We have Authentication, Authorisation and Accounting. And the least of these is Accounting, because no-one bothers about computer time these days. But its presence in the triad reminds us that username and password authentication dates back to a time when the only reason to log on was to select the account to be billed for your FORTRAN session on the teletype.
Using a password to prove identity is a later loading of this basic idea. Which is why it doesn't work.
Long train ride today, for a futile meeting.
Looking out of the window, I see it's not just in the south east that there have been many trees felled all along the track to control leaf fall.
Left behind: piles of logs, entire tree trunks. It's obvious they'll just be left. And I am consumed by lust to possess them.
As it's the holidays, the kiddies would stay on the PCs all night. To get them into bed, stern measures are needed:
First you need to set the accounts they are using (you're not letting them be admins, are you?) to have fixed logon hours. You can't do this through the GUI on XP Home, so you need a batch file of commands like this one to set times when it's possible to log on. Call it accounts.cmd -- you'll need to re-run it when anything changes:
net user mmadson /times:sunday,08:00:-21:00;monday-saturday,09:00-21:00;saturday,08:00-21:00The /passwordreq:no directive can be useful here too.
Unfortunately, Windows won't enforce that logoff. (A domain would, but Windows itself will not.) So the second step is to force it. There would be any number of ways to deal with this, but I chose the ugliest: run the the Sysinternals psshutdown command at bedtime. I chose to run it from a command file so that I could get a log. Put this text into enforcer.cmd, make the obvious modifications and set it up as a Windows scheduled task. (In the control panel, under Performance and Maintenance.)
@echo off echo "-start-" >>d:\at\log.txt date /t >>d:\at\log.txt time /t >>d:\at\log.txt d:\at\psshutdown -o -f >>d:\at\log.txt 2>&1 echo "-end-" >>d:\at\log.txtI set it to run twenty minutes past the last log on time. Hey presto! Instant rage from the younger generation.
The obvious improvement is to only log off console sessions which are members of the kiddiewinks group. It's really annoying when it logs ME off! I think I could script that up, but I'm too idle.
I've been intending to assemble some notes about the way I've been using an OpenSSL install to knock off some certification requirements. I was going to start with a round-up of the ways that X.509 was needlessly confusing, redundant and bizarre. And I was going to say that large-scale, public, multi-party PKIs are wrong-headed and dangerous.
There's still room for the OpenSSL cookbook -- I'll do that. For such a long-lived product, the documentation just doesn't say what a typical newbie user will want to know. And there's room for me to come clean (if no-one else will) and say that the worst initial obstacle was that I got confused with OpenSSH!
But the rest has been done a long time ago. I wish I'd found it earlier. It's sufficient to say:
The new URL makes much more sense. I doubt I've inconvenienced anyone, but if I have, I'm sorry, and thank you for finding your way here.
Just back from three days in a caravan on the Isle of Grain. Literally three days -- I slept at home, commuting with Comedy Dave and the dog, neither of whom were really happy with the caravan concept.
The spookily-named Allhallows Camp is great for bike-mad boys, even if they are a bit iffy about brakes. And the more mad son is very iffy on the brakes -- or at least that's a much more palatable theory than accepting that he's played too much "The Simpsons Hit and Run". Of course, when he runs into an occupied, parked van, and then sidesteps the inevitable argument with the Homer collision soundbite from the game: "Ow! My neck!" you have to wonder.
(This is my entrant for "most peurile reference to a Nintendo gaming console 2007".)
Now that the less mad son's eagerly desired birthday present has arrived from a reputable supplier (gamestation) I feel that it won't be tempting fate to describe what happens when you try and order from some other suppliers.
About ten days ago, Mrs U was desperately looking for a Wii. It launched months ago -- how could it possibly be in short supply now? The LMS was on a promise but there were none to be found with a fixed delivery date anywhere in the UK. Until she came across a site that magically was promising a five day delivery. Just time! So she shopped, waved her credit card, and waited.
No confirmation email: that's odd. Five days later, no Wii: that's a nightmare. Check the bank account: £2,500 debited by a restaurant in Surrey. Oooh.
Now I'm not naming the site because it's just possible that the cause of the trouble is actually this. But I don't think so.
The point to this sad story is that Mrs U is a competent shopper and competent security consumer. She declines to speak to the bank when they ring her up and ask her to confirm her identity. She knows what the padlock means. But as soon as she was a little bit needy, she was willing to deal with a site she'd never used before, without doing research that could have shown the slagging it got on Yahoo answers, she was willing to ignore the absence of a phone number, and she clicked straight through the warning from the self-signed certificate that was pointing to a "commerce" site hosted the Dear knows where. Education and common sense swept aside by need and "experience" of good shopping outcomes in the past.
It's worse for the restaurant: they've accepted a bad card without a PIN and that'll mean a monster charge back straight off their margin. Grief all round.
Education is supposed to be the key security tool, but it seems to me that the only education that works is to screw up.
You don't have to work with audit logs to be a GMT bigot. But it helps.
Less mad son's birthday and the Wii hasn't turned up, so I had to fall back on an old promise to install Steam and pay for a copy of Garry's Mod. Whatever that is.
What it is, is an easy install, together with -- in Steam -- the crappiest LUA bug ever. Obviously it needs to be installed as an admin, and equally obviously, after a deplorable spyware incident, the less mad son is not an admin. So I installed it myself, tested, and then we flipped over to his account to run it there. Well, to cut a long story short, to run Steam as a non admin, all you have to do is make sure that BUILTIN\Users have read-write permission from the install directory (\Program Files\Steam) on down. That's a bit of a palaver on XP Home, as it's hard to get the security tab to show, and I ended up going nuclear with a copy of subinacl, but conceptually it's the simplest possible LUA bug -- the installer doesn't bother to set the right permissions.
I'm not a bigot. Steam runs on Linux as well, so I can see that creating local application settings might not be the right thing to do. But I don't think it was too much to ask the testers to check that files shared among users were permissioned to BUILTIN\Users. Not to BUILTIN\Administrators.
In my opinion, programmers who test code using administrator accounts should never be admins again.
Still, at least Steam is free. Matlab costs £2-12K depending on what you buy, and our unfortunate application packager is going to have to spend days figuring out what part of the machine registry it's writing user settings to before I will sign it off for use in the firm. Slimy negligent gouging incompetents.
The last thing I did before I was locked up was plant some fresh ash whips. I smeared off the lower buds, stuck them eight or ten inches in, wrapped rabbit guards round, and bundled in threes in the hope that one will grow. I've tried hazel in some hedges and they look like they're going to break out, so we'll see.
I spent last week in hospital with an infected joint; I've had to find out about StickyKeys, and I'm using the mouse wrong-handed. I didn't feel ill, I just had to be around for regular surgery and IV penicillin, so there was a lot of time to kill with no desk, no computer, no Internet and one or two compromised hands (you can't read when your hands hurt and you haven't got a desk).
Better people than I am would have done something useful with all this time. I just wished it was finished. But I saw a lot of security protocols:
OK -- the scenario is that you really, really want to know what's on a Windows workstation hard drive -- you plan to look in the IE cache, system logs, registry, SAM, etc. You can't/won't be arsed to image it and work on the image and you are not going to take this rather urgent moment to learn about excellent Linux based tools. But you do want to take all reasonable precautions. (What's reasonable? I'm less sure than I was after reading this document. It's a normally reliable source, but the example scenario contains an eyepopping amount of work on a live system. Maybe evidence rules are different in the States. My approach is to kill the disk and only ever read from it.) Here's the plan.
Create a file called readonly.reg using notepad. Save it on your desktop. The file contains just these lines:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
"WriteProtect"=dword:00000001
Read Event Log Files
The log files you want will be in d:\windows\system32\config\ assuming d: is where your disk is. Sometimes you can load the .evt files from the subject disk into the log viewer. I find that it always says they're corrupt though.So I use Activestate Perl, add the Parse::EventLog module and a few lines of code to list them out into an easy text format. Here's the code -- you'll want to tweak it.
use strict;
use Parse::EventLog;
$|=1;
my $elogfn = 'd:\\windows\\system32\\config\\SecEvent.Evt';
print "Loading Event log: $elogfn .." ;
my $elog = Parse::EventLog->new($elogfn);
print "..loaded\n";
my %c = $elog->getOldestEvent();
while (%c = $elog->getNextEvent())
{
my $str;
if ($c{Strings})
{
$str = join('|', @{$c{Strings}}) ;
$str =~ s/\t/\\t/g;
$str =~ s/ / /g;
}
my $evt = $c{EventID};
my $time = localtime($c{TimeGenerated});
my $ msg = "$time: $evt <$str>\n";
print $msg unless grep({$_ == $evt} (560, 576, 515, 600));
}
The good bit here, is that this will work from a Linux machine just as well as Windows.
Read Registry and SAM files
The most amazing thing thing I've learnt recently is that the SAM is in the same format as a registry hive. This means you can use this tool to print out the system registry and the SAM (from d:\windows\system32\config\) as well as user registry from ntuser.dat in the appropriate profile.
You should also be able to use Parse::Win32Registry though I haven't done that. It would work from Linux, too. There's scope for a useful script here, as the SAM is in a desperately unhelpful format.
When you have to investigate a PC, there's the ideal approach, and the actual approach.
The ideal approach calls in a firm of investigators -- I use Kroll Ontrack as the sucessors to Vogon. They send in an engineer to take forensically sound images, and retain them on their systems until they can schedule an investigation to answer some of the basic questions. Two weeks to get there, and then further rounds of questions and answers ending in a report. Meanwhile you have managers wanting answers.
So there's the actual, otherwise known as DIY. Everyone does this sometimes, so here's a few pointers to protect your arse.1) Give Babylon Her Due.
If this is one of the cases where the police need to be called, then you must do that. You can't be ordered to conceal it by your boss -- your duty as a subject trumps your duty as an employee. Definitely talk it over with a sane advisor who's familiar with the situation, but if it's ugly then you have to give the cops the option. Don't go mental about this: for certain spyware breaches the Computer Misuse Act, but what are the chances of some random piece of spyware originating from someone subject to the Act?
2) Get it Cleared.You need a pretty explicit memo from your source of arse covering (your boss, HR) saying that the answers are wanted tomorrow, there is definitely no intention to rely on your investigation in any sworn proceedings, and that your advice to go the ideal route is not wanted or not practical in this case.
3) Take Care Anyway.
When you're half way into a DIY investigation and you realise that you are going to have to complain about the behaviour of an employee, or call the police, you do not want a sinking feeling that you've trampled on the only copy of the evidence. See the next post has basic tips for getting the data you need without booting the evidence disk or writing to it.
4) Keep it Locked Up.
One of the best reasons for working on images is that the record keeping to prove evidence is easy: you can keep the original locked away for long periods. If you're actually working on it, you have to sign it in and out, secure it when you leave your desk.... No fun, and not impressive when you have to swear a long chain on ins and outs, but better than no records kept at all.
OK. I finished pollarding the old willows by the pond. The take from that is going to be a lot of crappy firewood and a lot of waste, unless I can make faggots. The sanest use for the land we have would be to grow enough willow or poplar to fire a woodchip boiler -- as we burn oil at the moment that's twelve or sixteen hundred savings from something that currently yields nothing.
The big winds last week blew out some of my dodgier hedgelaying, so I've put that back. And I've planted another twenty-five hazels on a rather tight spacing. When they're established I'm putting in ash behind them with a view to eventual firewood coppice.
And I put in seventy-five hornbeams for Mrs U's garden.
Just one magic point: if you've struggled as I have to put bare-root trees into heavy clay you need this spade or one like it. If you want to let the plants in down the back of the spade in the traditional way, and you're strong enough to open up the slits in the soil, the metal shaft means you can push as hard as you need without breaking the handle off, and if you do decide to dig a trench, it needn't be a wide one. You'll need metal re-inforced boots to use it though -- and be prepared to jump on it to get it in to clay.
