topic Re: execute acces on SYSUAF.DAT in Operating System - OpenVMS

execute acces on SYSUAF.DAT

Bruno Seghers — Tue, 11 Jul 2006 08:26:52 GMT

Hi,

I install a patch on a third party Scheduler product ($U from Orsyp). Since this moment, I have security problems on the SYSUAF.DAT file.
Users who runing task under the scheduler generate a protection error : they try to access the SYSUAF.DAT in execute mode.

My question is : what is the risk to give (w:E) protection on SYSUAF.DAT. In the VMS doc I only see that execute access is to authorize to run a image or to @ a dcl file.

Thanks for help

Seghers Bruno

Re: execute acces on SYSUAF.DAT

Wim Van den Wyngaert — Tue, 11 Jul 2006 09:02:47 GMT

Hi Bruno,

Long time no see.

I have no knowledge of side effects except that you can @ the sysuaf file.
BTW : over here they are RE with no side effects.

CU

Wim

Re: execute acces on SYSUAF.DAT

Volker Halle — Tue, 11 Jul 2006 09:11:20 GMT

Wim,

setting SYSUAF.DAT to WO:RE is an invitation to hackers to try and crack your passwords.

The default protection for SYSUAF.DAT would be: SYSTEM:RWED, OWNER:RWED and nothing else.

Volker.

Re: execute acces on SYSUAF.DAT

Wim Van den Wyngaert — Tue, 11 Jul 2006 09:19:15 GMT

If you give W:R to the sysuaf, a user could do open/share=read/read and thus prevent other processes from updating it. This could cause hanging processes (password changes, update date last login, etc).

Wim

Re: execute acces on SYSUAF.DAT

Ian Miller. — Tue, 11 Jul 2006 09:46:06 GMT

is the product asking for execute only or read and execute (the audit entry should tell you)?

Re: execute acces on SYSUAF.DAT

Bruno Seghers — Tue, 11 Jul 2006 09:49:36 GMT

Execute only

Re: execute acces on SYSUAF.DAT

Wim Van den Wyngaert — Tue, 11 Jul 2006 09:51:15 GMT

I tested it and with RE your system gets in hung after open/read/share=read.

In accounting : error accessing system authorization file and this for all new processes.

Wonder what other files I could use in this way ... should check *.dat at least.

Wim

Re: execute acces on SYSUAF.DAT

Ian Miller. — Tue, 11 Jul 2006 09:58:22 GMT

The original question is about the risk of execute only access for world.

One way of restricting this risk would be to add an ACL with a ACE grating execute access to holders to a specific idenitifer. Then grant that identifier to users who need to run a task under the scheduler.

I think that the locking problem mentioned above needs read access.