NetNews Usenet Archive 1992 #19/NN_1992_19.iso/spool/comp/admin/policy/964

Internet Message Format | 1992-08-26 | 1.9 KB

Path: sparky!uunet!cs.utexas.edu!bcm!rice!owlnet.rice.edu!jaw
From: [e-mail] (Joseph A. Watters)
Newsgroups: comp.admin.policy
Subject: Re: Policy regarding Crack
Message-ID: <[e-mail]>
Date: 26 Aug 1992 21:19:34 GMT
References: <[e-mail]>
Sender: [e-mail] (News)
Organization: Rice University
Lines: 32

In article <mumble>, [e-mail] (Daniel Zabetakis) writes:
|>
|>     Does anyone have in thier usage policy mention of Crack, or COPS,
|> or other programs that could be used for unnacceptable purposes?
|>     Does anyone not allow possesion of Crack? How about running it?

At Rice, we do not explicitly disallow the possession or running of
either of these programs.  If we caught someone using them for
unacceptable purposes, we could take action against them for trying to
break in to systems that they are not authorized to use.  Our policies
prohibit unacceptable actions, regardless of the mechanism or
technology used to perform them.  For some systems here, our defense is
to run them ourselves regularly, and strongly encourage/force users
whose accounts are vulnerable according to these programs to close the
vulnerabilities.  In the case of crack, if it guesses a password, we
have the user change to an unguessable (by crack) password.  We use
COPS regularly to audit for its list of security holes, such as world
readable/writable .rhosts files, and have the users close those too.

There are many different groups managing computers here on campus, and
not all of them use these methods, to my knowledge.  The systems that
do use these methods comprise the largest networks on campus, with by
far the largest number of users.  The good thing about using COPS is
that it protects the networks that use it from some of the weaknesses
of the other networks on campus.

--
Joseph A. Watters, Jr.        [e-mail]
Deputy Director, Owlnet
Rice University
Houston, Texas