Re: (PM) SECURITY PROBLEM. (fwd)

Jon Lewis (jlewis@inorganic5.fdt.net)
Sun, 19 Jul 1998 00:21:24 -0400 (EDT)

On Sat, 18 Jul 1998, Thomas C Kinnen wrote:

> >what the hell is the problem with setting it to default
> >to off upon opening a telnet session
>
> How many people user pmwho or other utilities to telnet in every min
> (remember the Admin loggin thread). That would make debugging a real pain
> if you had to turn it on every min.

I think you misinterpretted him. If ComOS were to default to the
equivalent of "set debug off, reset con" on termination of a telnet
session, this would be a non-issue...and this is what people seem to have
expected, which is why they're calling this a bug.

RFE: How difficult would it be to do the above with an override command
like "set debug persist" which causes debugging not to be disabled upon
termination of the telnet session in which the "set debug persist" command
was issued?

Otherwise, this could be turned into a potential security hole. Picture
this: Some user notices an admin has telnetted to a PM...perhaps he's
even called saying "I can't seem to get my ISDN to sync up, can you see
what your end is saying"...he waits a few seconds, then tries various
methods to kill that admin's telnet session. If sucessful, he then opens
4 telnet sessions to the PM, and if lucky, collects the debug 0x51 output
for the next few logins.

------------------------------------------------------------------
Jon Lewis <jlewis@fdt.net> | Spammers will be winnuked or
Network Administrator | drawn and quartered...whichever
Florida Digital Turnpike | is more convenient.
______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____

-
To unsubscribe, email 'majordomo@livingston.com' with
'unsubscribe portmaster-users' in the body of the message.
Searchable list archive: <URL:http://www.livingston.com/Tech/archive/>