Re: BYPASS privilege !!

In article <1181606749.449032.311320@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
BaxterD@xxxxxxxxxx wrote:

Equally obvious, to a user with BYPASS privilege, it matters not how
well you lock down the security on your app, since BYPASS by
definition, will bypass all system security. Once the app is
properly secured, then the only way for a non-application, privileged
username to access the application directories or files is either to
grant themselves the necessary identifiers, or use BYPASS to bulldoze
their way in. Both of these actions, (and most other discrete
attempts) can be recorded in the Security Audit Journal.

I have found the flowchart in Figure 4-3 in the "OpenVMS Guide to System
Security" manual to be useful when explaining the sequence of access
processing to auditors.

In particular, note that the use of BYPASS to access an object will only
be reported by the auditing subsystem when all other access checks fail.
(IOW, if the user has "normal" access to an object, that is used instead
of BYPASS.)

However, If there happen to be multiple Administrators, all using the
SYSTEM account for their admin duties. How do you determine who
did what?

Give each administrator his/her own account. The relevant user name will
not only show up in the audit journal, but also places like the PRODUCT
database and VMSINSTAL.HISTORY files. This makes life easier for admins
to see who did what on a day to day basis, so IMHO is desirable even
before considering auditor's requirements.

1. Does anyone know of any function, particularly during system
startup, which "absolutely" requires BYPASS" privilege.

I think you are concentrating too much on BYPASS here. As others have
pointed out, other privileges will get a malicious/"well meaning" user
there eventually anyway. Don't forget that he "well meaning" user can be
dangerous too.

Note that a fair amount of stuff is started _before_ the audit server -
shadow server, clustering, OPCOM, and SYLOGICALS.COM, to mention a few.

--
Paul Sture
.

Relevant Pages

  • Re: BYPASS privilege !!
    ... your App, or Data, and be able to recover from it. ... will bypass all system security. ... Enable auditing of Privilege use and UAF modification. ... retrieve lost files. ...
    (comp.os.vms)
  • Re: BYPASS privilege !!
    ... demarkation between OS Admins and App Admins, ... less simple to stop a Sys Admin from messing with the App (again, ... under/over/around/through the same security. ... Equally obvious, to a user with BYPASS privilege, it matters not how ...
    (comp.os.vms)
  • Re: bypassing employers proxy to surf anonymously
    ... How do I seek to bypass the controls that my company has put in place? ... How do I demonstrate that I should not be woirking in the security industry?! ... You have an option to go with a managed service or an enterprise software. ... Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. ...
    (Pen-Test)
  • Re: Security Flaws with XP
    ... someone can just temporarily load another operating system and bypass ... the security features" - because there is really no way to prevent it. ... Only says it's easy to bypass ... > Microsoft's logon. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: ASP.NET Security
    ... Or how about hand assembling some hex codes in a buffer overrun? ... All those will bypass 'security'. ... off all security checks... ... The easiest quickest simplest solution is to not use a .dll - just ...
    (microsoft.public.dotnet.framework.aspnet.security)