Home | Gallery | Forum | Services | Webmail | Archive | Links | Contact Us | About Us
OS2 World.Com Forum
OS2 World.Com Online Discussion Forum.
Index / OS/2 - SIGs / Security
author message
how does OS/2 store passwords??
Post a new topic Reply to this Topic Printable Version of this Topic Forward this Topic to your Friend Topic Commands (for administrator or moderators only)
dljone9
Premium member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 93
since: 13 Jan, 2003
1. how does OS/2 store passwords??
Reply to this topic with quote Modify your message
I work for a large US corporation that uses OS/2 Warp Server 4 (the Warp 3, pre-Aurora version).

We need to respond to an auditor's inquiry about how OS/2 a) stores user's logon passwords, and b) protects security control files. Encryption?? Does it cache passwords?

Also - does it allow repetitive characters in a password??

Much obliged!!

Daniel

Date: 22 Jul, 2004 on 15:25
mobybrick
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 38
since: 23 Jul, 2004
2. Re:how does OS/2 store passwords??
Reply to this topic with quote Modify your message
Hi,

The standard OS/2 network passwords and security mechanisms are managed by the OS/2 User Account Subsystem (UAS). UAS integrates security between UPM, LAN Server, non-ACL based filesystems and HPFS386/JFS.

UAS stores passwords in an encrypted hash file, NET.ACC. As it is a hash file, the real passwords are protected and the real password is never transmitted on the wire, using a form of challenge authentication.

If you want to find out what password policies are available (e.g. remembered passwords) then type NET ACCOUNTS from the OS/2 command line.

Good ol' LANServer 4 (which predates the v5 you are using) introduced fixes which include that the server never retains in memory a network password in usable form. So, if the server traps or if you initiate a memory dump, you will still not be able to obtain passwords (or even usernames) from the memory dump.

These password mechanisms exclude other password systems, such as the ones you might use for FTP or telnet, which are unforunately less secure.

Date: 23 Jul, 2004 on 12:41
dljone9
Premium member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 93
since: 13 Jan, 2003
3. Re:how does OS/2 store passwords??
Reply to this topic with quote Modify your message
That information is most useful - much obliged, sir!

Would love to hear more - if there is any more to be said on this
topic. This corporatin is heavily invested in OS/2, and I want to
see them upgrade and stay with it


mobybrick (23 Jul, 2004 12:41):
Hi,

The standard OS/2 network passwords and security mechanisms are managed by the OS/2 User Account Subsystem (UAS). UAS integrates security between UPM, LAN Server, non-ACL based filesystems and HPFS386/JFS.

UAS stores passwords in an encrypted hash file, NET.ACC. As it is a hash file, the real passwords are protected and the real password is never transmitted on the wire, using a form of challenge authentication.

If you want to find out what password policies are available (e.g. remembered passwords) then type NET ACCOUNTS from the OS/2 command line.

Good ol' LANServer 4 (which predates the v5 you are using) introduced fixes which include that the server never retains in memory a network password in usable form. So, if the server traps or if you initiate a memory dump, you will still not be able to obtain passwords (or even usernames) from the memory dump.

These password mechanisms exclude other password systems, such as the ones you might use for FTP or telnet, which are unforunately less secure.


Date: 23 Jul, 2004 on 13:48
Kim
Team member
in staff

View this member's profileSearch all posts from this memberSend an email to this memberhttp://www.haverblad.se
posts: 2128
since: 10 Dec, 2000
4. Re:how does OS/2 store passwords??
Reply to this topic with quote Modify your message

dljone9 (23 Jul, 2004 13:4:
That information is most useful - much obliged, sir!

Would love to hear more - if there is any more to be said on this
topic. This corporatin is heavily invested in OS/2, and I want to
see them upgrade and stay with it


Agree would be higly interesting to hear a bit more about OS2 and the security used within the system and as well what could be suggested add-ons.

/Kim

Date: 27 Jul, 2004 on 18:39
mobybrick
Normal member
in user

View this member's profileSearch all posts from this memberSend an email to this member
posts: 38
since: 23 Jul, 2004
5. Re:how does OS/2 store passwords??
Reply to this topic with quote Modify your message
i) Password caching

Password caching is a function of the client, not the server. Both OS/2 and Windows clients allow passwords to be cached, but this is easily disabled. In a secure environment, it is always best to force network logon and validation by removing password caching. Newer versions of Windows (e.g. NT, 2K, XP) do NOT, by default, allow password caching, so you may already be OK here.

ii) Security of files

If you are using the OS/2 Warp Server Entry Edition, then access control lists for the file systems are held in the NET.ACC file per server. This allows moderate performance, but means that physical access to the server would mean security compromised - no logon is required to access files on the server console, and the harddisk can be taken out and read in another machine (assuming it supports FAT/HPFS).

If you are using the Advanced server, then the access control lists are held on the filesystem for HPFS (and JFS if using ACP) using HPFS386. If local security is not installed, then physical access to the server remains a concern, but at least directories with ACLs on cannot be read in another computer - the ACLs have to match the running NET.ACC on the domain controller. So, if you take a HPFS386 formatted disk and stick it even in another OS/2 server, you will not be able to read anything. (If you need to lower the HPFS386 protection, e.g. to do a system upgrade, then run THIN386 which lowers the security).

If local security is installed, then a valid domain logon is required on the server to even access/modify ACL protected directories on the server.

All in all though, it is simply best to prevent physical access to the server and keep it locked away - maybe with the lockup facility running to prevent casual access.

Post if there is anything else specific you wish to know about...

Regards,
M

Date: 28 Jul, 2004 on 12:28
how does OS/2 store passwords??
Post a new topic Reply to this Topic Printable Version of this Topic Forward this Topic to your Friend Topic Commands (for administrator or moderators only)
All times are CET+1. < Prev. | P. 1 | Next >
Go to:
 

Powered by UltraBoard 2000 Standard Edition,
Copyright © UltraScripts.com, Inc. 1999-2000.
Home | Gallery | Forums | Services | Webmail | Archive | Links | Contact Us | About Us
© OS2 World.Com 2000-2004