OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1998: More Rconsole stuff

More Rconsole stuff

Chris Brenton (cbrentonsover.net)
Fri, 9 Oct 1998 11:06:39 -0400 

Since we're on the subject of Rconsole and I did not find this in the
archives...

As of NetWare 4.x, Novell recommends using the Inetcfg utility for
managing networking. If you have "load remote" in the autoexec.ncf,
Inetcfg will try to grab it and add it to Inetcfg's scripts.

The problem here is that Inetcfg saves the Rconsole password to SYS:ETC
in a file named Netinfo.cfg. All users have full read access to this
directory so anyone with a valid account can view the Rconsole password.
Given Simple Nomad's post, even if you cut and paste in order to ensure
that the password is encrypted, it is still extremely vulnerable.

The patch would be to call remote from another NCF file which is stored
in the SYS:SYSTEM directory. This will at least limit access to only
Admins. This will also prevent Inetcfg from trying to grab it. Of course
the real fix would be to not use Rconsole. ;)

I've also noticed (with 4.1x anyway) that if you enable Telnet access to
the server, remote sessions are not logged. Combine this with the above
and any user can now whack away at the server console without leaving an
audit trail.

Any known patches for the above would be most cool,
Chris
--
**************************************
cbrentonsover.net

* Multiprotocol Network Design & Troubleshooting
http://www.amazon.com/exec/obidos/ISBN=0782120822/0740-8883012-887529
* Mastering Network Security
http://www.amazon.com/exec/obidos/ISBN%3D0782123430/002-0346046-8151850