OS2 World.Com Forum

Subject  :  how does OS/2 store passwords??
Author  :  dljone9 dljone9@os2world.com
Date  :  22 Jul, 2004 on 15:25
I work for a large US corporation that uses OS/2 Warp Server 4 (the Warp 3, pre-Aurora version).

We need to respond to an auditor's inquiry about how OS/2 a) stores user's logon passwords, and b) protects security control files. Encryption?? Does it cache passwords?

Also - does it allow repetitive characters in a password??

Much obliged!!

Daniel


Subject  :  Re:how does OS/2 store passwords??
Author  :  mobybrick
Date  :  23 Jul, 2004 on 12:41
Hi,

The standard OS/2 network passwords and security mechanisms are managed by the OS/2 User Account Subsystem (UAS). UAS integrates security between UPM, LAN Server, non-ACL based filesystems and HPFS386/JFS.

UAS stores passwords in an encrypted hash file, NET.ACC. As it is a hash file, the real passwords are protected and the real password is never transmitted on the wire, using a form of challenge authentication.

If you want to find out what password policies are available (e.g. remembered passwords) then type NET ACCOUNTS from the OS/2 command line.

Good ol' LANServer 4 (which predates the v5 you are using) introduced fixes which include that the server never retains in memory a network password in usable form. So, if the server traps or if you initiate a memory dump, you will still not be able to obtain passwords (or even usernames) from the memory dump.

These password mechanisms exclude other password systems, such as the ones you might use for FTP or telnet, which are unforunately less secure.


Subject  :  Re:how does OS/2 store passwords??
Author  :  dljone9 dljone9@os2world.com
Date  :  23 Jul, 2004 on 13:48
That information is most useful - much obliged, sir!

Would love to hear more - if there is any more to be said on this
topic. This corporatin is heavily invested in OS/2, and I want to
see them upgrade and stay with it


mobybrick (23 Jul, 2004 12:41):
Hi,

The standard OS/2 network passwords and security mechanisms are managed by the OS/2 User Account Subsystem (UAS). UAS integrates security between UPM, LAN Server, non-ACL based filesystems and HPFS386/JFS.

UAS stores passwords in an encrypted hash file, NET.ACC. As it is a hash file, the real passwords are protected and the real password is never transmitted on the wire, using a form of challenge authentication.

If you want to find out what password policies are available (e.g. remembered passwords) then type NET ACCOUNTS from the OS/2 command line.

Good ol' LANServer 4 (which predates the v5 you are using) introduced fixes which include that the server never retains in memory a network password in usable form. So, if the server traps or if you initiate a memory dump, you will still not be able to obtain passwords (or even usernames) from the memory dump.

These password mechanisms exclude other password systems, such as the ones you might use for FTP or telnet, which are unforunately less secure.



Subject  :  Re:how does OS/2 store passwords??
Author  :  Kim
Date  :  27 Jul, 2004 on 18:39

dljone9 (23 Jul, 2004 13:4:
That information is most useful - much obliged, sir!

Would love to hear more - if there is any more to be said on this
topic. This corporatin is heavily invested in OS/2, and I want to
see them upgrade and stay with it


Agree would be higly interesting to hear a bit more about OS2 and the security used within the system and as well what could be suggested add-ons.

/Kim


Subject  :  Re:how does OS/2 store passwords??
Author  :  mobybrick
Date  :  28 Jul, 2004 on 12:28
i) Password caching

Password caching is a function of the client, not the server. Both OS/2 and Windows clients allow passwords to be cached, but this is easily disabled. In a secure environment, it is always best to force network logon and validation by removing password caching. Newer versions of Windows (e.g. NT, 2K, XP) do NOT, by default, allow password caching, so you may already be OK here.

ii) Security of files

If you are using the OS/2 Warp Server Entry Edition, then access control lists for the file systems are held in the NET.ACC file per server. This allows moderate performance, but means that physical access to the server would mean security compromised - no logon is required to access files on the server console, and the harddisk can be taken out and read in another machine (assuming it supports FAT/HPFS).

If you are using the Advanced server, then the access control lists are held on the filesystem for HPFS (and JFS if using ACP) using HPFS386. If local security is not installed, then physical access to the server remains a concern, but at least directories with ACLs on cannot be read in another computer - the ACLs have to match the running NET.ACC on the domain controller. So, if you take a HPFS386 formatted disk and stick it even in another OS/2 server, you will not be able to read anything. (If you need to lower the HPFS386 protection, e.g. to do a system upgrade, then run THIN386 which lowers the security).

If local security is installed, then a valid domain logon is required on the server to even access/modify ACL protected directories on the server.

All in all though, it is simply best to prevent physical access to the server and keep it locked away - maybe with the lockup facility running to prevent casual access.

Post if there is anything else specific you wish to know about...

Regards,
M


Powered by UltraBoard 2000 <www.ub2k.com>