HP3000-L Archives

August 1996, Week 1

HP3000-L@RAVEN.UTC.EDU

Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
From:
Gavin Scott <[log in to unmask]>
Reply To:
Date:
Fri, 2 Aug 1996 16:47:32 -0700
Content-Type:
text/plain
Parts/Attachments:
text/plain (33 lines)
Michael L Gueterman writes:
>I couldn't find any documentation on LaserRom to support
>its usage here (not real surprising), and considering
>that it appears to require PM not because of a 'technical'
>reason, but only due to a half-hearted attempt at compatibility
>with the Unix world, I'm a little dismayed.
 
It's the same issue that UNIX has.  TCP port numbers <1023 are
typically assigned to security sensitive services like telnet.
A process that can bind to port 23 can trivially implement a
"fake" telnet service, and proceed to capture passwords from
users who attempt to telnet into the system.  Thus, on most
multi-user systems, you have to prove to the OS that you are
"trusted" or "privileged" enough to be allowed to bind to
these low numbered ports.  On UNIX this means that you have
to be running as root (since this is the only sort of privilege
that UNIX has), and on MPE it means you have to be running in
Priv Mode.  It's not an issue of being "UNIX compatible" at
all.  It's a basic network security issue.  You simply cannot
allow untrusted users to bind to any old port that they want
to, at least not on a multi-user system.
 
Of course, the fact that most systems only extend this
protection to socket numbers <1024 means that many services
(X, HP VT, etc.) are not protected by it.  For example there
is nothing that would stop one from writing a fake inbound
VT service on MPE that would issue an MPE/iX: prompt to
clients that connected to it and then log the passwords that
were entered, other than the fact that hopefully the real VT
will always be running so that the port is already in use.
 
G.

ATOM RSS1 RSS2