In <BxtK7G.4o5@news.cso.uiuc.edu> tinsel@uiuc.edu (Thomas Aaron Insel) writes:
>arie@eecs.umich.edu (Arie Covrigaru) writes:
>> There is a security hole in the AppleShare 3.0 password scheme.
>> Suppose I am a user (or even if I am not) on an AppleShare server,
>> but don't have administrator privileges. The following procedure will
>> enable me to assign them to myself and thus have future access to all
>> folders on the server.
>> 1. Turn off the server.
>> 2. Move the Users & Groups Data File file from the Preferences folder
>> within the system folder to the root level of the system folder.
>> 3. Open the administrator application. The administrator will allow you
>> to set a new administrator password.
>This isn't a security hole in AppleShare, it's a security hole in your
>site. If everything was layed out correctly, the server would be locked
>in a room where you couldn't get to it. At the very least, its floppy
>drive should be locked so you can't boot into the Finder and do this sort
>of stuff.
>
No kidding! If you have access to the System folder of the Server unit why not
snoop through all the files you want on the mounted volumes! As mentioned aboveit's a security hole in your site. I use Mac Guardian keyboard locks for sites
were a locked room is impossible. That at least provides a physical lock of
all server input without the appropriate key.
BTW: I did notice this security hole in AShare 3.0, if I take a sledge hammer and bust open the cpu running the server, I can remove the internal Hard Drive andattach it to another cpu thus gaining access to all the files! tisk tisk tisk
