterbach@linus.rad.rwth-aachen.de
> 

At 11:39 AM 6/16/97 -0700, Bill Stout wrote:
>The ethical dilemma: If a company has a problem, and you have a solution, do
>you charge for it? If the users of a companys' product have a problem, do
>you charge to solve that? When do you consult and when do you volunteer
>information?

 Solving problems is the basis for capitalism as I know it. Why do you
buy food? To fix the problem of being hungry. Why do you hire a mechanic?
 To fix the problem of your car not working. Or should the mechanic fix
your car for free, because you are the user of a company's (be it Ford,
Chevrolet, what have you) product and he has the information on how to fix
it? How far do we take this? My opinion is if you wish to volunteer
information you possess, then do it. I don't believe it to be right to
fault others for wishing to be compensated for their work, however.

>Sunday, San Jose Mercury News defined hackers in 'Black Hat' and 'White Hat'
>catagories, both types giving 'Security Managers' fits. Both hacker types
>look for security flaws. 'Black Hats' use vulnerabilities for exploitation,
>and 'White Hats' announce vulnerabilities to prevent exploitation.
>'Security Managers' keep vulnerabilities to themselves until fixes are
>released. I would say I and most others on this list fit in the 'White Hat'
>catagory, since I and others strongly believe (from personal ethics) that
>users/admins should share flaws as they are discovered, and not cluelessly
>drive on with open holes. 

 From my imperfect understanding of the entire Danish-Netscape fiasco...
I don't believe the Danish company was attempting to hide the bug. It is
my understanding they approached Netscape and said something to the effect
of, we have found a bug in your software, we don't want your measly $1,000
and a T-shirt, pay us more or you'll have to find the bug yourself. Then,
after a few days when Netscape refused to agree to their request, they
proved to CNNfn and PC-Magazine that the bug does indeed exist. Now,
according to the black-and-white world that's painted above, I don't think
they accurately fit into any of the categories you've outlined. I think
that they probably fall somewhere between White Hat hacker (disclosing the
existence of a discovered bug to proper people) and System Administrator
(not disclosing exploitations of the bug until a bug fix had been
created)... oh my god! A shade of gray!

>Being legal does not equate to being ethical. (Whitewater, Travelgate,
>Chinagate, Lippogate, Paulagate, Coscogate, Jennifer_Flowers-gate,
>AntiCalifoniaVoterGate, (and on, and on) and BigmonopolyGates.) Our system

 "BigmonopolyGates" pretty much sums up the vast majority of attitude I've
seen in regard to this situation. I've seen more than one person bemoaning
this Danish company's negotiating tactics saying, "I think it's funny when
MSIE bugs are discovered but I'm really saddened that a bug has been found
in Navigator" while in the same post speaking of altruism and the good of
all, blah blah blah.

>Bill Stout

Frank Rundatz
frank@cavnet.com
http://www.cavnet.com
My definition of what a "firewall" should do includes:

1. Prevent unauthorized access to your private network.
2. Enable secure access for authorized users to your private
network.
3. Detect and report unauthorized attempts to access your private
network or servers on the public network.

The MS Proxy will do #1, but cannot do #2 or #3 (It will do a better job
with good filters programmed on the router). Because the purpose of the
Proxy Server is to allow outbound access (and close inbound holes), it
does not conflict with the functions of a "firewall". I would put the
proxy on the outside of the firewall, with your web server, DNS server
and SMTP server.

I usually setup the proxy with 2 NIC's, one on the private network, and
one on the public network. You can use any IP addressing scheme for
your internal clients that you want, just be sure to include them in the
LAT, or you will lose any Winsock functionality. I don't know if this
is in conflict with your NAT scheme, but I think it makes it
unnecessary. With a proxy, clients on your private network can have
full outbound functionality without going through your firewall.

I have been looking a one product that is both a proxy and firewall -
you can check it out at www.i-planet.com. I am sure there are others.

I would be interested in knowing what advantages a Firewall/NAT
configuration has over a proxy for outbound access. Anybody?

Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

 -----Original Message-----
 From: Jack LeGrand [SMTP:jackl@infi.net]
 Sent: Saturday, June 14, 1997 4:54 PM
 To: Joel W. Barrett
 Cc: RPM Engineers (E-mail); NT Security List Service
(E-mail); NPA MCSE Study Group (E-mail)
 Subject: Re: [NTSEC] MS Proxy Server

 Okay...here's a good one. I recently took an abbreviated Proxy
course
 and one thing that was unclear to all present was....since MS
Proxy is
 NOT a firewall, it will in most case work in line with a
firewall.
 
 Question: Should the proxy server be on the outside of the
firewall? 
 If so, does it affect the ability of a firewall that does
Network
 Address Translation. In this case the firewall is passing to
the Proxy
 server a single IP (I presume). Is it able to keep the
individual
 sessions separate?

 The same sort of question also exists if you put the proxy
server on the
 inside of the firewall. If the proxy server is passing off (the
 presumed) single IP, how does the firewall keep track of the
sessions of
 the (800) internal clients on our network?


 Noone at the session (including the instructor) had a good grasp
of how
 the MS Proxy fits within a traditional "Outer DMZ" architecture.
If you
 have any input on this, I'd be interested.....


 Jack LeGrand
 jackl@infi.net

To give him or her the right to login to the "console" (I suppose you mean the 
server), go into User Manager for Domains, then to select that person's 
account. Go to Policies from the menu then User Rights. Select "Logon Locally" 
and add that user or a group the user belongs to. This will allow the user to 
logon at the server.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Louis Leff [SMTP:leff@med.edu]
Sent: Monday, June 16, 1997 3:29 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Re: ntsecurity-digest V2 #533

Many thanks to those who helped me get my network backup system
running--the key was to start the scheduler service under the user ID of
my backup operator, then give read permissions to the backup operator
throughout my WIN95 network.

Unfortunately, the only way I can get the scheduler to start is by
giving the new backup operator administrative group rights. Just
"backup" or "server operator" rights are not enough--the scheduler dies
with message "access denied."

My NT4/SP3 server will not allow any of my "backup" or "server
operators" users to log into the console unless they have administrative
rights.

I guess this has something to do with "profiles", and I am sorry if this
is a beginner's question, but what do I do to allow a less privlidged
user to log into the console, or even just start the scheduler service
automatically.

Or simply disable the guest account, as it is on all domains anyways...

Eric


At 12:44 PM 6/16/97 -0700, Sean Mathias wrote:
>This is not a bug at all. It is behaving exactly as it is configured to.
If the 'Everyone' group has permissions on the share and the filesystem (if
using NTFS), then access will be granted to absolutely anyone who tries to
connect to the resource. The best method of disabling this is to block
TCP/UDP ports 137-139 at your Internet gateway/router. Beyond that, some
degree of security should be in place. For starters, when granting
permissions on objects, if you are inclined to use the 'Everyone' group,
don't. Instead use the 'Domain Users' group (making sure all users belong
to that group), or, on NT 4 SP3 or later, use the 'Authenticated Users'
group. This will close this particular hole, but there may be many more
you are unaware of...
>
>Sean Mathias, MCSE
>President, Prosolve Technical Solutions Group
>Vice President of Technology, BackOffice Professionals Association
>Director or Network Services, Online Interactive
>seanm@prosolve.com
>0 1 206 362 6398 (GMT -8:00)
>
>
>-----Original Message-----
>From: Charles R. Derk, Jr [SMTP:charlie@eaki.net]
>Sent: Monday, June 16, 1997 9:37 AM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] Shared Folders Across Internet
>
>Hey all...
>
>Just joined the list this morning because of a question that I had. This
may or may not have been addressed before, but as I said, I'm new here.
>
>Anyway, last week a friend of mine called me and asked for my IP address
of my machine. 10 minutes later, one of my shared folders had been
renamed, and a bunch of bogus files dumped in to it. He told me that it is
possible, using NT, to map a network drive by just using the IP address,
and gain access to any shared folders that do not have passwords. Correct
me if I am wrong, but don't a lot of businesses created shared directories,
and eliminate the password, just so everyone inside the LAN can get to it
effortlessly? Is there anyway to get around this "bug" if it is indeed a
bug. I really do not want people outside my LAN gaining access, or even
just looking at the drives on our machines here.
>
>Thanx!
>Charlie
>
>-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
> 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
> Phone: (610) 746-0807 Fax: (610) 746-3688
>
>If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
>the doors?
>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
In my opinion, since MS Proxy is most likely going to be installed on a NT 
Server, I would prefer to see it inside the firewall and also inside the 
network protected from the Internet by a Cisco router. This is because NT has 
so many security problems that I wouldn't trust anything running NT between my 
network router(s) and the Internet. I would implement something like this 
depending on how large the installation:

 Internet-----router (if required)-----Unix-based firewall or Cisco 
Pix-----router----Proxy server (if required)----network

Having a firewall, router, and proxy server may be redundant depending on the 
firewall or router. I know that Cisco routers running version 11.2(5) can 
perform NAT if they have the proper memory. The problem is there aren't many 
Cisco routers running 11.2 yet.

In either case, the hardware is going to do only what it is programmed to do 
and it will process only the packets it receives. If packets are filtered or 
translated before they get to it then the product (router, firewall, proxy 
server) can only perform transactions based on those packets. Do you see what 
I'm getting at?

The easiest way to figure this out is to draw what you intend to do then 
implement it on the drawing. Make several drawings, each with separate 
implementations so you can see where redundancy occurs. These drawings will 
most probably answer your questions.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Jack LeGrand [SMTP:jackl@infi.net]
Sent: Saturday, June 14, 1997 5:54 PM
To: Joel W. Barrett
Cc: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA MCSE Study 
Group (E-mail)
Subject: Re: [NTSEC] MS Proxy Server

Okay...here's a good one. I recently took an abbreviated Proxy course
and one thing that was unclear to all present was....since MS Proxy is
NOT a firewall, it will in most case work in line with a firewall.

Question: Should the proxy server be on the outside of the firewall?
If so, does it affect the ability of a firewall that does Network
Address Translation. In this case the firewall is passing to the Proxy
server a single IP (I presume). Is it able to keep the individual
sessions separate?

The same sort of question also exists if you put the proxy server on the
inside of the firewall. If the proxy server is passing off (the
presumed) single IP, how does the firewall keep track of the sessions of
the (800) internal clients on our network?


Noone at the session (including the instructor) had a good grasp of how
the MS Proxy fits within a traditional "Outer DMZ" architecture. If you
have any input on this, I'd be interested.....


Jack LeGrand
jackl@infi.net


****************************************

Joel W. Barrett wrote:
>
> I installed MS Proxy Server last night and will eventually take the MS test 
for
> it. I need to learn as much about it as possible so if anyone has questions
> about it I'd be happy to figure out the answer for you.
>
> I am currently using it as a network address translation (NAT) and dial-up
> solution for a small home network with limited Internet accounts. It seems to
> work very well. It did require MS IIS to be installed prior to its 
installation
> but that was not a major hassle.
>
> I can now do an internal FTP site, Intranet Web services, and a Gopher server
> if I wanted.
>
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!

--
Jack LeGrand
TeleGrand Technologies
jack.legrand@telegrand.com
A Strategic Business Partner of Blue Ridge Interactive

If I understand your question correctly, you want to implement multiple MS 
Proxy Servers. I don't know if this is possible and can only see where multiple 
Proxy Servers are required when redundant/backup servers are needed (which is 
quite often). If that is the situation you propose then that is a good 
question.

I guess you would implement multiple Proxy servers the same way multiple DHCP 
servers are implemented. Windows NT DHCP servers cannot currently share IP 
address ranges. The addresses must be split between the servers so that if one 
server crashes the other will pick up and issue new DHCP IP addresses to 
workstations.

I am still learning MS Proxy Server and presently can only guess at how Proxy 
Server would react in a multi-server installation.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Eigenheer Patrik, EIP [SMTP:Patrik.Eigenheer@cantrade.ch]
Sent: Monday, June 16, 1997 1:18 AM
To: 'Joel W. Barrett'
Subject: RE: [NTSEC] MS Proxy Server

HI

I have also a questen, did u see if is possible to cascading the MS
Proxy ?
So is means, if the MS Proxy can "ask" an other Proxy, so to build a
Proxy hierarchy :-) do u know what I'm looking for ?

Tnx
Patrik



-----Original Message-----
From: Joel W. Barrett [SMTP:cnebody@mindspring.com]
Sent: Freitag, 13. Juni 1997 18:17
To: RPM Engineers (E-mail); NT Security List Service (E-mail); NPA
MCSE Study Group (E-mail)
Subject: [NTSEC] MS Proxy Server

I installed MS Proxy Server last night and will eventually take the MS
test for
it. I need to learn as much about it as possible so if anyone has
questions
about it I'd be happy to figure out the answer for you.

I am currently using it as a network address translation (NAT) and
dial-up
solution for a small home network with limited Internet accounts. It
seems to
work very well. It did require MS IIS to be installed prior to its
installation
but that was not a major hassle.

I can now do an internal FTP site, Intranet Web services, and a Gopher
server
if I wanted.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!




Well to answer your question you first must know what a proxy server is and 
what it does. Here is M$'s definition:


A proxy server is a server configured to act on behalf of assigned clients.

When a client application makes a request for an object on the Internet, a 
proxy server on the private network responds by translating the request and 
passing it to the Internet. When a computer on the Internet responds, the proxy 
server passes that response back to the client application on the computer that 
made the request. The proxy server is a gateway between the private network and 
the Internet.

A gateway is special software, or a computer running special software, that 
enables two different networks to communicate.

A proxy server provides a gateway between your private network to the Internet. 
You configure a proxy server to enable your workstations to communicate with 
remote services on the Internet. You select the appropriate hardware for a 
gateway computer, adequate bandwidth for the Internet connection, and choose 
the level of security for protecting your private network.

The gateway acts as a barrier that allows you to make requests to the Internet 
and receive information, but does not allow access to your network by 
unauthorized users.


In essence, proxy servers are not designed to do NAT (Network address 
translation). NAT is more a router or firewall process. NAT on a large network 
is fairly CPU intensive because each and every packet the firewall or router 
receives must be translated to a different IP address or tossed out or 
rerouted.

A proxy server merely allows or disallows external IP addresses to access your 
network and allows or disallows internal IP addresses to access external 
resources.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Darr Emery, Connie [SMTP:cedar@fgcu.edu]
Sent: Monday, June 16, 1997 12:34 PM
To: 'Joel W. Barrett'
Subject: RE: [NTSEC] MS Proxy Server

Can you use MS Proxy server to do address translation from a set of 4
class "C" addresss (externally) to internal class "B" addresses?
Connie Darr Emery
Email/Network Administrator
Florida Gulf Coast University
cedar@fgcu.edu


Actually, disabling the guest account does not necessarily prohibit this sort of access. The Everyone group, as we have seen in recent months, is all enclusive and it may be possible to be mapped to some other account (user, IUSR_computername, SQL account, etc.). As a rule, I never use the Everyone group for file system permissions which eliminates much of these issues, but not all. Following are the general guidelines I use, arguments/comments/opinions for or against any of these recommendations is welcomed bearing in mind that this is only my experience and these are general suggestions...

1. Disable the guest account

2. Format all disks (other than RISC boot partitions) with NTFS

3. Use the 'Domain Users' group in place of the 'Everyone' group for file system permissions (remove the Everyone group entirely using cacls or equivalent) Be sure that all of your users belong to the Domain Users group (you may also want to do a text dump of permissions before making changes as a precaution.

4. When creating shares, the default permissions are 'Everyone:Full Control' , remove this and change it to Domain Users:Full Control. This removes the Everyone group again and by specifying Domain Users:Full Control, you can effectively only maintain the file system permissions to acheive the desired result as they will override the share permissions (say only Accounting has file system permissions, this will override the share permissions)

Beyond this I can go on, but it is late and many others on this list have written excellent FAQ's and whitepapers. You can also have a look at a white paper from the BackOffice Professionals Association which provides a bit more information 

http://www.bopa.org/sigs/nt/winntsec.doc

Good luck,

Sean Mathias, MCSE
President, Prosolve Technical Solutions Group
Vice President of Technology, BackOffice Professionals Association
Director or Network Services, Online Interactive
seanm@prosolve.com
0 1 206 362 6398 (GMT -8:00)


-----Original Message-----
From: Eric Germann [SMTP:ekgermann@cctec.com]
Sent: Monday, June 16, 1997 8:26 PM
To: Sean Mathias
Cc: 'Charles R. Derk, Jr'; 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Shared Folders Across Internet

Or simply disable the guest account, as it is on all domains anyways...

Eric


At 12:44 PM 6/16/97 -0700, Sean Mathias wrote:
>This is not a bug at all. It is behaving exactly as it is configured to.
If the 'Everyone' group has permissions on the share and the filesystem (if
using NTFS), then access will be granted to absolutely anyone who tries to
connect to the resource. The best method of disabling this is to block
TCP/UDP ports 137-139 at your Internet gateway/router. Beyond that, some
degree of security should be in place. For starters, when granting
permissions on objects, if you are inclined to use the 'Everyone' group,
don't. Instead use the 'Domain Users' group (making sure all users belong
to that group), or, on NT 4 SP3 or later, use the 'Authenticated Users'
group. This will close this particular hole, but there may be many more
you are unaware of...
>
>Sean Mathias, MCSE
>President, Prosolve Technical Solutions Group
>Vice President of Technology, BackOffice Professionals Association
>Director or Network Services, Online Interactive
>seanm@prosolve.com
>0 1 206 362 6398 (GMT -8:00)
>
>
>-----Original Message-----
>From: Charles R. Derk, Jr [SMTP:charlie@eaki.net]
>Sent: Monday, June 16, 1997 9:37 AM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] Shared Folders Across Internet
>
>Hey all...
>
>Just joined the list this morning because of a question that I had. This
may or may not have been addressed before, but as I said, I'm new here.
>
>Anyway, last week a friend of mine called me and asked for my IP address
of my machine. 10 minutes later, one of my shared folders had been
renamed, and a bunch of bogus files dumped in to it. He told me that it is
possible, using NT, to map a network drive by just using the IP address,
and gain access to any shared folders that do not have passwords. Correct
me if I am wrong, but don't a lot of businesses created shared directories,
and eliminate the password, just so everyone inside the LAN can get to it
effortlessly? Is there anyway to get around this "bug" if it is indeed a
bug. I really do not want people outside my LAN gaining access, or even
just looking at the drives on our machines here.
>
>Thanx!
>Charlie
>
>-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
> 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
> Phone: (610) 746-0807 Fax: (610) 746-3688
>
>If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
>the doors?
>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 

Yes it works although I thought it was somewhat flaky at first... I believe it 
was operator error though and think I have it working well now. Here's some 
things I discovered along the way:

You must first install IIS 2.0 or above. Then you can install MS Proxy Server. 
I do not know how this affects SP on NT 4.0 yet but I would assume that you 
would probably want to reinstall SP3 and all hotfixes after installing IIS and 
Proxy.

You can use the basic default configuration with no filters and it works just 
fine. I have done some tweaking on my system and added filters so that only my 
Internet IP address is granted access to the system. My ISP Internet address is 
static and I got the address in NT by running IPCONFIG in a DOS shell. IPCONFIG 
shows both the NIC and Modem IP addresses but you must choose the modem IP 
address to filter on (this I know by experience).

You also want to install the client side of Proxy at each workstation which 
accesses the Proxy server for dial-up. This includes the server if you also use 
the server as a client.

Other things to do:
- Set the Idle Seconds before disconnect in the user settings of the Dial-Up 
Networking app.
- Download and install MS Index Server so you can search for things in the 
Proxy Server documentation which is only available in HTTP format.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Gunnar Bredow [SMTP:gbredow@comtech.com.au]
Sent: Monday, June 16, 1997 11:14 PM
To: Joel W. Barrett
Subject: Re: [NTSEC] MS Proxy Server

Ok - a question asked many times in the exam in many forms was whether you
could use MS proxy as a dialup solution for small business. Does it work
and if so how do you set it up ? (I guess I just answered the first
question with the second).

regards

Gunnar

----------
> From: Joel W. Barrett 
> To: RPM Engineers (E-mail) ; NT Security List Service
(E-mail) ; NPA MCSE Study Group (E-mail)

> Subject: [NTSEC] MS Proxy Server
> Date: Saturday, 14 June 1997 0:16
>
> I installed MS Proxy Server last night and will eventually take the MS
test for
> it. I need to learn as much about it as possible so if anyone has
questions
> about it I'd be happy to figure out the answer for you.
>
> I am currently using it as a network address translation (NAT) and
dial-up
> solution for a small home network with limited Internet accounts. It
seems to
> work very well. It did require MS IIS to be installed prior to its
installation
> but that was not a major hassle.
>
> I can now do an internal FTP site, Intranet Web services, and a Gopher
server
> if I wanted.
>
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!
>
>

G'day 
 ok a few things .. a proxy is NOT a firewall but can be used to
limit access and they go great in front of a firewall and behind them..

sound stupid?? not really look at the application you want a proxy may
solve it..

with firewall

placeing a proxy outside a firewall (correctly configured) can stop telent
sessions to mail ports open ports that you have to have open etc added
security right?? plus setting up a proxy to act as a cache as well can cut
your band width a heap as it looks at what your requesting looks at the site
and only brings what needs updateing.. pretty cool eh..

ok say you have a big intranet and need to reduce traffic.. stick a
proxy/cache behind the firewall and have it do the same job.. saves network
traffic there fore reducing hardware needs etc and it can add internal
security as well..

say your a ISP and like here you pay huge bucks for bandwidth.. some studies
we have seen show proxies can save you 25% of your bandwidth (big bucks) if
used correctly.. and can be used in a number of ways (forwarding from www
servers to secure servers behind firewalls with logging and authentication..
nice for business sites) the hard part is to choose which one and learning
how to get it going well and doing what you want..but aint that the hassle
we all face??

Proxies dont do everything and are in no way a substiute for a good
firewall but used wisely in conjunction with a correctly configured and
maintained firewall can improve access to sites (speed) and security..
there are a number of good books out there and heaps of stuff on the web
about them ..

cheers



John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

On Mon, 16 Jun 1997 12:44:58 -0700, seanm@prosolve.com (Sean Mathias)
wrote:

>This is not a bug at all. It is behaving exactly as it is configured to.
>If the 'Everyone' group has permissions on the share and the filesystem
> (if using NTFS), then access will be granted to absolutely anyone who 
>tries to connect to the resource. The best method of disabling this is 
>to block TCP/UDP ports 137-139 at your Internet gateway/router. Beyond
> that, some degree of security should be in place. For starters, when 
>granting permissions on objects, if you are inclined to use the 'Everyone'
> group, don't. Instead use the 'Domain Users' group (making sure all
> users belong to that group), or, on NT 4 SP3 or later, use the
> 'Authenticated Users' group. This will close this particular hole,
> but there may be many more you are unaware of...

If I'm just connected to the internet through RAS over a dedicated dial-up
connection is there any way built into NT to filter these ports? If not
what is the simplest solution?

Thanks - Kevin


FORCEDOS is an OS/2 command used to run OS/2 1.x apps in a VDM. You want to use 
the START command in either a DOS shell or batch/CMD file to run Win3.1 apps.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Sameer Khosla [SMTP:labtec@netcom.ca]
Sent: Monday, June 16, 1997 9:22 PM
To: NT Security Mailing List
Subject: Re: [NTSEC] Multiple instances of NTVDM

These are 16-bit windows apps... Originally designed for win 3.1

Sameer Khosla - labtec@netcom.ca
 ----
From: Franz Josef Katterbach 
To: Sameer Khosla 
Date: Monday, June 16, 1997 3:14 AM
Subject: [NTSEC] Multiple instances of NTVDM

>Sometimes I found similar problems when using MS Word for DOS.
>1. It may help if you start these apps via the forcedos.exe and a batch
>file.
>2. Connect and release any net resource in that batch file.
>3. I would highly recommend to use a full screen text mode for these
>applications.
>
>In File Manager: File\Properties forcedos.exe your_app.bat
>
>and the batch looks like this:
>
>...
>clmode 3 (cirrus logic vga, text mode)
>mode mono|co80
>net use ....
>your_app.exe
>net use ... /delete
>
>Hope this helps.
>
>Greetings,
> Franz Josef
>--
>======================================================================
>Klinikum Aachen ! Tel: ++49 (0)241 80-88518
>Dept. Radiology ! Fax: ++49 (0)241 8888-480
>DI Franz Josef Katterbach !
>Pauwelsstr. 30 !
>52057 AACHEN ! email:
>Germany ! katterbach@linus.rad.rwth-aachen.de
>

Perhaps because all of the DOS, Win 3.x, and Win95 users
are all essentially always logged in as "admin"?

 Ryan

---------- Previous Message ----------
To: ntsecurity
cc: 
From: dgpeters@its.cse.dnd.ca ("Peters, Donald G.") @ smtp
Date: 06/16/97 04:10:14 PM
Subject: [NTSEC] Browsers Should Warn Users

More than one person wrote:

>DON'T BROWSE WHEN YOU'RE LOGGED IN AS ADMIN!
>DON'T BROWSE WHEN YOU HAVE READ/WRITE ACCESS TO SENSITIVE FILES!

My question is, has anyone asked the browser companies to have their
browsers check with the operating system (eg, Windows NT) if you are
running as ADMIN or in some other privileged mode and at least WARN you
that you are taking an additional risk? I was not even aware of this
warning until today, though it makes perfect sense now. (But in my case
I don't have Admin privileges, fortunately ;-).)

Why haven't I seen this discussed anywhere before? Isn't this a simple,
useful security feature that can be added to browsers?

Don
dgpeters@cse.dnd.ca

P.S. I won't charge any of the browser companies over $1000 for this
security-related bugfix. (Though US$1000 is actually over CAN$1000. ;-)




Do you happen to have a email program open that is checking mail in fewer 
minutes or seconds than your Dial-Up Networking (DUN) User Preferences setting 
for Idle Seconds before Disconnect?

Also, if you are using NT you could load Network Monitor to see what is being 
sent or received over your dial-up connection.

I have also had some strange occurrences with DUN, for example, last night it 
just dialed itself a few minutes before midnight! No reason whatsoever... only 
thing I could think of was that it was lonely and wanted to talk to someone. 
 ;^) Freaked me out, to say the least.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Neven Jacmenovic [SMTP:neven@skyscraper.times.hr]
Sent: Sunday, June 15, 1997 5:58 PM
To: David Tyree
Cc: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] MS Proxy Server (RAS not disconnecting)

On Sat, 14 Jun 1997, David Tyree wrote:

> The timeout setting is controlled from within RAS, not the Proxy Server.
> Go to Dialup Networking | More | User Preferences to set a timeout.

heh, this is where the problem is. i can enter *ANYTHING* there, but my
modem just won't hangup damn connection... what would happen if my modem
wouldn't be extern modem so I couldn't see those little flashing lights? I
would have to connect with ras administrator every not and then?

I checked my modem settings, and everything is allright... it just seems,
like proxy just won't IDLE... I haven't sniff any packets, but I supose
that is the next logical step to do... Any help STILL needed :)

Thanx in advance
Neven

> All the machines in our network are running NT4.0. Some run
[rather lenghty explanation of the problem cut]
> We have to reinstall the OS.
> I have looked through the registry to see if there is any
> setting available to turn off drag-n-drop. Couldn't find one.
> Is there such a registry setting or is this some kind of virus?

 I spent half a year pinning that down. It all came down to a genius
mouse! After I replaced the genius mouse I had, drag'n'drop worked
perfectly. My symptoms were exactly as yours except that reboot fixed
the problem - only for the problem to return in less than three days
(sometimes instantaneously). Another thing I noticed with this was that
the screen saver stopped and started working along with the d'n'd. Hope
this helps.

-- 
Juha Jäykkä, juolja@utu.fi
Having listened to (or read) the reviews on "Low Brainer/Low Cost"
Firewalls such as The Wall with interest, I am now in the position of
determining the suitability of such a product for a specific purpose.

We currently have a number of NT boxes collecting SNMP stats from points
around the part of our network that is providing clients with their
internet connections. Now we obviously don't want anyone to mess with
the stats that are sitting on these boxes, but the boxes are visible to
any of our clients and we do need them to allow FTP of the stats back to
a central point periodically. I have been told that I should have a
firewall such as Firewall ONE installed on each (could be many) of the
NT boxes so as to make them bullet proof. The cost factor alone is
making me think long and hard about possible alternatives, however I
personally have my doubts that this is really necessary.
The cost of The Wall product is reasonable enough per box to consider it
but I am not sure of its suitability for the task.

Do people think that a firewall is the answer?
Are there other products that could do the job of protecting these
boxes?
Are there other low cost firewall products like The Wall that could do
the job?

Any comments are quite welcome.

Tim.

Sameer Khosla wrote:
> 
> These are 16-bit windows apps... Originally designed for win 3.1
> 
> Sameer Khosla - labtec@netcom.ca

Yeah, this could be right. But the ntvdm.exe is the "NT Virtual Dos
Machine". So it seems that some code in your win16-apps is calling DOS
functions via ntvdm or starts DOS-based subprograms ... ??
The other possibility is, that from the "Startup" group, the "Run" and
"Runonce" lines in the registry or the "run=" and "load=" -lines in the
Win.ini file s.th. is called, that requires ntvdm running.

Greetings,
 Franz Josef

-- 
======================================================================
Klinikum Aachen ! Tel: ++49 (0)241 80-88518 
Dept. Radiology ! Fax: ++49 (0)241 8888-480 
DI Franz Josef Katterbach ! 
Pauwelsstr. 30 ! 
52057 AACHEN ! email: 
Germany ! katterbach@linus.rad.rwth-aachen.de
Hello,

I like to lock the floppy drives to prevent users to load programms
(viruses)... I know there's a small utility in the RESKIT to do this.
But this utility locks the drive completely. What I would prefer is
to allow users to load data files but no executables! Is there a
way to do this? How can this be achived? Is there a commercial utility
or a Readme how to programm it (preferable with C++)?

Thanks
 Martin

------------------------------------------------------------------------
Dipl.-Ing. Martin Bernreuther University of Stuttgart
Pfaffenwaldring 7 Informationsverarbeitung im
70569 Stuttgart konstruktiven Ingenieurbau
Germany
 E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
 http://www.uni-stuttgart.de/iv-kib/
------------------------------------------------------------------------
At 10:15 16.06.1997 +0100, John Taylor wrote:
>I think this has something to do with security, although it may be a bug!
>
>After printing from IE 3.02, I find that I can no longer print from a DOS
>box. I get the error message Access is denied. Printing from a windows
>program works OK.

I couldn't reproduce this on my NT 4.0 Server. I printed a page from IE
3.02 and then tried to print from command prompt. It worked fine. 



 Stef

--------------------
RokNET Administrator
stef@roknet.ro
http://www.roknet.ro
--------------------
On Tue, 17 Jun 1997 05:11:18 GMT, you wrote:

[old stuff deleted]
>
>If I'm just connected to the internet through RAS over a dedicated dial-up
>connection is there any way built into NT to filter these ports? If not
>what is the simplest solution?
Yes - it's also possible for RAS connections to have a _very_
primitive filter installed.
Remember the security feature for network cards? You can do
the same for the "RAS adapter" (Usually NDISWANn, n=3 on my
box). Not totally sure 'bout the syntax now (no resourcekit at hand)
but you could try to set it on for a network card & track the changes
in the registry. Should be one key in Services/Tcpip called security
or something like and three keys in Services/NDISWAN3 (or
what it is on your system) called IPAllow, UDPAllow, TCPAllow
specifying the ports for which incomming conections are accepted
(OK - the first one specifies the protocols allowed).
Have read it in the resource kit - placed into the registry - and it
seems to work. netmon shows RST-packets for not allowed but
listeningTCP-ports and ftp works no longer in active mode (remote host
opening data connection).
BUT - it's a crude approach, any protocol requiring the remote host
to initiate a connection will be broken!

But you asked for the simplest solution?
Got to Network/Bindings and disable the WINS client. Reboot.
Disable all services/devices crying for NETBT. Iterate one or 
two times to disable all affected services.
One hint: no SMB-based networking will be available after these
steps.

hope that helped a little,

Dietz Proepper
-- 

 Dietz Proepper, [Software|Web] Designer, S.E.P.P. MED
 AKA tik on IRC, bladerunner on netrek, 
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. Neither S.E.P.P. MED nor heaven 
+ or hell shall be made responsible.
Thanks to all of you who answered my question!

I got a lot of responses, many of them having a lot of good pointers which went beyond the scope of my question which really made me re-think our network layout. It looks like I will be quite busy in the next couple of weeks making some changes which we hopefully, make our network a little more secure.

Thanks again... I really appreciate it!
Charlie


-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==- 
 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
 Phone: (610) 746-0807 Fax: (610) 746-3688

If a 7-11is open 24 hours a day, 365 days a year, why are their locks on
the doors?


hi,

I am sorry if this does not directly conforms to the group discussions 
objective but I've seen a lot of good NT solutions/fixes discussed that I 
cannot help but to think that you guys know a lot about NT.

I was wondering if anybody can provide me with some light on this 
matter.. We have to connect a SQL server on our site/domain (valid FQDN 
and IP address) to machines on an intranet which has a gateway that is 
not on our domain or ip range. The good news is that these 2 things 
resides in the same building and we have the power to manipulate the 
datalines (patchings etc) as needed. Is there anyway that a line can be 
linked directly from the server to the ethernet hub serving the 
intranet... the IP addresses would surely be different (intranet).. 

later, probably end of the year, (this would be another question), the 
server will be placed in another intranet. Any way of letting people on 
one intranet have access to the server which resides on another 
intranet?

FYI, the machines on the intranet are win95s and the SQL server is 
running Win NT 4.0. If there are any Win/Networking gurus that can help 
me in this, I'd really appreciate it. The servers serving the intranet are 
NT 3.51s and Redhat linux.
 
thanks in advance.
rimi.
Hicom Communication (Malaysia)
+60-3-202-8839


> -----Original Message-----
> From: Frank Knobbe [SMTP:FKnobbe@BellSouth.net]
> Sent: Monday, June 16, 1997 11:18 AM
> To: 0x486578; ntsecurity@iss.net
> Cc: a@mail.bna.bellsouth.net
> Subject: Re: [NTSEC] *Safe* Proxy server?
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> >On 16 Jun 97 at 4:07, 0x486578 wrote about: Re: [NTSEC] *Safe* Proxy
> >server?
> >
> >> [...]
> >> security of the security of the system as a whole. If I can hack
> >> into your proxy server with a filesharing hole then your proxy is
> >> useless. Also I could be wrong on this (But most likely not), but a
> >> [...]
> 
> >If you run MS Proxy, block 47 and 1745 (or whatever you configured
> the
> >Proxy for). Otherwise folks from Internet might be able to connect
> to
> >your proxy and proxy back out, using your proxy's IP address as a
> >disguise for hacking purposes. I know, they shouldn't be able to
> >because they are not specified in your LAT, but who knows what bugs
> >are still lurking in MS Proxy... :)
> 
> I set up our proxy server with 2 network cards, one internal, one
> external.
> On the external card, we have everything disabled, except for TCP/IP
> itself. We've also disabled the local web and gopher servers on the
> box, and
> just about every other service that might talk to the internet. With
> this
> configuration, I'm reasonably confident in our proxy server.
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
Hi all,

This may somewhat like an farfetched topic but I doen't no wherelse to
find an answer.

I've been looking at CATIA, which is a CADCAM application from which
certain parts recently have been ported from Unix to WindowsNT using
NuTCracker from DataFocus. To run CATIA a NuTCracker Kernel service is
installed. Does anybody know what this service is doing and more
inportant if the ported programs endanger the WindowsNT security
measures in anyway and could enable them to avoid certain measures ?

Greetings,
Reinout




Oops,
After I hit the send button I realized my answer was more suited to 95 
users running share level security. I've seen quite a bit of corporate 
systems set up with a 95/NT LAN and an ISDN router to the internet. The 
95 machines are a cinch to hack, NT a little tougher. You need make 
sure the guest account is disabled and use your own groups for share 
permissions instead of the built in NT groups; at least not the Everyone 
group. Just tighten up with the little things like, NTFS, enable 
logging, enable account lockouts, etc. etc. This will help you at least 
on the LAN, now for the internet you need to have a firewall that blocks 
the specific ports... I'm not sure on what ports to block though


----------------------------------------------
Eric Roberson
MCSE/Email Administrator
Relational Management Services
eroberson@rmsys.com

So what you'd like to do is allow the user to rename their executables
to some other extension and then copy them from the floppy and then
rename them back? ;-)

Don't think that would be too great of an idea.

Paul W. Ward
Software Engineer
NexTrend, Inc.
pward@nextrend.com

>----------
>From: Martin Bernreuther[SMTP:Martin.Bernreuther@po.uni-stuttgart.de]
>Sent: Tuesday, June 17, 1997 3:42 AM
>To: NTSecurity Mailing List
>Subject: [NTSEC] Locking Floppy drive
>
>Hello,
>
>I like to lock the floppy drives to prevent users to load programms
>(viruses)... I know there's a small utility in the RESKIT to do this.
>But this utility locks the drive completely. What I would prefer is
>to allow users to load data files but no executables! Is there a
>way to do this? How can this be achived? Is there a commercial utility
>or a Readme how to programm it (preferable with C++)?
>
>Thanks
> Martin
>
>------------------------------------------------------------------------
>Dipl.-Ing. Martin Bernreuther University of Stuttgart
>Pfaffenwaldring 7 Informationsverarbeitung im
>70569 Stuttgart konstruktiven Ingenieurbau
>Germany
> E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
> http://www.uni-stuttgart.de/iv-kib/
>------------------------------------------------------------------------
>
 I think having the application check whether it is being
 operated by a powerful user is losing battle. Every
 application would have to do it including Excel, Word97,
 Notes, Visual Basic, etc. Since they are all becoming Internet
 enabled and the enablement can take the form of a dynamically
 loaded library and they all have scripting capability, this
 would be a lot of work with no improvment in security.

 The problem here is that as has been stated many times in this
 group, people simply log in as "administrator" stay logged in
 that way. The NT system must evolve into a system which
 requires little if any ongoing "administrator" privileges.
 Notwithstanding the great complexity of the security model
 itself, now is the time to "object-ify" security. It should be
 simple AND checkable; today, NT fits neither of those glass
 slippers.

 My model is that if you can't explain everything a programmer
 needs to know about security in 1/2 hour, then it's too
 complex. This is seen by the number of errors in coding of
 security issues we have seen in the last 6 months. It's not
 that people weren't trying to do the correct thing, its just
 too complex for anyone to understand (and therefore use
 correctly).

 Here is an example of needless complexity:

 I want to become "administrator" and I know the
 correct password so I type

 c:\ntreskit\su administrator

 but it comes back and says I don't have the necessary
 privileges to use the su.exe program. I go and get the
 susrv.zip file off the internet, compile it and
 install it as a service and once again type
 su administrator
 This time I become administrator. The only difference
 here is that the susrv.exe program has the necessary
 privileges to create a process for me. Now I needed
 real administrator privileges to install the susrv
 service. To do that, I need to know the password of
 adminstrator. But I knew that when I first tried
 su.exe.

 The current security model makes me either log
 completely out (and shut down all programs) or acquire
 the susrv utility and install it. In either case the
 only thing separating me from administrator privileges
 is an unnecessarily large number of keystrokes -- nothing
 else.

 That is needless complexity and causes people to stay
 logged in to their workstation or server as
 administrator all the time. One measure of this would
 be the percentage of programmers that actually run in
 administrator mode (either as "administrator" or a
 member of the "administrators" group). If the number
 is larger than 10% or so, I think something is wrong.
 (10% is my number for rookies or people who don't know
 any better.)

 Anyway, I think the NT security model is reasonable and
 complete. It's just too complex (way!).

 This is my humble opinion.

 Ed



According to Peters, Donald G.:
> 
> More than one person wrote:
> 
> >DON'T BROWSE WHEN YOU'RE LOGGED IN AS ADMIN!
> >DON'T BROWSE WHEN YOU HAVE READ/WRITE ACCESS TO SENSITIVE FILES!
> 
> My question is, has anyone asked the browser companies to have their
> browsers check with the operating system (eg, Windows NT) if you are
> running as ADMIN or in some other privileged mode and at least WARN you
> that you are taking an additional risk? I was not even aware of this
> warning until today, though it makes perfect sense now. (But in my case
> I don't have Admin privileges, fortunately ;-).)
> 
> Why haven't I seen this discussed anywhere before? Isn't this a simple,
> useful security feature that can be added to browsers?
> 
> Don
> dgpeters@cse.dnd.ca
> 
> P.S. I won't charge any of the browser companies over $1000 for this
> security-related bugfix. (Though US$1000 is actually over CAN$1000. ;-)
> 
> 


-- 
Ed Bradford
NT Architecture M/S 9170
Software Solutions Div. Integrated Solutions Architecture
egb@austin.ibm.com 11400 Burnet Rd
Phone: T/L 678-1421 Austin,Tx, 78758
Real Phone 512-838-1421 FAX 512-838-2212

At 04:51 PM 6/17/97 +1000, Tim Duncan wrote:

>We currently have a number of NT boxes collecting SNMP stats from points
>around the part of our network that is providing clients with their
>internet connections. Now we obviously don't want anyone to mess with
>the stats that are sitting on these boxes, but the boxes are visible to
>any of our clients and we do need them to allow FTP of the stats back to


A proxy firewall is what you need if you use many protocols with filterable
commands, and you also want to protect the used ports against malicious IP
attacks. Doesn't sound like that's the case. Since it appears you're only
using SNMP and FTP, you can use the filters on your routers to allow traffic
for just those protocols. Additionally you can adjust with the advanced
network security options in the network control panel, but router filtering
is more reliable. Simple, cheap _and_ fast. ;^)

Bill Stout

_____________________________________________________________________________
Bill Stout (Systems Engineer/Consultant) stoutb@pios.com
Pioneer Standard (Computer Systems & Components) http://www.pios.com/
San Jose, CA (Location of 1 of 52 U.S. offices) (408) 954-9100
*My opinions do not reflect that of the company, and visa-versa, thankfully.*

Is there a good way to send a popup to an admin terminal if a user gets
locked out, or if there has been repeated login failed attempts??? Any
advice would be helpful.
We are using NT 3.51 server and workstations.

Scott

Using NT Server 4, there is an option under Network->Protocols->TCP/IP->Advanced to Enable Security...Configure. This allows you to set TCP/UDP port/protocol restrictions, though it is implemented exactly opposite as one would expect. Rather than denying ports/protocols, you specify the ports/protocols to allow. This is very precise in that if configured, IT WILL ONLY ALLOW THOSE PORTS/PROTOCOLS EXPLICITLY SPECIFIED. It would make much more sense to deny specific ports/protocols. So, the best solution is to disable the binding between your Remote Access WAN Wrapper and WINS/NetBIOS. This should provide a good degree of protection which you can easily test/verify.

Sean Mathias, MCSE
President, Prosolve Technical Solutions Group
Vice President of Technology, BackOffice Professionals Association
Director or Network Services, Online Interactive
seanm@prosolve.com
0 1 206 362 6398 (GMT -8:00)


-----Original Message-----
From: Kevin Porter [SMTP:kporter@nmia.com]
Sent: Monday, June 16, 1997 10:11 PM
To: ntsecurity@iss.net
Subject: RE: [NTSEC] Shared Folders Across Internet

On Mon, 16 Jun 1997 12:44:58 -0700, seanm@prosolve.com (Sean Mathias)
wrote:

>This is not a bug at all. It is behaving exactly as it is configured to.
>If the 'Everyone' group has permissions on the share and the filesystem
> (if using NTFS), then access will be granted to absolutely anyone who 
>tries to connect to the resource. The best method of disabling this is 
>to block TCP/UDP ports 137-139 at your Internet gateway/router. Beyond
> that, some degree of security should be in place. For starters, when 
>granting permissions on objects, if you are inclined to use the 'Everyone'
> group, don't. Instead use the 'Domain Users' group (making sure all
> users belong to that group), or, on NT 4 SP3 or later, use the
> 'Authenticated Users' group. This will close this particular hole,
> but there may be many more you are unaware of...

If I'm just connected to the internet through RAS over a dedicated 


On Tue, 17 Jun 1997, Kevin Porter wrote:

> On Mon, 16 Jun 1997 12:44:58 -0700, seanm@prosolve.com (Sean Mathias)
> wrote:
> 
> >This is not a bug at all. It is behaving exactly as it is configured to.
> >If the 'Everyone' group has permissions on the share and the filesystem
> > (if using NTFS), then access will be granted to absolutely anyone who 
> >tries to connect to the resource. The best method of disabling this is 
> >to block TCP/UDP ports 137-139 at your Internet gateway/router. Beyond
> > that, some degree of security should be in place. For starters, when 
> >granting permissions on objects, if you are inclined to use the 'Everyone'
> > group, don't. Instead use the 'Domain Users' group (making sure all
> > users belong to that group), or, on NT 4 SP3 or later, use the
> > 'Authenticated Users' group. This will close this particular hole,
> > but there may be many more you are unaware of...
> 
> If I'm just connected to the internet through RAS over a dedicated dial-up
> connection is there any way built into NT to filter these ports? If not
> what is the simplest solution?
> 
> Thanks - Kevin
 
In the bindings on your network properties, disable the server service on 
the RAS adapter, and probably disable the while netbios thing on the RAS
adapter, assuming that the computer is connected to a network and 
actually needs these services, if not, just remove them.
> > 
> 


On Sat, 14 Jun 1997, Jack LeGrand wrote:

> Okay...here's a good one. I recently took an abbreviated Proxy course
> and one thing that was unclear to all present was....since MS Proxy is
> NOT a firewall, it will in most case work in line with a firewall.

As will any proxy server.
> 
> Question: Should the proxy server be on the outside of the firewall?
If the intent is to control user access (inside -> out) it would require 
storing user information on it, which would suggest keeping it inside 
the network. If it acting as a ras server, it would need to be on the
outside of the firewall. Using it simply for caching (dedicated caching
proxy server), it really wouldn't matter much, except for the possibility
of vanalism and denial of service attacks against it.
If the proxy was being used with the winsock proxy (ipx -> IP) it would
probably have to be inside the firewall, unless you had one of those rare
firewalls that handled ipx.
If using MS challenge response, I think that this may be using port 139?
if so, you might not want to pass this through the firewall. 

> If so, does it affect the ability of a firewall that does Network
> Address Translation. In this case the firewall is passing to the Proxy
> server a single IP (I presume). Is it able to keep the individual
> sessions separate?

Sometimes they are, I never could figure out how that works.
I have installed a microtrend Viruswall http scanner behind a 
Raptor firewall. The Viruswall works as a proxy server, except
it can't actually request the information from the internet,
it has to forward the proxy to another server. Raptor can act as this
proxy server. Interestingly enough, if authentication is required 
by Raptor, the Viruswall would forward the authenication to the actual
client. And each client would have to authenticate, even through Raptor
saw them as all coming form the same IP address.
> 
> The same sort of question also exists if you put the proxy server on the
> inside of the firewall. If the proxy server is passing off (the
> presumed) single IP, how does the firewall keep track of the sessions of
> the (800) internal clients on our network?
> 
The firewall logs only the proxy server. Some proxy servers 
allow themselves to be slaves to another proxy server, the first 
one caches but the next one actually does the dns. This would allow
you to get at nonstandard port theough most application gateway firewalls,
but this does help the logging, and I don't beleive MS proxy does this
> 
> Noone at the session (including the instructor) had a good grasp of how
> the MS Proxy fits within a traditional "Outer DMZ" architecture. If you
> have any input on this, I'd be interested.....

People generally put there proxy server inside the firewall in my 
experiences. Reasoning for this is largelly based on the reasoning
for having one. A lot of companies find it's easier to control user
on the internal network going to the Internet with a proxy server than 
a firewall, but need the firewall to control outside users coming in.

Having a proxy server outside the firewall could have one small advantage.
Some application gateway firewalls can't handle the browser ftp with 
authentication. Although most proxy servers can. Running the firewall through
the outside proxy server can generally solve this. 

Also, The Raptor Eagle firewall is licensed by the number of IP addresses
on the inside network that are allowed to pass through its gateway. I've
seen more than one company use a proxy server with 200 clients. The firewall
sees 1 license in use. (this doesn't work on Firewall-1, trust me)
> 
> Jack LeGrand
> jackl@infi.net
> 
Paul Ward wrote:
> 
> So what you'd like to do is allow the user to rename their executables
> to some other extension and then copy them from the floppy and then
> rename them back? ;-)

Since code is a special kind of data, usually there is a specific stub
you will find at the beginning of an executable. This can be checked.
I know this can be changed, but without an hex editor it can't be
changed
back. If it's an modification without effect I'm beaten, but most of
my users are not able for this kind of hack...

Bye
 Martin

------------------------------------------------------------------------
Dipl.-Ing. Martin Bernreuther University of Stuttgart
Pfaffenwaldring 7 Informationsverarbeitung im
70569 Stuttgart konstruktiven Ingenieurbau
Germany
 E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
 http://www.uni-stuttgart.de/iv-kib/
------------------------------------------------------------------------
Does someone know how to stop users from locking theirs workstations? We
have quite a lot of users with very restricted access rights, but they
often lock their workstations and do then forget about it. The
administrator not being always around, we are looking for a solution to
log off users who have been idle for a certain time or to disable the
option "Lock Workstation".

Thanks in advance

ITC SA
Martin Schetat
I not quite certain that I understand exactly what you are doing, but if
all these boxes are doing is collecting SNMP info *from* other boxes (they
don't listen for SNMP request themselves) and occasionally FTP the data
*to* another host, well then a firewall on each box is entirely unnecessary
and overly complex. Firewall 1 will *not* make these boxes bulletproof.

You really just need good host security on each of these NT boxes. Let me
make a few suggestions:

Turn off all unnecessary services -
 Alerter
 ClipBook Server
 Computer Browser
 DHCP Client
 Directory Replicator
 Messenger
 Net Logon
 Network DDE
 Network DDE DSDM
 Remote Procedure Call Locator (you must leave the RPC Service running)
 Schedule
 Server
 TCP/IP NetBIOS Helper
 Telephony Service
 UPS
 Workstation

You should only have a few services left running (Eventlog, NTLM Security
Provider, Spooler, RPC Service, and Plug and Play). Since you must leave
the RPC Service running in order to have a functional machine from the
console, use the built in TCP/IP security services to block network access
to all ports not being used (everything at this point), but specifically
block TCP 135 because you can't stop it from listening. Unbind WINS TCP/IP
client from your network adapter(s) to stop TCP 139 from listening. Have a
minimal user community on each box and only allow logons from the console.
Specifically remove everyone's permission to logon from the network just as
another layer of precaution (TCP 139 should not be listening now, but just
incase it gets turned back on).

Do a TCP and UDP port scan of each NT box and there should be *no* UDP or
TCP ports listening (also check with netstat shipped in SP3). Winsock
client applications like SNMP client utilities and FTP clients should still
work just fine still. Your NT boxes will now provide 0 services to the
network that can be attacked. Take care to still set file, directory, and
registry permissions with care, and make sure that those users that can
logon from the console are placed in the appropriate groups for their job
responsibilities.

I might have missed something, but this should be a very good start to
getting those NT boxes tightly controlled and reduce the risk of compromise
significantly.

Dominique 

At 04:51 PM 6/17/97 +1000, you wrote:
>Having listened to (or read) the reviews on "Low Brainer/Low Cost"
>Firewalls such as The Wall with interest, I am now in the position of
>determining the suitability of such a product for a specific purpose.
>
>We currently have a number of NT boxes collecting SNMP stats from points
>around the part of our network that is providing clients with their
>internet connections. Now we obviously don't want anyone to mess with
>the stats that are sitting on these boxes, but the boxes are visible to
>any of our clients and we do need them to allow FTP of the stats back to
>a central point periodically. I have been told that I should have a
>firewall such as Firewall ONE installed on each (could be many) of the
>NT boxes so as to make them bullet proof. The cost factor alone is
>making me think long and hard about possible alternatives, however I
>personally have my doubts that this is really necessary.
>The cost of The Wall product is reasonable enough per box to consider it
>but I am not sure of its suitability for the task.
>
>Do people think that a firewall is the answer?
>Are there other products that could do the job of protecting these
>boxes?
>Are there other low cost firewall products like The Wall that could do
>the job?
>
>Any comments are quite welcome.
>
>Tim.
>
>
>
Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
Hello all, 
 I am a summer intern with the Motorola Corp. and my job has
nothing to do with administering NT networks. However, I have been
trying to run DOS based programs in NT with no success. 
 I am at the point where I get a polite pop-up window stating
that NTVDM will not allow the program to run because it is trying to
execute an illegal instruction. I tried to run a few different programs
just to be sure that it wasn't the program's fault...still, no success. 
 I am probably wrong, but I think that these prgms are trying to
access the hard drive directly and NTVDM doesn't want to allow it. 
 I understand that going around NTVDM is a serious security
issue, but can it be done? 

%%%%%%%%%%%%%%%%%%%%%%%%
These comments are purely my own 
and in no way represent the beliefs or 
values of the Motorola Corporation. 

Victor Marshall vgm@cldc.howard.edu
%%%%%%%%%%%%%%%%%%%%%%%%


Multihomed 4.0 PDC (public and private IP networks)
No IP forwarding between networks
NetBIOS, TCP/IP, and NetBT all enabled
WINS enabled

Problem: Browsing from the PDC is _slow_

I've looked at Q155986 and Q166159 - both apply to this problem. 86 has you
enable the routing between the two cards -- a definite no-no in my case. 59
has the registry fix for the redirector - but applying that didn't fix the
problem.

I've created LMHosts (with #PRE and #DOM tags) to have the complete public
and private lists and loaded that into WINS -- no help. I've made sure that
the settings on each of the ethernet cards are correct (no gateway on the
private side, WINS address on the private side; gateway on the public side,
WINS address on the public side) - still no help.

While I'm eventually able to the proper share, this is getting _really_
annoying -- any ideas on where to go next? I've thought about disabling the
NetBT service, but that is used on some VPNs so it's out. Disabling WINS is
also out because of the same VPN issue. I've checked the default routes
that were installed and they look ok (for IP) and IP access on this has no
problems - just NetBIOS. Anything else that could be done to help this
monster figure out what to do?

Frostie
--
Frostie Sprout Frostie@wyoming.com Voice: 307.856.4220
System Engineer, wyoming.com LLC FAX: 307.856.1499
 Wyoming's Leading Internet Service Provider
Opinions are mine and do not necessarily reflect those of wyoming.com
A. Einstein--"God might be subtle, but He is never malicious."
 "Albert! Stop telling God what to do!"--E. Fermi



 Thanks for all your help in the past. This is my major source of
 answers when books don't help.

 A couple more questions:

 1) Are ids with an account type of 'server' or 'workstation'
 interactive? Could you logon to them from a terminal if you knew the
 password?

 2) Do all servers need to be defined to the PDC with and account type
 of 'user'? And do they need Domain Admin access?

 Thanks Again!

 Connie
 (cmbalodimos-barry@bkb.com)
NT has no way of determining what files
might be executable, or easily made
executable. Examples include
source code, debug scripts, etc..

 Ryan

---------- Previous Message ----------
To: ntsecurity
cc: 
From: Martin.Bernreuther@po.uni-stuttgart.de (Martin Bernreuther) @ smtp
Date: 06/17/97 08:42:33 AM
Subject: [NTSEC] Locking Floppy drive

Hello,

I like to lock the floppy drives to prevent users to load programms
(viruses)... I know there's a small utility in the RESKIT to do this.
But this utility locks the drive completely. What I would prefer is
to allow users to load data files but no executables! Is there a
way to do this? How can this be achived? Is there a commercial utility
or a Readme how to programm it (preferable with C++)?

Thanks
 Martin

------------------------------------------------------------------------
Dipl.-Ing. Martin Bernreuther University of Stuttgart
Pfaffenwaldring 7 Informationsverarbeitung im
70569 Stuttgart konstruktiven Ingenieurbau
Germany
 E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
 http://www.uni-stuttgart.de/iv-kib/
------------------------------------------------------------------------




Joel W. Barrett wrote:
> 
> ...
> In essence, proxy servers are not designed to do NAT (Network address
> translation). NAT is more a router or firewall process. NAT on a large network
> is fairly CPU intensive because each and every packet the firewall or router
> receives must be translated to a different IP address or tossed out or
> rerouted.

Hmm? That's precisely what the MS Proxy server does--it filters packets
and readdresses them so that they all appear to be coming from the proxy
server.

> 
> A proxy server merely allows or disallows external IP addresses to access your
> network and allows or disallows internal IP addresses to access external
> resources.

And, in the case of the MS product, logs access and provides permissions
on a per-user basis.

> -----Original Message-----
> From: Darr Emery, Connie [SMTP:cedar@fgcu.edu]
> Sent: Monday, June 16, 1997 12:34 PM
> To: 'Joel W. Barrett'
> Subject: RE: [NTSEC] MS Proxy Server
> 
> Can you use MS Proxy server to do address translation from a set of 4
> class "C" addresss (externally) to internal class "B" addresses?

Well, you'd normally just have a single external IP address, but
otherwise the answer is yes.
On Tue, 17 Jun 1997 egb@austin.ibm.com wrote:



> This is my humble opinion.

I think that setting programs to run as a different user (SUID/SGID
nobody) could do wonders for moving in the right direction. An internet
browser would be a perfect example of something that should run asa
completely unpriveledged user.

--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


Does anyone know how to enumerate the users and groups in a trusted domain?

I know that it can be done, since I can see them in the user manager, but I
am unable to access this information from my own code. The NetxxxEnum
functions don't appear to have the appropriate rights.

thanks
dan

------------------------------------------------------------
Dan Barrett dbarrett@aventail.com
NT Server Development Lead www.aventail.com
Aventail 206.777.5609

Hi, are there somebody know a tcp listener quite similar to snoop on sun,
or tcpdump on dec which running on NT, and this can also work closely like
sniffer 

any comments appreciated


vedi

Just joined list so not sure if this has been discussed.

Just set up NT Radius client. It works with my
Shiva Radius server but not my Livingston Radius
server. Turns out NT Radius puts the challange in
CHAP-Challange attribute #60 and this is not
defined in Livingston dictionary. Putting it in
dictionary doesn't help because livingston
doesn't do anything with it. RFC says this
should be supported.

Anyone run into same problem?

dreez

-----------------------------------------------------------------------
Michael J. Endrizzi-InterSec Communications Inc.
Internet and Computer Security Consulting 
7020 145th Street West, Apple Valley, MN 55124
Vc)612-432-0509 Fx)612-432-2428
mje@intersec.com

 
"Lock workstation" also allows administrator level users to login to the 
workstation. Of course this logs out the local user and shuts down any app they 
were running... but at least it lets the admin people get in without having to 
turn off the system.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Martin Schetat [SMTP:itc@span.ch]
Sent: Tuesday, June 17, 1997 2:26 PM
To: NT Security Mailing List
Subject: [NTSEC] How to disable "Lock Workstation" or to log off idle users

Does someone know how to stop users from locking theirs workstations? We
have quite a lot of users with very restricted access rights, but they
often lock their workstations and do then forget about it. The
administrator not being always around, we are looking for a solution to
log off users who have been idle for a certain time or to disable the
option "Lock Workstation".

Thanks in advance

ITC SA
Martin Schetat

Hi
Where do u haven't the "drag-n'-drop" feature ?

Do remember u can prevent user to put some stuff on the desktop, but I 
think it isn't these problem, right ?

Have a nice day
Patrik

-----Original Message-----
From: Juha Jäykkä [SMTP:juolja@utu.fi]
Sent: Dienstag, 17. Juni 1997 08:06
To: Pradeep Tapadiya
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] Is there some option on NT to prevent 
drag-n-drop?

> All the machines in our network are running NT4.0. Some run
[rather lenghty explanation of the problem cut]
> We have to reinstall the OS.
> I have looked through the registry to see if there is any
> setting available to turn off drag-n-drop. Couldn't find one.
> Is there such a registry setting or is this some kind of virus?

 I spent half a year pinning that down. It all came down to a genius
mouse! After I replaced the genius mouse I had, drag'n'drop worked
perfectly. My symptoms were exactly as yours except that reboot fixed
the problem - only for the problem to return in less than three days
(sometimes instantaneously). Another thing I noticed with this was 
that
the screen saver stopped and started working along with the d'n'd. 
Hope
this helps.

--
Juha Jdykkd, juolja@utu.fi
Hi folks

What do u mean will do the stock exchange after these news ?
...and the other security bugs in sensitive software ?

Is anyone familiar with "security-news" and the stock market ?

Cu
PAtrik

-----Original Message-----
From: Ryan Russell/SYBASE [SMTP:Ryan.Russell@sybase.com]
Sent: Dienstag, 17. Juni 1997 04:30
To: Peters Donald G.
Cc: 'ntsecurity@iss.net'
Subject: Re: [NTSEC] Browsers Should Warn Users

Perhaps because all of the DOS, Win 3.x, and Win95 users
are all essentially always logged in as "admin"?

 Ryan

---------- Previous Message ----------
To: ntsecurity
cc: 
From: dgpeters@its.cse.dnd.ca ("Peters, Donald G.") @ smtp
Date: 06/16/97 04:10:14 PM
Subject: [NTSEC] Browsers Should Warn Users

More than one person wrote:

>DON'T BROWSE WHEN YOU'RE LOGGED IN AS ADMIN!
>DON'T BROWSE WHEN YOU HAVE READ/WRITE ACCESS TO SENSITIVE FILES!

My question is, has anyone asked the browser companies to have their
browsers check with the operating system (eg, Windows NT) if you are
running as ADMIN or in some other privileged mode and at least WARN you
that you are taking an additional risk? I was not even aware of this
warning until today, though it makes perfect sense now. (But in my case
I don't have Admin privileges, fortunately ;-).)

Why haven't I seen this discussed anywhere before? Isn't this a simple,
useful security feature that can be added to browsers?

Don
dgpeters@cse.dnd.ca

P.S. I won't charge any of the browser companies over $1000 for this
security-related bugfix. (Though US$1000 is actually over CAN$1000. ;-)



I stand corrected. I told you I was still learning this Proxy Server stuff. The 
proxy server (or proxy gateway) does translate from an internal IP address (ex: 
10.1.1.1) to another IP address, usually either a valid Internet IP address or 
a valid WAN IP address. It also performs the translation in reverse.

So, there are several products which may perform NAT (Network Address 
Translation) redundancy on your network: a router, a firewall, or a proxy 
server. Not all routers and firewalls have the capability to do NAT.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Paul J. Ste. Marie [SMTP:pstemari@well.com]
Sent: Tuesday, June 17, 1997 7:11 PM
To: NT Security List Service (E-mail)
Subject: Re: [NTSEC] MS Proxy Server

Joel W. Barrett wrote:
>
> ...
> In essence, proxy servers are not designed to do NAT (Network address
> translation). NAT is more a router or firewall process. NAT on a large 
network
> is fairly CPU intensive because each and every packet the firewall or router
> receives must be translated to a different IP address or tossed out or
> rerouted.

Hmm? That's precisely what the MS Proxy server does--it filters packets
and readdresses them so that they all appear to be coming from the proxy
server.


Actually I'd like to find a utility that allows access based on the
users rights within the domain. Has anyione come across something that
will do this?

Thanks
Steve


Paul Ward wrote:
> 
> So what you'd like to do is allow the user to rename their executables
> to some other extension and then copy them from the floppy and then
> rename them back? ;-)
> 
> Don't think that would be too great of an idea.
> 
> Paul W. Ward
> Software Engineer
> NexTrend, Inc.
> pward@nextrend.com
> 
> >----------
> >From: Martin Bernreuther[SMTP:Martin.Bernreuther@po.uni-stuttgart.de]
> >Sent: Tuesday, June 17, 1997 3:42 AM
> >To: NTSecurity Mailing List
> >Subject: [NTSEC] Locking Floppy drive
> >
> >Hello,
> >
> >I like to lock the floppy drives to prevent users to load programms
> >(viruses)... I know there's a small utility in the RESKIT to do this.
> >But this utility locks the drive completely. What I would prefer is
> >to allow users to load data files but no executables! Is there a
> >way to do this? How can this be achived? Is there a commercial utility
> >or a Readme how to programm it (preferable with C++)?
> >
> >Thanks
> > Martin
> >
> >------------------------------------------------------------------------
> >Dipl.-Ing. Martin Bernreuther University of Stuttgart
> >Pfaffenwaldring 7 Informationsverarbeitung im
> >70569 Stuttgart konstruktiven Ingenieurbau
> >Germany
> > E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
> > http://www.uni-stuttgart.de/iv-kib/
> >------------------------------------------------------------------------
> >

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
--------------------------------------------------------------------
On 17 Jun 97 at 11:17, Scott wrote:

> Is there a good way to send a popup to an admin terminal if a user
> gets locked out, or if there has been repeated login failed
> attempts??? Any advice would be helpful. We are using NT 3.51
> server and workstations.

Use Elwiz.


Greetings
Frank Heyne

Get your free version 0.99 of Elwiz, the Eventlog Wizard:
http://rcswww.urz.tu-dresden.de/~fh/nt/eventlog/#Elwiz
A couple of things about locking a floppy drive:

1) It is possible (by setting an ACL on a device key) to lock the floppy
drive (or any drive for that matter) to read-only permissions, and no
execute permissions. KB article Q150101.
2) From this, I would assume that any file copied from the floppy onto a
user's directory would either inherit the rights of the destination
directory or retain the non-execute rights given to the floppy drive
(depending on whether a move or copy was performed).
3) To prevent users from executing any old script they make up I assume
they would not have execute rights to their own directory.

Given the above points it would be a quite simple matter to create
either a device driver or service which locked down the floppy drive to
read-only and therefore gives you the level of security you require,
with ACL level restrictions. Perhaps this could be achieved through the
service reading the ACL from a specific registry key and placing that on
the device mentioned in the KB article?

John Wiltshire

> -----Original Message-----
> From: Steve Toomey [SMTP:toomeys@dircon.co.uk]
> Sent: Wednesday, June 18, 1997 5:13 PM
> To: Paul Ward
> Cc: 'NTSecurity Mailing List'; 'Martin Bernreuther'
> Subject: Re: [NTSEC] Locking Floppy drive
> 
> Actually I'd like to find a utility that allows access based on the
> users rights within the domain. Has anyione come across something that
> will do this?
> 
> Thanks
> Steve
> 
> 
> Paul Ward wrote:
> > 
> > So what you'd like to do is allow the user to rename their
> executables
> > to some other extension and then copy them from the floppy and then
> > rename them back? ;-)
> > 
> > Don't think that would be too great of an idea.
> > 
> > Paul W. Ward
> > Software Engineer
> > NexTrend, Inc.
> > pward@nextrend.com
> > 
> > >----------
> > >From: Martin
> Bernreuther[SMTP:Martin.Bernreuther@po.uni-stuttgart.de]
> > >Sent: Tuesday, June 17, 1997 3:42 AM
> > >To: NTSecurity Mailing List
> > >Subject: [NTSEC] Locking Floppy drive
> > >
> > >Hello,
> > >
> > >I like to lock the floppy drives to prevent users to load programms
> > >(viruses)... I know there's a small utility in the RESKIT to do
> this.
> > >But this utility locks the drive completely. What I would prefer is
> > >to allow users to load data files but no executables! Is there a
> > >way to do this? How can this be achived? Is there a commercial
> utility
> > >or a Readme how to programm it (preferable with C++)?
> > >
> > >Thanks
> > > Martin
> > >
> >
> >---------------------------------------------------------------------
> ---
> > >Dipl.-Ing. Martin Bernreuther University of
> Stuttgart
> > >Pfaffenwaldring 7
> Informationsverarbeitung im
> > >70569 Stuttgart konstruktiven
> Ingenieurbau
> > >Germany
> > > E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
> > > http://www.uni-stuttgart.de/iv-kib/
> >
> >---------------------------------------------------------------------
> ---
> > >
> 
> -- 
> --------------------------------------------------------------------
> Steve Toomey | EMail : toomeys@dircon.co.uk 
> London, UK | Home Page :
> Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
> --------------------------------------------------------------------
> Where do u haven't the "drag-n'-drop" feature ?

 It manifested itself everywhere - every single program in every single
directory and drive.

> Do remember u can prevent user to put some stuff on the desktop, but I
> think it isn't these problem, right ?

 It isn't - even admin could not drag and drop his own files to his own
directories.. I even tried to take ownership. Besides the bug was fixed
at every reboot - for a while. It would come back in a matter of minutes
or hours.

-- 
Juha Jäykkä, juolja@utu.fi
At 08:42 AM 6/17/97 +0000, Martin Bernreuther allegedly wrote:

>Hello,
>
>I like to lock the floppy drives to prevent users to load programms
>(viruses)... I know there's a small utility in the RESKIT to do this.
>But this utility locks the drive completely. What I would prefer is
>to allow users to load data files but no executables! Is there a
>way to do this? How can this be achived? Is there a commercial utility
>or a Readme how to programm it (preferable with C++)?
>
>Thanks
> Martin
>
>------------------------------------------------------------------------
>Dipl.-Ing. Martin Bernreuther University of Stuttgart
>Pfaffenwaldring 7 Informationsverarbeitung im
>70569 Stuttgart konstruktiven Ingenieurbau
>Germany
> E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
> http://www.uni-stuttgart.de/iv-kib/
>------------------------------------------------------------------------

It appears to me that the original problem to be solved was preventing 
virii on NT systems and that locking the floppy is one way of attempting 
to solve that problem. (BTW, never underestimate the ability of users to
bypass workarounds). 

Why not just use a NT anti-virus scanner? I know it takes the latest 
s/w products a while to get to Germany (having worked in Muenchen & 
Leinfelden), but an NT Anti-Virus Scanner should be available by now. 
This seems to be the most robust approach as well as the easiest to 
implement on a long-term basis. (Even better, the solution will be
supported). 8^)

MfG,


Frank

The opinions of the author of this mail may not necessarily be 
representative of the opinions of Fortifed Networks, Inc.

Fortified Networks, Inc. - http://www.fortified.com/
Expert (vendor-neutral) Computer and Network Security Consulting
Phone: (317) 573-0800 Fax: (317) 573-0817
Hi,

This is a request for some advice, not a report of a concern.

I have written a password changing utility for NT in VB(5) which works
successfully apart from one thing. If you change your password with it,
and then do a Ctrl-Alt-Delete/Lock Workstation and then a
Ctrl-Alt-Delete, the system requires your old password. However, once
you have logged out and try to log in again, your new password works
fine. This means that the passwords must be cached somewhere
(presumably encrypted) - probably in the registry. 

Does anyone know how I can flush this cache so that the new password is
effective immediately?

Thanks in anticipation.


Richard Warner
IT Security Administrator
Motorola
We have been getting what seems like random Workstations that will not
allow regular users to logon to their workstations. Those workstation will
allow only an Admin equivalent user to login. When we view the logs there
is always an entry for NT Authority/anonymous at the time of the first
user not being able to login. I was wandering if the problem is related.
I have read what is available through Microsoft KB but it still does not
explain how one is able to logon through this NULL session. The only way
we can figure out how to solve the problem is to reinstall NT. 
Is their a system file or something in the registry that can be changed to
allow reg users to logon to the workstation? 


Thanks
I have tried this, but also noted that users in the server operator and
backup groups are already supposed to have login locally rights. 
When I try to login as the backup user the machine accepts the password,
plays the intro music, but the screen goes blank (background color with
only a mobile mouse cursor) for about 30 seconds, then the login screen-splash
returns.  Is my system broken?

Joel W. Barrett wrote:
To give him or her the right to login to the "console"
(I suppose you mean the
server), go into User Manager for Domains, then to select that person's
account. Go to Policies from the menu then User Rights. Select "Logon
Locally"
and add that user or a group the user belongs to. This will allow the
user to
logon at the server.
--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody
(12/17/96)
Do Something Digital!
-----Original Message-----
From:   Louis Leff [SMTP:leff@med.edu]
Sent:   Monday, June 16, 1997 3:29 PM
To:     ntsecurity@iss.net ntsecurity@iss.net
Subject:        [NTSEC] Re: ntsecurity-digest
V2 #533
Many thanks to those who helped me get my network backup system
running--the key was to start the scheduler service under the user
ID of
my backup operator, then give read permissions to the backup operator
throughout my WIN95 network.
Unfortunately, the only way I can get the scheduler to start is by
giving the new backup operator administrative group rights.  Just
"backup" or "server operator" rights are not enough--the scheduler
dies
with message "access denied."
My NT4/SP3 server will not allow any of my "backup" or "server
operators" users to log into the console unless they have administrative
rights.
I guess this has something to do with "profiles", and I am sorry if
this
is a beginner's question, but what do I do to allow a less privlidged
user to log into the console, or even just start the scheduler service
automatically.

-- 
Louis Leff
leff@med.edu
(412) 621-6166

Guys,

Has anyone yet figured out how to FORCE only 128-bit authentication to a PPTP server? I know that 128-bit service pack 2 or 3 will ALLOW 128-bit as long as the client is using 128-bit as well, but even so the server will still ALLOW and AUTHENTICATE a 40-bit user!!

Doesn't anyone else WANT to be able to enforce this?!??!

- Neil
Certainly yes; if you have samba on the linux, the symptom is the same.
You can find a solution on the page lake.canberra.edu.au address on the
samba pages (search for the SP3). It works with the WfW3.11 clients.

The reason is Microsoft's newest, regular undocumented change in the
SMB protocol.

Janos Zoldi-Kovacs

>>> "Pedro Ribeiro" 05/31/97 12:19pm >>>
Securety vs Compatibility

Since i installed SP3 in our NT's, the wfw3.11 people can't log in the
domain
Is this happening to anyone alse ?

Tks for any help.

[]-----------------------------------------------------------------[]
 Pedro Ribeiro 
 Online: http://www.cc.isel.pt/Pessoais/PedroRibeiro 
 e-Mail: Personal: pribeiro@cc.isel.pt
 Admin: admin@isel.pt 
[]-----------------------------------------------------------------[]

Hi all...

Netscape Communicator 4.01 was released on 17th of June.

Version 4.01 deals with the security flaw addressed by a danish company.
(I will not comment on whether i am pro or con in the way this company handled 
the situation)

Netscape advises people to check-mark the security settings such as to be warned every time you are submitting a form insecurely..

More information:

http://www.cabocomm.dk/

http://home.netscape.com/flash1/misc/security_update.html



vader@inet.uni-c.dk | "We learn from history,
Chris Larsen | that we don't learn from history"
Struers A/S |
System Manager | All opinions expressed herein are solely
http://www.babel.dk/windowsnt/ | of my own, and _not_ of my employers.


Dan,

I use NetUserEnum without difficulty. Levels 0 and 10 will get you minimal information,
but you don't have to be an admin to use them. What level are you trying, and what are
your return codes?

good luck,

tim

----------
From: Dan Barrett
Sent: Tuesday, June 17, 1997 11:07 PM
To: ntsecurity@iss.net
Subject: [NTSEC] enumerating users/groups in a trusted domain

Does anyone know how to enumerate the users and groups in a trusted domain?

I know that it can be done, since I can see them in the user manager, but I
am unable to access this information from my own code. The NetxxxEnum
functions don't appear to have the appropriate rights.

thanks
dan

------------------------------------------------------------
Dan Barrett dbarrett@aventail.com
NT Server Development Lead www.aventail.com
Aventail 206.777.5609


Martin Bernreuther wrote:
>But this utility locks the drive completely. What I would prefer is
>to allow users to load data files but no executables!

Preventing access to executables would not block viruses, as macro viruses
are clearly the most common virus type and they spread with document files.

According to my experiences at F-PROT antivirus support, the most common
virus types to infect NT machines are Word macro viruses (which spread
under NT just as well as under 3.1, 95 or Mac) and floppy-based boot sector
viruses (which typically render an NT machine unbootable).

I would suggest using a good NT-based antivirus product. Make sure it
includes realtime driver, to detect infected objects automatically when
they are accessed (executed, copied, downloaded, attached etc.).

As a sidenote, there are now more than 1000 macro viruses for Word. See
http://www.DataFellows.com/news/vir-news/


-- 
 Mikko Hermanni Hyppönen - Mikko.Hypponen@DataFellows.com
 Data Fellows Ltd's F-PROT Pro Support: F-PROT-Support@DataFellows.com
 Computer virus information available via web: http://www.DataFellows.com/
Paivantaite 8, 02210 Espoo, Finland. Tel +358-9-478444, Fax +358-9-47844599
Better way to do that!!!!

Just enable Auditing.

Go to Performance Monitor (yes! Performance Monitor!) Select the Server
Object, and you´ll be surprised with the counters that will appear!! The
number and the type of the counters may vary due to the options selected.
Change Performance Monitor to Alert mode and configure an alert to send an
administrative message when you want.

Best Regards,

Romulo Moacyr Cholewa.

 ----
From: Frank Heyne 
To: ntsecurity@iss.net
Date: Quarta-feira, 18 de Junho de 1997 05:37
Subject: Re: [NTSEC] Failed Logon Attempts... how to know??

On 17 Jun 97 at 11:17, Scott wrote:

> Is there a good way to send a popup to an admin terminal if a user
> gets locked out, or if there has been repeated login failed
> attempts??? Any advice would be helpful. We are using NT 3.51
> server and workstations.

Use Elwiz.


Greetings
Frank Heyne

Get your free version 0.99 of Elwiz, the Eventlog Wizard:
http://rcswww.urz.tu-dresden.de/~fh/nt/eventlog/#Elwiz


-----BEGIN PGP SIGNED MESSAGE-----

On 16 Jun 97 at 23:17, Joel W. Barrett wrote about: RE: [NTSEC] MS
Proxy Server

> In my opinion, since MS Proxy is most likely going to be installed
> on a NT Server, I would prefer to see it inside the firewall and
> also inside the network protected from the Internet by a Cisco
> router. This is because NT has so many security problems that I
> wouldn't trust anything running NT between my network router(s) and
> the Internet. I would implement something like this depending on how
> large the installation:

With the exception that we know more about NT security holes, and how
to fix them, than Unix. Almost all CERT advisories reference to some
kind of Unix. Having only one (ignoring Citrix) flavor of NT makes the
platform more secure. But, hey, this is just my opinion anyway... so
hold back the torch. I know where you coming from, I like Cisco too,
but a router is a router. I can filter on a Bay router as well as on
a Cisco, so brand name should be imperative.


> Internet-----router (if required)-----Unix-based firewall or
> Cisco 
> Pix-----router----Proxy server (if required)----network

This is actually also my prefered layout, placing the proxy behind the
firewall.

> Having a firewall, router, and proxy server may be redundant
> depending on the firewall or router. I know that Cisco routers
> running version 11.2(5) can perform NAT if they have the proper
> memory. The problem is there aren't many Cisco routers running 11.2
> yet.

Each part has its strong points. The Cisco PIX looks fairly stable,
but I need a Unix host for logging, I need a Unix host for user
security. A lot of folks don't have or want Unix. 

Yes, PIX can proxy, but if you look at administration, logging and
ease of user security configuration (at least outbound), MS Proxy is
better.


> In either case, the hardware is going to do only what it is
> programmed to do and it will process only the packets it receives.
> If packets are filtered or translated before they get to it then the
> product (router, firewall, proxy server) can only perform
> transactions based on those packets. Do you see what I'm getting at?
> The easiest way to figure this out is to draw what you intend to do
> then implement it on the drawing. Make several drawings, each with
> separate implementations so you can see where redundancy occurs.
> These drawings will most probably answer your questions.

I completley agree with you on this one. Planning is the most 
important part. Simulate all possible scenarios (I wish someone would
write an interactive software, that supports the logic behind these
scenarios [packet flow]). That would save some time... (and keeps the
sales staff away from me :)


Anyway, what I originally wanted to say was that I see more and more
firewalls moving into the network, instead of sitting where they
belong, right on the border to the uncontrolled. The primary goal is
to keep the firewall right behind the demarc router. Only if
nessecary, move a server into the demil. If your firewall supports
conduits, make use of them and keep the server behind the wall. A
proxy server has (usually) only one IP address going out, so include
it in your firewall configuration.



Gotta run...

Frank


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM6bKT8ZP3ocmY5AlAQF++AP/U62QWxz9jC2CTsTa8/XDS3wEVp5e5rMo
bl6KrjVDkCkX9QGsgeIFkG0TkzIYrM0zWt0ukqOSy7jBVIJhvLwUS/Vyq5QA4ZmR
Kwd5EvuxuIm0mDR2aeQO+9M52znEMsCquQVfwUTKLhtiT2NTT+vGgEfvKRJSS6s4
8Ueb6RNPBT0=
=Cevx
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
This may be offtopic but I suspect that the answer will to use one
or more security addons so please bear with me.

Recent discussions on this list have reiterated that a shared resource
is shared with a network "identity" that consists only of (username,
password) pairs. There seems to be no concept of a network ID
that consists of (username, password, host), i.e. accepting a valid
username and password *only* when coming from a specified host.*

This seems to put me in a questionable situation with respect to
software licensing. I configured my servers for per-seat licensing with
the plan of buying a client license for each of my intended clients.
Now it seems that I have no way to control use of my servers by people
who have accounts in my domain but who are working on machines other
thant the intended clients.

To be a little less vague, I have two labs of MSWNT4+ WS pcs (~125
machines) and two servers. We are on a university campus where all of
the dormitory rooms are, or soon will be, connected to the univerity
computer network. It's not hard to predict that users in my domain
working from dorm rooms will soon discover that they can access
software from my lab servers. So, if I put licensed software packages,
I see two possibilities:

1) I limit access to a package to a number of machines (with uncontrolled
 identities) and face the possibility of the dorm machines consuming
 all of the allowed connections
 
2) I place no limits on the shared resource and face the probability of
 exceeding the licensing.
 
I can't be the first person to face this. Is there a well-known solution
to this problem?

* I personally consider this to be a flaw in the LM security scheme.
I'd *like* to be able to specify that a resource is accessible *or*
inaccessible to everyone *or* a named group of users from *or* not from
everywhere *or* a named group of machines. To rephrase that, I'd like

- positive and negative assertions on accessibility for

- "anyone" or one or more groups of specified users (with associated
 passwords) from

- "anywhere" or one or more groups of specified machines

Is there any way to do this with MSWNT as shipped or is there any
add-in for MSWNT 4.0+ that will give better control over who can
access my shared resources (e.g. does the much-bruited MS Proxy service
support extended control of shared resources)?

 David
-- 
David Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
Box 3241, Station B |Disclaimer: I have no authority
Nashville, TN, USA 37235 |to speak for anyone but myself.
 "Export crypto, not jobs." - Daniel Lynch
 http://www.vuse.vanderbilt.edu/~drl

 
The protocol didn't change. We just stopped accepting plaintext
passwords, unless specifically configured to do so -- as _frequently_
requested in this list and others.

Furthermore, the readme for SP3 clearly documented it. RTFR.

> ----------
> From: János Zöldi-Kovács (János Zö
> ldi-Kovács)[SMTP:ZKJ@APPL.SYSTREND.hu]
> Reply To: János Zöldi-Kovács (János Zö ldi-Kovács)
> Sent: Tuesday, June 17, 1997 9:39 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] NT4+SP3 Securety vs Compatibility -Reply
> 
> Certainly yes; if you have samba on the linux, the symptom is the
> same.
> You can find a solution on the page lake.canberra.edu.au address on
> the
> samba pages (search for the SP3). It works with the WfW3.11 clients.
> 
> The reason is Microsoft's newest, regular undocumented change in the
> SMB protocol.
> 
> Janos Zoldi-Kovacs
> 
> >>> "Pedro Ribeiro" 05/31/97 12:19pm >>>
> Securety vs Compatibility
> 
> Since i installed SP3 in our NT's, the wfw3.11 people can't log in the
> domain
> Is this happening to anyone alse ?
> 
> Tks for any help.
> 
> []-----------------------------------------------------------------[]
> Pedro Ribeiro 
> Online: http://www.cc.isel.pt/Pessoais/PedroRibeiro 
> e-Mail: Personal: pribeiro@cc.isel.pt
> Admin: admin@isel.pt 
> []-----------------------------------------------------------------[]
> 
At 09:52 AM 6/18/97 -0400, Tim Dodd wrote:
>Dan,
>
>I use NetUserEnum without difficulty. Levels 0 and 10 will get you
minimal information,
>but you don't have to be an admin to use them. What level are you trying,
and what are
>your return codes?

NetQueryDisplayInformation/ works against the host machine and the domain
it is logged on to, but returns ERROR_ACCESS_DENIED for the trusted domain.
NetUserEnum at level 0 again works for the host and domain, but returns
ERROR_LOGON_FAILURE for the trusted domain.

If I am just logged on to the local machine, I get the same results when I
try to enumerate the local domain as I do with the trusted domain. If I log
into the trusted domain under any user account, I can see everything I need
on the local machine and on both domains. 

>
>good luck,
>
>tim
>
>----------
>From: Dan Barrett
>Sent: Tuesday, June 17, 1997 11:07 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] enumerating users/groups in a trusted domain
>
>Does anyone know how to enumerate the users and groups in a trusted domain?
>
>I know that it can be done, since I can see them in the user manager, but I
>am unable to access this information from my own code. The NetxxxEnum
>functions don't appear to have the appropriate rights.
>
>thanks
>dan
>
>------------------------------------------------------------
>Dan Barrett dbarrett@aventail.com
>NT Server Development Lead www.aventail.com
>Aventail 206.777.5609
>
>
>Attachment Converted: "c:\eudora\attach\RE [NTSEC] enumerating usersg"
>
------------------------------------------------------------
Dan Barrett dbarrett@aventail.com
NT Server Development Lead www.aventail.com
Aventail 206.777.5609
The other side of the coin is that are you sure you want to expose your
lab servers to all those bored dorm students? If there is a desire
(understandable and compelling) for the students to be able to access
their files from their rooms then I would suggest using the FTP server
(IIS FTP for simplicity).

If you have restricted student directories (personal directories only
accessible to the student) then export the directory with FTP. Allow
only NTLM authentication (Basic if the students are on Netscape - but
beware of students with sniffers ( sniffers are great entertainment on
dorm LANs)). With this the student can log in using their NT domain
userid and password and be able to read and write to their directory so
they can move projects between the lab servers and their personal
machines.

If the ftp is a feasible answer then next setup is strong access lists
on the routers between the servers and the students (not to mention the
net) to protect from the other great dorm LAN entertainment - hacking
dorm servers. 

FTP would seem to provide a good mix between allowing students to access
their files on one hand, but not being able to use or pirate
applications from the lab servers from the comfort of their dorm rooms.

Chris

- All views and opinions are the property of my delusions and may or may
not bear any relation to reality.

>-----Original Message-----
>From: drl@vuse.vanderbilt.edu [SMTP:drl@vuse.vanderbilt.edu]
>Sent: Wednesday, June 18, 1997 9:24 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] controlling access to shared resources with MSWNT 4.0+
>
>This may be offtopic but I suspect that the answer will to use one
>or more security addons so please bear with me.
>
>Recent discussions on this list have reiterated that a shared resource
>is shared with a network "identity" that consists only of (username,
>password) pairs. There seems to be no concept of a network ID
>that consists of (username, password, host), i.e. accepting a valid
>username and password *only* when coming from a specified host.*
>
>This seems to put me in a questionable situation with respect to
>software licensing. I configured my servers for per-seat licensing with
>the plan of buying a client license for each of my intended clients.
>Now it seems that I have no way to control use of my servers by people
>who have accounts in my domain but who are working on machines other
>thant the intended clients.
>
>To be a little less vague, I have two labs of MSWNT4+ WS pcs (~125
>machines) and two servers. We are on a university campus where all of
>the dormitory rooms are, or soon will be, connected to the univerity
>computer network. It's not hard to predict that users in my domain
>working from dorm rooms will soon discover that they can access
>software from my lab servers. So, if I put licensed software packages,
>I see two possibilities:
>
>1) I limit access to a package to a number of machines (with uncontrolled
> identities) and face the possibility of the dorm machines consuming
> all of the allowed connections
> 
>2) I place no limits on the shared resource and face the probability of
> exceeding the licensing.
> 
>I can't be the first person to face this. Is there a well-known solution
>to this problem?
>
>* I personally consider this to be a flaw in the LM security scheme.
>I'd *like* to be able to specify that a resource is accessible *or*
>inaccessible to everyone *or* a named group of users from *or* not from
>everywhere *or* a named group of machines. To rephrase that, I'd like
>
>- positive and negative assertions on accessibility for
>
>- "anyone" or one or more groups of specified users (with associated
> passwords) from
>
>- "anywhere" or one or more groups of specified machines
>
>Is there any way to do this with MSWNT as shipped or is there any
>add-in for MSWNT 4.0+ that will give better control over who can
>access my shared resources (e.g. does the much-bruited MS Proxy service
>support extended control of shared resources)?
>
> David
>-- 
>David Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
>Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
>Box 3241, Station B |Disclaimer: I have no authority
>Nashville, TN, USA 37235 |to speak for anyone but myself.
> "Export crypto, not jobs." - Daniel Lynch
> http://www.vuse.vanderbilt.edu/~drl
>
> 
This is because NT does not allow programs to access hardware directly.
This is not a security issue. It's a compatibility issue, and doesn't
belong in this mailing list

Mike Bausenwein


> -----Original Message-----
> From: Victor Marshall-CVM012
> [SMTP:Victor_Marshall-CVM012@email.mot.com]
> Sent: Wednesday, June 18, 1997 11:52 AM
> To: 'ntsecurity@iss.net'
> Subject: 
> 
> Hello all, 
> I am a summer intern with the Motorola Corp. and my job has
> nothing to do with administering NT networks. However, I have been
> trying to run DOS based programs in NT with no success. 
> I am at the point where I get a polite pop-up window stating
> that NTVDM will not allow the program to run because it is trying to
> execute an illegal instruction. I tried to run a few different
> programs
> just to be sure that it wasn't the program's fault...still, no
> success.
> 
> I am probably wrong, but I think that these prams are trying to
> access the hard drive directly and NTVDM doesn't want to allow it.
> I understand that going around NTVDM is a serious security
> issue, but can it be done? 
> 
> 
> %%%%%%%%%%%%%%%%%%%%%%%%
> These comments are purely my own and in no 
> way represent the beliefs or values of the 
> Motorola Corporation. 
> Victor Marshall vgm@cldc.howard.edu
> %%%%%%%%%%%%%%%%%%%%%%%%
I use Microsoft Word Viewer to prevent Word macro viruses
from infecting my system. However, I cannot save a file
using the viewer. I can, however, select the entire 
document, copy it, and paste it into a new Microsoft Word
document. Did I loose the viruses with this little
maneuver?

-leonard
I hope someone can offer a potential solution to a rather vexing problem (NTS 4.0 SP2). How can I synchronize a PDC w/ a BDC based on the following scenario?

We have a firewall. The PDC sits inside on one subnet.

The BDC/Web/ftp server resides outside the firewall, exposed to the internet (I will ultimately make it _just_ Web & ftp), & on a different subnet.

DNS resides on a separate Unix box.

I can browse PDC-BDC because I set up an Lmhosts file on each machine. But SAMs are not being updated because our firewall admin does not wish to open _any_ ports (137-139) on the firewall. He is very concerned about Netbios scanners & TMHs (Truly Malicious Hackers). He has configured the firewall to only allow one-way communication to take place. IE, from inside the internet domain to outside (PDC->BDC). Even if I demote the BDC into a simple Web/ftp server, it will, as I understand it, still need to check ACLs against the PDC. Which means that there must be two way communication.

What about ssh/f-secure or some other encryption scheme? Does the firewall admin need to open those ports regardless? Would such be related to what PPTP does? 

I have scoured the Microsoft site, the resource guides, et al, but all to no avail. Both machines saw each other during testing when they were on the same LAN, so their SID's are locked together; they were also on the same subnet .

I am grateful for any help.

-Barry Koblenz



__________________________________________________________________
Barry Koblenz (bkoblenz@adm.schoolofvisualarts.edu)
Systems Administrator, MFA PHOTO, School of Visual Arts 
Tel (212)592-2364 Fax (212)592-2368
Check out our Website at http://mfaphoto.schoolofvisualarts.edu
__________________________________________________________________


What security issues surround the NT multicast group 224.0.1.24? I see it
leaving an NT network onto the MBONE - even when nothing is participating
in a group. For now, I'm stopping it - but what is it for? What security
holes does it leave?

Frostie
--
Frostie Sprout Frostie@wyoming.com Voice: 307.856.4220
System Engineer, wyoming.com LLC FAX: 307.856.1499
 Wyoming's Leading Internet Service Provider
Opinions are mine and do not necessarily reflect those of wyoming.com
A. Einstein--"God might be subtle, but He is never malicious."
 "Albert! Stop telling God what to do!"--E. Fermi

At 09:03 PM 6/16/97 -0500, David Tyree wrote:
>My definition of what a "firewall" should do includes:
>
>1. Prevent unauthorized access to your private network.
>2. Enable secure access for authorized users to your private
>network.
>3. Detect and report unauthorized attempts to access your private
>network or servers on the public network.

Although you sort of included this in #3, I'd add "Full logging of all
actions, both permitted and denied" which the MS Proxy also doesn't do, at
least not for inbound services that are blocked or not enabled.

>I usually setup the proxy with 2 NIC's, one on the private network, and
>one on the public network. You can use any IP addressing scheme for

I'd agree that if one is planning to use the proxy as a "poor man's
firewall" then 2 NICs is an absolute must. Hardening the NT server itself
is also a must.

>I would be interested in knowing what advantages a Firewall/NAT
>configuration has over a proxy for outbound access. Anybody?

Once again, it all depends on the definition of firewall :-). A "real"
firewall, while allowing outbound access, will also log any inbound
attempts, protect against inbound attacks and (ideally) allow you more
control over which subfunctions a user has access to. By that I mean one
might want to allow FTP "get" commands, but not "put" commands for example.

The main problem one runs into these days with firewalls is that the term
covers everything from black boxes with flashing lights and filters to high
end $30K managed proxy solutions and everything in between. As usual in
the technology industry, there's more hype than reality so it's hard to get
a good picture of what's really going on. As usual, a large dose of caveat
emptor (let the buyer beware) applies in this market...

My $0.02,
Ian

PS. Any bets on which firewall vendor Microsoft will buy to get a real
"Microsoft Firewall"? Maybe I should start a pool.


-----
Ian Poynter ian@jerboa.com
Jerboa, Inc. +1-617-492-8084
PO Box 382648, Cambridge, MA 02238 http://www.jerboa.com
Providing unbiased Internet consulting for businesses.
PGP Fingerprint: BA 0C 82 C5 F2 03 3D 95 7C CE FD D3 57 4E 15 73

Greetings, does anyone know of patches or quick fixes for NTS/W 4.0 ? 
Thanks.
-- 
Casey Roberts
casey@amaonline.com
 ...---===---...
"There is no pain, you are receeding..."
I'm attempting to get a handle on the upcoming Kerberos authentication
process with NT 5.0. My current understanding is lame, I didn't find any
information on the MS-Kerberos process at microsoft.com, and the first-pass
process below may be _way_ off. To see where I'm wrong, I'm bouncing what I
_think_ happens in NT 5.0/kerberos off the list:

1. User enters username/password/domain information into a kerberos-enabled
WinLogon process.
2. WinLogon 'hashes' the password, and sends user credentials to the
kerberos Authentication Service (AS) on an NT server.
2. On the server the AS checks for a current session ticket in the Key
Distribution Center (KDC)/SAM database. If there is no session ticket in
the database, AS then verifies the user credentials against the database.
If correct;
 a. The AS Ticket Granting Server (TGS) process creates a Ticket Granting
Ticket (TGT), which contains user SID information.
 b. TGS stores the TGT in a ticket cache.
 c. TGS DES encrypts the TGT with the (database obtained) client private
key. (Shared secret key process executed here, not PGP-type public/private
key process).
 d. TGS creates a session key by time-stamping and DES encrypting the TGT
with the server private key and client ID.
 e. Server sends both encrypted ticket and session key to client.
6. Client time-stamps and again encrypts the server-encrypted session key,
and returns it as a ticket to the server.
7. The KDC service decrypts the ticket (first with the shared secret key,
then with the server secret key), and reads the session key.
8. If the session key matches the session key sent to the client, the client
is authenticated. The TGT by default is good for eight hours.
9. The client presents the ticket (TGT) to servers it attempts to access. A
server recognizes the TGT as from an authenticated client, and the server
returns an encrypted session ticket (encrypted with the distributed secret
key) which the client uses to access the desired service.

User authority and permissions then continued to be handled as they are now,
via Local/Global SIDs and ACLs.

Bill Stout
____________________________________________________

Old(?) rhymes from the net (will try to rhyme kerberos process next time):

If a packet hits a pocket on a socket on a port, 
And the bus is interrupted as a very last resort 
And the address of the memory makes your floppy disk abort 
Then the socket packet pocket has an error to report. 
If your cursor finds a menu item followed by a dash, 
And the double-clicking icon puts your window in the trash, 
And your data is corrupted 'cause the index doesn't hash, 
Then your situation's hopeless, and your system's gonna crash!

IF the label on the cable on the table at your house, 
Says the network is connected to the button on your mouse, 
But your packets want to tunnel on another protocol, 
That's repeatedly rejected by the printer down the hall, 
And your screen is all distorted by the side effects of gauss, 
So your icons in the window are as wavy as a souse, 
Then you may as well reboot and go out with a bang, 
Cause as sure as I'm a poet, the sucker's gonna hang! 
When the copy of the floppy's getting sloppy on the disk, 
And the microcode instructions cause unnecessary RISC, 
Then you have to flash your memory and you'll want to ram your ROM. 
Quickly turn off the computer and be sure to tell your mom!


Paul J. Ste. Marie wrote:
> 
> Joel W. Barrett wrote:
> >
> > ...
> > In essence, proxy servers are not designed to do NAT (Network
> address
> > translation). NAT is more a router or firewall process. NAT on a
> large network
> > is fairly CPU intensive because each and every packet the firewall
> or router
> > receives must be translated to a different IP address or tossed out
> or
> > rerouted.
> 
> Hmm? That's precisely what the MS Proxy server does--it filters
> packets
> and readdresses them so that they all appear to be coming from the
> proxy
> server.
> 
You could make a very definate distinction between NAT done by a 
router and what is done by a proxy.

NAT, as done by a router, will go through every packet and rewrite
the source and destination addresses of every packet going through 
it. Some devices will support a one to many translation, but other
only support one to one, with a table. 

A proxy doesn't rewrite the addresses in a packet in the same fashion.
A client will make a request for a connection to a proxy server. The
proxy server will then make this connection for the client, returning
the data. If you were to look through documentation for Microsoft's 
proxy, somewhere it would show an example of the client send a url of
http://proxy http://web.page.that.the.client.wants
the proxy server will then go get the page and bring it back.
No packets are actually sent directly from the client to the outside
server. All packet to the outside server are sent from the proxy 
server, all packets to the client are sent from the proxy server.
There are two connections taking place here.

This is not what a router doing NAT does. IT routes the packet, 
rewriting the addresses in the header.

> >
> > A proxy server merely allows or disallows external IP addresses to
> access your
> > network and allows or disallows internal IP addresses to access
> external
> > resources.
> 
> And, in the case of the MS product, logs access and provides
> permissions
> on a per-user basis.
> 
Various different proxies are built with various different abilities.
The Raptor firewall is built upon the technology of proxying all 
connection between networks. This is what the term Application 
Gateway refers to. Many other firewalls are designed the same way.
And they have much more functionality than stated above.

A proxy could easily be written to examine the contents of the
data in packets that it is sending. Many proxies used in firewalling
do this. As an example, an FTP proxy could all "gets" and prohibit
"puts", a SMTP proxy could prohibit EXPN, VRFY or WIZ commands from
reaching a mail server. 

Some firewall are designed to do packet fitering, and some routers
have this capability. Packet filtering looks at the source and
destination IP addresses and ports, and then decides whether or not 
to pass them through it. This is not what a proxy does. A proxy
will recieve the packet, and then decide whether or not to make the
requested connection.
> > -----Original Message-----
> > From: Darr Emery, Connie [SMTP:cedar@fgcu.edu]
> > Sent: Monday, June 16, 1997 12:34 PM
> > To: 'Joel W. Barrett'
> > Subject: RE: [NTSEC] MS Proxy Server
> >
> > Can you use MS Proxy server to do address translation from a set of
> 4
> > class "C" addresss (externally) to internal class "B" addresses?
> 
> Well, you'd normally just have a single external IP address, but
> otherwise the answer is yes.
All packets sent to the Internet would come directly from the proxy
server. The destination server would never see the address of the 
original client.
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
On Monday, June 16, 1997 1:23 AM, Ken Anthony [SMTP:ntsec@smtsecure.com] wrote:
> 
> Has anyone ever heard anything bad about this proxy server?
> ( like ways to break into a system using it? )
> WinProxy http://www.lanprojekt.cz/winproxy/
> 
> I've been using it at home for about 6 months, and it works great, but with
> the 
> recent 'Netscape' discoveries, my company feels a more well known 
> (ie: more expensive and harder to configure) proxy / firewall would be a
> safer choice.
> 
> We would use Microsoft's proxy if it had a POP/SMTP gateway.
> As far as I know, you have to install exchange server to get mail to work,
> and really don't need exchange server.
> 
> Thanks..
> Ken Anthony

I have a client using Post.Office from Software.com and we set it up successfully
with Microsoft Proxy. It's been up for 7 months with no problems.

Wouldn't it just be easier to run scanprot.dot and then turn off the
macros? As long as you have normal.dot set to read only, none of those
nasties can autolaunch.

Al Castanoli | afcasta@texas.net | afn22800@afn.org
 | ah446@rgfn.epcc.edu | 
 "Computers save time like kudzu prevents soil erosion."

On Wed, 18 Jun 1997, Leonard Timmons wrote:

> I use Microsoft Word Viewer to prevent Word macro viruses
> from infecting my system. However, I cannot save a file
> using the viewer. I can, however, select the entire 
> document, copy it, and paste it into a new Microsoft Word
> document. Did I loose the viruses with this little
> maneuver?
> 
> -leonard
> 

Frank Knobbe wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On 16 Jun 97 at 23:17, Joel W. Barrett wrote about: RE: [NTSEC] MS
> Proxy Server
> 
> > In my opinion, since MS Proxy is most likely going to be installed
> > on a NT Server, I would prefer to see it inside the firewall and
> > also inside the network protected from the Internet by a Cisco
> > router. This is because NT has so many security problems that I
> > wouldn't trust anything running NT between my network router(s) and
> > the Internet. I would implement something like this depending on how
> > large the installation:
> 
> With the exception that we know more about NT security holes, and how
> to fix them, than Unix. Almost all CERT advisories reference to some
> kind of Unix. Having only one (ignoring Citrix) flavor of NT makes the
> platform more secure. But, hey, this is just my opinion anyway... so
> hold back the torch. I know where you coming from, I like Cisco too,
> but a router is a router. I can filter on a Bay router as well as on
> a Cisco, so brand name should be imperative.
>
Do you really think so ? That we know more about NT security holes ? I
for on do not. Every time a security hole is found in NT we have to
turn to M$ to fix it. We really have no clue what exactly is going on
in the system. Unless you have sold your soul to M$ for the NT source
code you really have no chance of truely understanding the security of
NT. You also need to look at the history of computer security. In the
begining computer security was to keep your systems in a physcally
secured area. As time when by time sharing systems were designed. UNIX
for example was not origionally intended to be a multi-user OS. And
when you take the history of UNIX and security, you are looking at how
computer security has thus far evolved. Yes there are more known
vulnerabilities in UNIX. But that is really a jadded view. There is
only one true UNIX. That is made by AT&T. SunOS, HPUX, AIX, Linux,
BSD, etc are all different flavors of UNIX and are by no means the same
OS. Just as VMS and NT are different even though NT is based largly on
VMS. When you say we as the security community know how to fix NT
security holes, you must truely be joking. With a few exceptional holes
such as the RedButton bug wich we could solve with permission/ownership
changes, we really have no control over patching NT security holes. 
Last week I had obtained a new vulnerability in UNIX's print spooler
program, lpr. I had it patched in less than 5 min. UNIX has evolved, 
been studied, and been attacked for over 20 years now. Of course there
will be more vulnerabilities. Now you look at NT, and it, over the
course of a year it has had more newly discovered security
vulnerabilities than most flavors of UNIX. You must also take into
consideration that this is being done with no available source code. We
dont know what it guts really look like. Then there is also the
extreamly large factor that it has not been scrutinized by hackers
nearly as much as UNIX. Right now the vast majority of the hacker
community has no clue how to use NT much more attack it. But this trend
has begun to change in the last year. They are starting to gain intrest
in the new game known as Windows NT. So as for more secure ? I think
you have been reading M$ sales pitches for far too long.

0x486578

Hello,

i am coming from the "Unix World" and I don't have really deep
knowledge about NT. Don't flame if my question sounds silly ....


We recently changed all our PC clients (around 50) from
DOS, Win3.11 and Win95 to NT4 SP3 to make Administration easier.
(NT Server and SMS will be installed, too). Everything works
really nice now. Interaction with our Unix servers is terrfic.
Support calls are mostly eliminated, no more crashed Windows ...


There is only one problem. Unix systems usually come with restricted
access on system files so the Joe User can not delete, overwrite
or change them accidentially. NT comes with completely open permissions.

I would like to prevent our Users from accidentially damaging their
workstations but don't have the knowledge which permissions to
give on the various dlls and exes in the system directories.

Did anyone compile a list of how to set access permissions on the system
files that accidential destruction of the workstation is difficult ?

Any pointers are greatly appreciated.

Thanks

Peter

(Even if I love my Unix servers, I love my NT clients, too ....) Peter
Eckhardt Tel. +49 6071 925130
RGW Express Airfreight GmbH Fax +49 6071 925140
Gebaeude 638 Mail dbadm@rgw-express.de
Cargo City Sued
D-60549 Frankfurt Main Flughafen
>
>2. Format all disks (other than RISC boot partitions) with NTFS
>
Just to expand on this:

1) You mean the system partition, not the boot partition.
2) On RISC systems, you would run Disk Administrator and secure the
system partition, so only Administrator has access to it. This makes the
entire drive disappear.

PJDM
----
Peter Mayne
Digital Equipment Corporation (Australia),
Canberra, ACT
These are my opinions, not DIGITAL's.
This was typed by an infinite number of monkeys.
>
> FTP would seem to provide a good mix between allowing students to access
> their files on one hand, but not being able to use or pirate
> applications from the lab servers from the comfort of their dorm rooms.

 Wait a second.. Am I missing something here (and the original message)
or why normal SMB sharing is not an option? Give the students access
only to their home directories - then they will not use any software
from the server. If students need some of the programs (with no fear of
exceeding licenses) give them access accordingly. Then give those people
who may use the licensed programs access to them as you see fit. If
there is a problem with number of used licenses, just limit the number
of users per share to equal the number of licenses the program under the
share has.

-- 
 ---------------------------------------
 | Juha Jäykkä, juolja@utu.fi |
 | Turun yliopisto, ATK-keskus |
 | University of Turku, Computer Centre |
 | työ/office: +358 2 333 5961 |
 ---------------------------------------
There is a registry setting that allows System Operators to use the AT
command.
The value is

HKLM\SYSTEM\CCS\Control\Lsa

Option Submit Control
Type REG_DWORD
value 1 to enable; 0 to disable (default)

Hope this helps

John Taylor
john@carrhouse.force9.net

----------
> From: Louis Leff 
> To: ntsecurity@iss.net
> Subject: [NTSEC] Re: ntsecurity-digest V2 #533
> Date: 16 June 1997 20:28
> 
> Many thanks to those who helped me get my network backup system
> running--the key was to start the scheduler service under the user ID of
> my backup operator, then give read permissions to the backup operator
> throughout my WIN95 network.
> 
> Unfortunately, the only way I can get the scheduler to start is by
> giving the new backup operator administrative group rights. Just
> "backup" or "server operator" rights are not enough--the scheduler dies
> with message "access denied."
> 
> My NT4/SP3 server will not allow any of my "backup" or "server
> operators" users to log into the console unless they have administrative
> rights.
> 
> I guess this has something to do with "profiles", and I am sorry if this
> is a beginner's question, but what do I do to allow a less privlidged
> user to log into the console, or even just start the scheduler service
> automatically.
Hello

If you are a member of 2 or 3 mailer lists like me
you have got to skim read

please put subject headers in it makes life easier

Thanks

Alex O.

"Frank Knobbe" writes:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On 16 Jun 97 at 23:17, Joel W. Barrett wrote about: RE: [NTSEC] MS
> Proxy Server
> 
> > In my opinion, since MS Proxy is most likely going to be installed
> > on a NT Server, I would prefer to see it inside the firewall and
> > also inside the network protected from the Internet by a Cisco
> > router. This is because NT has so many security problems that I
> > wouldn't trust anything running NT between my network router(s)
> > and the Internet. I would implement something like this depending
> > on how large the installation:
> 
> With the exception that we know more about NT security holes, and
> how to fix them, than Unix.

Well... I suppose we could use some humour on this list for once. Or
maybe you're being serious.

> Almost all CERT advisories reference to some kind of Unix.

Mainly because CERT don't tend to issue advisories 'til they've been
fixed in a verifiable manner. I'm not even sure that their terms of
reference extend to NT.

> Having only one (ignoring Citrix) flavor of NT makes the platform
> more secure.

The number of flavours of an OS have the square root of fsck all to do
with said OS's security -- each OS is a separate entity. Ferinstance I
would never consider running IRIX on my firewall machine -- there are
too many documented holes, and those holes that I know about seem to
speak of a deeper malaise with the system as a whole -- so many
exploits for IRIX tend to use the same old techniques that have been
known about since forever. However, I would consider running something
like Solaris or Linux on the system -- Solaris because it has a good
reputation, Linux because it is the OS with which I am most familiar.
I can build a stripped down Linux installation in which I know what
every file and program does and what permissions it should have so
that when it gets hacked (however unlikely it may be you have to plan
for it happening) I should be able to spot what has happened, and
possibly catch it as it does happen (especially if I've gone the extra
mile to turn on logging of terminal sessions and the like captured to
another, inside the firewall, box).

NT on the other hand is /not/ well understood. Leaving the aside, for
the moment, the issue of source code availability, we have a problem
in that there is a vast amount of stuff in the WINNT directory and it
would be trivial to hide some extra stuff in there -- taking stuff out
of WINNT is not an easy option either, because you can never be
entirely certain what foo.dll does. Another point that worries me
greatly is Microsoft's attitude to security issues -- it seems to me
that, whenever a bug is found in one of the applications, or, more
seriously, the OS itself, the attitude seems to be to characterise the
people who found, and reported, the bug as no good hackers. This is
/not/ the way to win friends and influence people, nor is it the way
to get Internet security people to look upon your products with
anything other than an extremely jaundiced eye. The recent dropped
ball with the bugfix that wasn't didn't help in this respect.

Lack of source availability is definately my biggest bugbear
though. In a UNIX environment even if you don't have the source to the
particular applications that you have to deal with there are free
alternatives available for most of the standard utilities which are of
an astonishingly high standard and which come with source code so if a
security hole is discovered it is possible for you to patch and fix
that hole before your vendor gets its finger out. This is /very/ good
indeed. Current work on the bugtraq list includes work on making a
`wrapper' for any SUID program (The biggest risk on a UNIX based OS)
that will trap `dangerous' input before it has a chance to do
damage. On another front, people have been working on modifying the
Linux kernel so that, even if someone manages to induce a buffer run,
the results cannot be executed. This is important work, and I can't
help but think that it will be a cold night in hell before anyone
(except possibly for Microsoft) manages to do something similar for
NT.

> But, hey, this is just my opinion anyway... so hold back the
> torch.

Too late. 

> I know where you coming from, I like Cisco too, but a router
> is a router. I can filter on a Bay router as well as on a Cisco, so
> brand name should be imperative.

It's been said before and will be said again, but packet filtering is
only half a step towards an effective firewall. Let your router do the
basic filtering, your firewall should be using application
gateways. Sure it's a little more awkward but it's a /great/ deal more
secure.

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
Casey Roberts writes:

> Greetings, does anyone know of patches or quick fixes for NTS/W 4.0 ? 
> Thanks.

Insert the RedHat Boot floppy and CD-ROM. Reboot your system and
follow the instructions.

Or did you want to still have NT on your system when you'd finished?

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
Hi all,

>To those of you who are familiar with the book called "Windows NT
>Security Handbook, Everything You Need to Know to Protect Your
>Network.", by Tom Sheldon I have a question about chapter 18, section
>"Windows NT Home-grown Firewalls" page 489, the author discusses the
RAS method of connection your LAN to the internet. Basically routing
will be turned off on the dual-homed system and inbound connections can
>be controlled by using TCP/IP advanced security (i.e permitting access
>at the port level).
>
>This is the security method we'll like to use as we dial-up to our ISP.
>Unfortunately, this security feature only applies to physical adapters
>(our system obviously only has one network adapter) and you can't
>select the Remote Access WAN Wrapper adapter which relates to the
dial-up. Whereas the book seems to suggest that you can stop inbound
connection from the Internet over a dial-up connection. Therefore with a
>dial-up connection to the internet how can we provide this level of
>security??

To following on from this, as routing will be turned off we'll use the
>MS proxy server for internal access to the internet. Reading the proxy
documents it mentions that you can restrict inbound connection. Below is
>a newsgroups article, confirming this:

Subject: Re: Does proxy disable my web server?
From: "Mike Derrberry" 
Date: 1997/05/15
Message-Id: <01bc6141$0da99f80$6c36369d@stumpjumper2>
Newsgroups: microsoft.public.proxy
[More Headers]

MS Proxy 1.0, by default, turns off access to inbound connections
(Internet
connections). To enable your web server (must be on the same box as
proxy),
from within Web Proxy service properties\Services Tab. Turn on "Enable
Internet Publishing". This will open port 80 so that Internet clients
can
hit your website.
-- 
Mike Derrberry
Microsoft Corporation
mikeder@microsoft.com

Brent Pranger wrote in article
<#dMm8LIY8GA.141@uppssnewspub04.moswest.msn.net>...
> Does proxy server disable my webserver to the outside world? I have it
> running on our office's server. The proxy works, the intranet works, but
> when I try to access the WWW server on the proxy machine from the
internet,
> I get "The Server Returned an Invalid or Unrecognized Response"
> 
> Any ideas?
> 
> Thanks,
> Brent

Does anybody know exactly what this mean? Is it that the restrict of
inbound connections is at the service/application level (not the TCP/IP
level)? Is it that no connection is established due to the fact that no
program is listening on the various ports??

Sorry for the long post but if anybody can help I'd appreciated it very
much. The idea situation is if we could restrict access at the protocol
level, so that we can deny all and then turn on access to specific
port/applications.


Thanks for any replies or emails

Michael Dunphy


>


Not sure where to find a list of what your looking for, but you may
learn something from these sites:

http://www.emf.net/~ddonahue/NThacks/ntexploits.htm
http://www.ilinks.net/~486578/hack_NT/hacknt.html
http://www.ers.ibm.com/security-links/seclinks-lst.html
http://www.ntsecurity.com/
http://www.ntsecurity.net/ - which as a great list of URL's on bottom left
side frame

Kelly

On Thu, 19 Jun 1997, Peter Eckhardt wrote:

> 
> Hello,
> 
> i am coming from the "Unix World" and I don't have really deep
> knowledge about NT. Don't flame if my question sounds silly ....
> 
> 
> We recently changed all our PC clients (around 50) from
> DOS, Win3.11 and Win95 to NT4 SP3 to make Administration easier.
> (NT Server and SMS will be installed, too). Everything works
> really nice now. Interaction with our Unix servers is terrfic.
> Support calls are mostly eliminated, no more crashed Windows ...
> 
> 
> There is only one problem. Unix systems usually come with restricted
> access on system files so the Joe User can not delete, overwrite
> or change them accidentially. NT comes with completely open permissions.
> 
> I would like to prevent our Users from accidentially damaging their
> workstations but don't have the knowledge which permissions to
> give on the various dlls and exes in the system directories.
> 
> Did anyone compile a list of how to set access permissions on the system
> files that accidential destruction of the workstation is difficult ?
> 
> Any pointers are greatly appreciated.
> 
> Thanks
> 
> Peter
> 
> (Even if I love my Unix servers, I love my NT clients, too ....) Peter
> Eckhardt Tel. +49 6071 925130
> RGW Express Airfreight GmbH Fax +49 6071 925140
> Gebaeude 638 Mail dbadm@rgw-express.de
> Cargo City Sued
> D-60549 Frankfurt Main Flughafen
> 

At 07:51 PM 6/18/97 -0500, you wrote:
>Greetings, does anyone know of patches or quick fixes for NTS/W 4.0 ? 

Hey, check out http://www.secant.net for WinNT instructions.


>Casey Roberts

Ken Harris
Am I missing something? I thought that the original message asked if there is
a way to keep people from accessing NT servers UNLESS they were at certain 
designated systems. I know that UNIX can do this. Is there a way that NT can
do this? I also want to keep the students in their DORM rooms from getting
access
to servers that they have access to from a designated lab.

Thanks....


Gina


At 10:35 AM 6/19/97 +0300, Juha Jäykkä wrote:
>> FTP would seem to provide a good mix between allowing students to access
>> their files on one hand, but not being able to use or pirate
>> applications from the lab servers from the comfort of their dorm rooms.
>
> Wait a second.. Am I missing something here (and the original message)
>or why normal SMB sharing is not an option? Give the students access
>only to their home directories - then they will not use any software
>from the server. If students need some of the programs (with no fear of
>exceeding licenses) give them access accordingly. Then give those people
>who may use the licensed programs access to them as you see fit. If
>there is a problem with number of used licenses, just limit the number
>of users per share to equal the number of licenses the program under the
>share has.
>
>-- 
> ---------------------------------------
> | Juha Jäykkä, juolja@utu.fi |
> | Turun yliopisto, ATK-keskus |
> | University of Turku, Computer Centre |
> | työ/office: +358 2 333 5961 |
> ---------------------------------------
>
>
Automatic configuration of WINS replication...

New feature in 4.0

Eric

At 04:43 PM 6/18/97 -0600, Frostie Sprout wrote:
>What security issues surround the NT multicast group 224.0.1.24? I see it
>leaving an NT network onto the MBONE - even when nothing is participating
>in a group. For now, I'm stopping it - but what is it for? What security
>holes does it leave?
>
>Frostie
>--
>Frostie Sprout Frostie@wyoming.com Voice: 307.856.4220
>System Engineer, wyoming.com LLC FAX: 307.856.1499
> Wyoming's Leading Internet Service Provider
>Opinions are mine and do not necessarily reflect those of wyoming.com
>A. Einstein--"God might be subtle, but He is never malicious."
> "Albert! Stop telling God what to do!"--E. Fermi
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
On Wed, 18 Jun 1997, Bivens, David R. wrote:

> You may wish to check the security policies for the one of the
> troublesome workstations to ensure that the "Log on locally" right is
> granted to those groups that you wish to allow to log on.
> You may access this through the NT User Manager (not User Manager for
> Domains) on the NT workstation. (Select Policies/User Rights.)

What is the difference between the two? If you mean local user manager
we have check this and found this to be ineffective.

> If this is not causing you a problem, what service packs are you using
> on the workstations that are giving you trouble? How about on the
> server(s)?

The server is on 3.51 and all the machines that were affected were NT 3.51
ranging from with out fix pack to fix pack 5. Something to note is that
no permission settings were touched by any of the administrators before
this happens, well at least we think so. 

> What did the log entry say when the non-admin user logon was rejected?
> (Message ID, text of error, etc.)

I am paraphraseing it, user is not allowed to login to this machine try a
different machine.

This problem has happened to now 5 nt 3.51 machines in our network. The
workstations were just normal reg user workstations. To our best
knowledge nothing was changed in them by any of the Admins. So we are
suspecting a intruder, or a bug in NT 3.51. The problem is that these
random workstations with 3.51 will stop allowing reg users to login to the
workstation, it only allows Admins, whether Local or domain. We tried the
usuall checks with the permission setting for users to allow them to log
in locally and still will not allow logon. Note that all machines had
3.51 with a range of service packs and without service packs.

Thanks 
John


Actually, there are two components to the MS Proxy Server, the W3 Proxy
and the Winsock Proxy. The W3 Proxy acts as you describe for a proxy,
provides caching and fetchig and retriving data on the half of the
proxy. OTOH, the Winsock Proxy performs NAT similar to what a router
would do, although it requires a special client and a control channel to
get user information to validate that the user in question is authorized
to access the particular host and port combination. The authetication is
done when the channel is set up, and once it is created, NAT proceeds as
it would with a router.

Chris Plunkett wrote:
> ...
> You could make a very definate distinction between NAT done by a
> router and what is done by a proxy.
> 
> NAT, as done by a router, will go through every packet and rewrite
> the source and destination addresses of every packet going through
> it. Some devices will support a one to many translation, but other
> only support one to one, with a table.
> 
> A proxy doesn't rewrite the addresses in a packet in the same fashion.
> A client will make a request for a connection to a proxy server. The
> proxy server will then make this connection for the client, returning
> the data. If you were to look through documentation for Microsoft's
> proxy, somewhere it would show an example of the client send a url of
> http://proxy http://web.page.that.the.client.wants
> the proxy server will then go get the page and bring it back.
> No packets are actually sent directly from the client to the outside
> server. All packet to the outside server are sent from the proxy
> server, all packets to the client are sent from the proxy server.
> There are two connections taking place here.
> 
> This is not what a router doing NAT does. IT routes the packet,
> rewriting the addresses in the header.
>
> ...
Mikko Hypponen wrote:
> Preventing access to executables would not block viruses, as macro viruses
> are clearly the most common virus type and they spread with document files.

It's not only viruses I'm worried about, it's also the installation of
numerous programms that should not be installed. (games,...)

Is there some information anywhere, which parts of the registry the user
should have with rights to change and which ones not?

Bye
 Martin

------------------------------------------------------------------------
Dipl.-Ing. Martin Bernreuther University of Stuttgart
Pfaffenwaldring 7 Informationsverarbeitung im
70569 Stuttgart konstruktiven Ingenieurbau
Germany
 E-Mail: Martin.Bernreuther@po.uni-stuttgart.de
 http://www.uni-stuttgart.de/iv-kib/
------------------------------------------------------------------------