NetNews Usenet Archive 1993 #3/NN_1993_3.iso/spool/comp/os/vms/21661

Internet Message Format | 1993-01-21 | 3.9 KB

Path: sparky!uunet!cs.utexas.edu!uwm.edu!linac!att!ucbvax!lrw.com!leichter
From: [e-mail] (Jerry Leichter)
Newsgroups: comp.os.vms
Subject: re: SYSUAF.DAT access - the real world
Message-ID: <[e-mail]>
Date: 20 Jan 93 21:28:13 GMT
Sender: [e-mail]
Distribution: world
Organization: The Internet
Lines: 62

Philip Perucci wrote that he needed to be able to provide access to SYSUAF.DAT
to someone working for the company comptroller.  A number of people have taken
the opportunity to use this as an example of the stupidity of management, and
to say that there is basically no way to do this without giving that person
at least the ability to get any rights he likes.

INFO-VAX subscribers (including some whose postings I generally respect) once
again again reveal their narrowness of vision and understanding of the real
world.  Look, a VAX is not a toy.  It can be a substantial investment, and
USE of it may represent real money.

A BASIC rule of handling money is never to give one person complete control.
That's why you pay one person for your movie ticket, then hand the ticket to
a second person.  (Otherwise, how's anyone to know that the person at the
ticket window isn't pocketing some fraction of the take and just letting
people through?)

It is perfectly legitimate for the comptroller of a corporation to wish to be
in a position to audit use of a corporate resource.  It is unacceptable if the
only way to audit usafe of a resource is through the direct intervention of a
person in a perfect position to misuse the resource.  If you have to ask the
system manager to prepare reports on system usage, and he is the one who is
stealing, what do you think the chances are that the reports will give him
away?

Don't respond by saying that you have to have confidence in your system
manager.  That's true - but why do you think con men - short for confidence
men - are called that?  They are the people who no one suspects, who everyone
identifies as the nicest, friendliest, most trustworthy people in the organi-
zation.

In the IBM world, system management responsibilities can be subdivided.  In
organizations that worry about this kind of thing, a common rule is that the
person who has the ability to create accounts on a system is never allowed to
use that system for anything else.  The most closely monitored function in a
payroll organization is the creation of new payroll accounts.

VMS is actually not particularly good in this kind of "large system/large
money" world.  However, it's moving in that direction.  That's why there's a
separate SECURITY privilege:  The security officer and the system manager in
a high-security shop are different people, and the former has SECURITY and
few other privileges, while the latter has all sorts of privileges, but not
SECURITY.  While with CMKRNL you can do anything, given enough effort, VMS is
deliberately designed so that it's difficult to do security-related things
without leaving a trail.

In Mr. Perucci's position, the ideal would be to be able to give the auditor
read-only access to the SYSUAF.  Unfortunately, AUTHORIZE demands WRITE
access.  I consider this a serious limitation, since it makes it unnecessarily
more difficult to implement an "outside auditor" facility.  One way to do this
would be to give the auditor just read access and have him copy the live
SYSUAF.DAT to a private file, which he could then modify to his heart's
content without damaging anything.  Another approach is to trust the auditor
not to do anything stupid - but have someone else check the audit logs for any
changes he might make to the SYSUAF.  (Again, make sure two people have to
work together to subvert the system.)

Of course, with the listings it should be simple to patch AUTHORIZE NOT to
demand write access - just pull out the explicit check.  If it keels over when
someone tries to write to the file, well, big deal.
                            -- Jerry