[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference noted::hackers_v1

Title:-={ H A C K E R S }=-
Notice:Write locked - see NOTED::HACKERS
Moderator:DIEHRD::MORRIS
Created:Thu Feb 20 1986
Last Modified:Mon Aug 03 1992
Last Successful Update:Fri Jun 06 1997
Number of topics:680
Total number of notes:5456

147.0. "A VMS 4 bug?" by APACHE::LAWLER () Thu Aug 15 1985 18:02

I noticed that after doing a SET DEF XXXX"USERNAME PASSWD"::DISK$[USER..]
That each subsequent operation (such as a directory) masks the real
password with the word "password", ostensibly to protect the password
from observations by people looking over a user's shoulder.  This
works great except for the instance

 SHO DEF

which responds with

  NODE"username **REALPASSWORD**"::xxxx  Is this a bug, or is there
a reason why the password is displayed in response to this command?


                                               al

BTW, this is true for vms 3.x and 4.x systems...
T.RTitleUserPersonal
Name
DateLines
147.1HARE::COWANThu Aug 15 1985 23:0710
	My guess is that it is a bug.  There is some bit you twiddle to
tell RMS to give you 'password' instead of the real password.  Off hand,
I don't remember what it is.

	I mistakenly tried the SET DEF scenario once.  Was it ever awful.
There are a ton of things you type that require bizarre network processes
to start up.  The overhead is enourmous.   Although since RMS provides
transparent network access, most things do work.

	KCz
147.2WEBSTR::NELSONFri Aug 16 1985 21:434
I think I remember seeing somewhere that VMS does not support setting your
default directory to a remote node.  I think it was the QAR database.

				JENelson
147.3R2ME2::GILBERTFri Aug 16 1985 21:5213
It's not really a bug, it's just that SHOW DEFAULT isn't as smart as the
rest of version 4 of VMS.  It simply translates SYS$DISK, and tacks on the
current default directory.  What it needs to do is check for search lists,
and this and that, all of which RMS can be persuaded to do on a $PARSE.
It's not too hard, but neither is it trivial; and the payoff is low.

For what it's worth, after accessing a few files with that default directory,
RMS might remember the password, so try:
	$ SET DEFAULT XXX"USERNAME password"::DISK$:[USER..]
(Yes, "password" in lower case, just like that).

Also, what's so bad about SHOW DEFAULT showing the password?
SHOW LOG SYS$DISK would also display it.
147.4WHO::YERAZUNISSun Aug 18 1985 21:5911
I have at times set def'd over the NI from a Microvax I to a VAXcluster, and
although it *is* slow, it also is completely transparent (so far as I can
tell) and it can be a convenience at times.... unless you get
confused and then the world seems to end.
	
Why worry about little things like "sho log"?  Just uparrow to 
see the text (unexpurgated, too) of the last twenty things you did.
	
VMS may need a flag to tell it to automatically NOT remember for 
uparrowing certain commands (or to sanitize the displayed versions
of those commands).
147.5VAXUUM::DYERMon Aug 19 1985 15:3512
	A slight digression, but a worthy one, as it describes a kludge:

	If you want to type commands that uparrows (and ^B) won't remember,
do them like this:

		    $ @tt:
		    _$ type FOO"BAR BAZ"::XYZZY:[PLUGH]HELLO.SAILOR
		    _$ exit	! Or ^Z.  Whatever.
		    $

The command recall doesn't recall anything inside the "command procedure," tt:.
		<_Jym_>
147.6WSGATE::FISHERTue Aug 20 1985 13:544
Hey, what a super kludge! Thanks, Jym!

Burns

147.7LATOUR::SPEERWed Aug 28 1985 15:1210
Re "password": From TOPS-land, now that you can do a parse-only GTJFN%
on a filespec containing node and userid/password attributes, an

	@INFORMATION (ABOUT) FILES

command at EXEC level returns you the real password along with everything else.
I believe this (and the SHO LOG VMS problem) are security weaknesses. The 
argument that since you just typed the password it's ok to echo it back (it's
ok for YOU to know it, right?) could just as well work the other way (YOU
know it, so why splash it on your terminal for others to see?)
147.8VAXUUM::DYERWed Oct 09 1985 04:547
.3> . . . after accessing a few files with that default directory,
.3> RMS might remember the password . . .

	I've noticed this, and it's a real nice feature.  What
are the conditions for RMS to remember the password?  Are they
documented anywhere?
		<_Jym_>