I'm trying to address this same problem: We have several <groups>.SYS with
no files and no passwords and yes, the dread PM.  In fact the only thing
stopping knowledgeable HP3K hackers is lack of network connections and
passwords on modem ports.

Does anybody have a list of HP-supplied SYS account groups which should NOT
have PM dropped, or which groups MUST remain?  I'm inclined to simply
clobber the excess (and hopefully unused) groups.

Thanks

K Tracy Pierce, Systems Programmer
Golden Gate Bridge, Hwy & Trnsp Dist
PO Box 9000, Presidio Station
San Francisco, CA  94129-0601
mailto:[log in to unmask]
415-923-2266


-----Original Message-----
From: Ron Horner [mailto:[log in to unmask]]
Sent: Wednesday, June 21, 2000 10:14 AM
To: [log in to unmask]
Subject: Re: Removing PM capability from groups in standard HP accounts


Those accounts are normally locked with pass words.  I'm a VESOFT user as
well, but sometimes you can't do as good of a cleaning as you'd like.






Nicholas Saner <[log in to unmask]> on 06/21/2000 12:08:40 PM

Please respond to [log in to unmask]

To:   [log in to unmask]
cc:    (bcc: Ron R Horner/CHI/Seabury)

Subject:  Removing PM capability from groups in standard HP accounts


The Vesoft VEAUDIT manual says that a group should not have PM capability
unless it contains a PM program.  I ran the VEAUDIT report which identifies
all groups that should have PM capability removed; the report lists many
groups in standard HP accounts such as SYS, SYSMGR and TELESUP.  I trust
Vesoft's advice but am hesitant to alter the capability list of default HP
groups.  Has anyone else had any trouble after removing PM capability from
groups in standard HP accounts?

Nicholas Saner
Gaiam, Inc.
(303) 222-3656