[comp.unix.aix] How do I fix this mile wide security hole?

fangchin@elaine54.Stanford.EDU (Chin Fang) (05/02/91)

Every now and then I have to be away from my RS6000 console.  Up to now
I haven't found a good way to lock my console.  Xlock won't cut it since
anyone can walk up to my console, ALT-CNTL-BKSP, kills X, and then do 
whatever s/he wants!

I can do a really *dirty* kludge using a shell wrapper as follows:

xmodmap unbind CNTL
call xlock
[user passwd validation]
xmodmap rebind CNTL

However, I don't really think the above even qualifies as a "solution".
Up to now, I just log out completely to protect my account, a BIG hassle
indeed considering we have 9600! users in yp, and it takes more than 30s
to get passwd prompt after login prompt!

I confess that RS6000 is still new to me and I might have missed some
utilities that I could have taken advantage of.  If someone could
kindly point me to these or suggest me an elagent way to secure my console,
I would be very appreciative.

Please email your response.  I promise a summary if there is enough interest.

Regards,

Chin Fang
Mechanical Engineering Department
Stanford University
fangchin@leland.stanford.edu

kgk@emubird.austin.ibm.com (Kevin G. Kehne) (05/02/91)

Look at the "-T" option on the command "X" which
starts the X server.

mbrown@testsys.austin.ibm.com (Mark Brown) (05/03/91)

fangchin@elaine54.Stanford.EDU (Chin Fang) writes:
> Every now and then I have to be away from my RS6000 console.  Up to now
> I haven't found a good way to lock my console.  Xlock won't cut it since
> anyone can walk up to my console, ALT-CNTL-BKSP, kills X, and then do 
> whatever s/he wants!

Look at the "-T" option on the command "X" which starts the X server.

             -or-
Lock the machine with your key. It will keep running, but the input devices
won't.


Mark Brown    IBM PSP Austin, TX.     (512) 823-3741   VNET: MBROWN@AUSVMQ
MAIL: mbrown@testsys.austin.ibm.com OR uunet!testsys.austin.ibm.com!mbrown
		Which came first: The Chicken or the Legba?
      DISCLAIMER: Any personal opinions stated here are just that.

frank@leopard.austin.ibm.com (05/03/91)

> Up to now, I just log out completely to protect my account, a BIG hassle
> indeed considering we have 9600! users in yp, and it takes more than 30s
> to get passwd prompt after login prompt!

Look at the mkpasswd command.  It makes a faster password lookup possible.


- Frank Feuerbacher


Disclaimer: I speak only for me!  And I don't even do a good job of that!

davec@shared.uucp (Dave Close) (05/05/91)

In article <7237@awdprime.UUCP> mbrown@testsys.austin.ibm.com (Mark Brown) writes:
>fangchin@elaine54.Stanford.EDU (Chin Fang) writes:
>  > Every now and then I have to be away from my RS6000 console.  Up to now
>  > I haven't found a good way to lock my console.  Xlock won't cut it since
>  > anyone can walk up to my console, ALT-CNTL-BKSP, kills X, and then do 
>  > whatever s/he wants!
>Look at the "-T" option on the command "X" which starts the X server.

Note that -T *only* inhibits CNTL-ALT-BKSP.  It does not inhibit ALT-ACTION.
Unless you are careful, you may have left behind a logged-in screen which
is reachable by ALT-ACTION.  This is true if you start X with 'open'.  To
prevent that problem, you can enter 'open xinit;exit'.

-- 
       	Dave Close         Shared Financial Systems          Dallas
        	davec@shared.com       vmail +1 214 458 3850
        	uunet!shared!davec       fax +1 214 458 3876
	My comments are my opinions and may not be shared by Shared.