Very Computer

Hi,

We all know that an account is locked for a while if somebody attempts to
login without success.
With every unsuccessfully attempt the lockout duration will become longer.
(On a secure system).

OK, now to the question:
If somebody has locked the SYSTEM account in that way, what can be done,
excluding reboot or waiting, to log in as SYSTEM?

Thanks to all,
Werner

On Tue, 11 May 1999 10:36:11 +0200, "Werner Pachler"

Hi

First you can look at the intrusion records

$show intrusion

If any intrusion records exists - you can delete them with

$delete /intrusion_record NODEXX::USERNAMEYY

The system account can also have been disabled with a disuser flag -
this can be removed in AUTHORIZE

$MC authorize
UAF>mod USERYY /flag=nodisuser

all this requires some level of privileges

Jimmi

Quote:

> OK, now to the question:
> If somebody has locked the SYSTEM account in that way, what can be done,
> excluding reboot or waiting, to log in as SYSTEM?

  The intrusion locking should be seperated by source, so if you come on from
  another source you should be able to get access.

  It also might be helpful to give enough privs to your own account so that
  you can clear the intrusion records from either account.

                                                        -Jeff

--
Jeff Schreiber,            Process Software Corp.

      TCPware & MultiNet: Stronger than Ever

Message text written by "Werner Pachler"

Quote:>We all know that an account is locked for a while if somebody attempts to

login without success.
With every unsuccessfully attempt the lockout duration will become longer.
(On a secure system).

OK, now to the question:
If somebody has locked the SYSTEM account in that way, what can be done,
excluding reboot or waiting, to log in as SYSTEM?
<

        On most systems this is not a problem.  Most system managers do not
use the SYSTEM account regularly.  The system account is needed only for
such things as installing software, or restarting a process that is
supposed to run under the system account.

        If this is actually happening to your system, another privileged
account can be used to delete the intrusion records.  Again, if it is
actually happening to your system, you also need to use ANALYZE /AUDIT, and
ACCOUNTING to try to determine the source of the attack.  If the source is
internal, your organization should take disciplinary action against the
perpetrator.  If the source is external, you need to fix your firewall.
You may have to enable a "system password" on modem lines, disable dormant
accounts, disable unneeded TCP/IP services, especially things like rsh and
rexec.  Check your DECnet proxies; are they all still necessary.

        In short, secure your system!