NETWORK SECURITY SUPPLEMENTAL INFORMATION - PROTECTING THE DECNET ACCOUNT

The most important thing that needs to be done to protect a system 
against the current WORM attacks is to modify accounts where
USERNAME=PASSWORD.  This is the default configuration for the DECNET
account.  This can be changed easily, but there appears to be some
confusion about the effect that this has on a network. Changing the
DECnet default password DOES NOT IMPACT the normal operation of DECnet
in any way. 
                            --------

The following section provides some background material to illustrate
this point: 

On your system, issue the following commands from a priviliged
(CMKRNL,BYPASS,SYSPRV) account:

        $MCR NCP (or $RUN SYS$SYSTEM:NCP)
        NCP> show executor characteristics

This will produce a list that resembles the following:
 
 
        Node Volatile Characteristics as of 31-OCT-1989 11:02:23
         
        Executor node = 6.133 (NSSDCA)
 
        Identification           = DECnet-VAX V4.7,  VMS V4.7
        .
        .
        .
        Nonprivileged user id    = DECNET
        Nonprivileged password   = DECNET
        .
        .
        .
 
This is your DECnet executor database.  The information listed is the
default configuration for your node.  The information contained in this
list includes "Nonprivileged user id" and "Nonpriviliged Password". 

This information is what DECnet uses for userid/password when the 
connecting process a)does not have a proxy, b)does not specify a
username/password as part of the access string, and c)does not
have a different userid/password defined for the network object
being invoked.

The access information contained in the executor database is used for
reference only. The candidate userid and password (in this case DECNET
and DECNET respectively) are then passed to LOGINOUT to validate them
against the *REAL* information contained in SYSUAF.DAT.  If the
information matches, the access is allowed. If the information does not
match, the connecting user gets the following error messages: 

         Unable to connect to listner
         Login Information Invalid at Remote Node

                          --------

In order to correctly change your default network password so that your
system cannot be easily exploited by the current DECnet WORM, the
following 2 steps must be followed: 

1)  Change the password for user DECNET in SYSUAF.DAT:

        UAF> modify DECNET/Password=NEW_DECNET_PASSWORD

                               *NOTE*
           It is advisable at this time to check that
           certain other attributes of the DECNET user
           are properly set:

           The ONLY access method for this account should 
           be NETWORK. The BATCH, REMOTE, INTERACTIVE, 
           and DIALUP fields should all read "--no access--"

           The value of PRCLM should be set to ZERO. This is
           the number of (SPAWNed) sub-processes allowed.

           The flag LOCKPWD should be set. This prevents
           anyone but a priviliged user from changing the 
           password. The following command can be used:

      UAF> MOD DECNET/FLAGS=LOCKPWD/PRCLM=0/NOBATCH/NODIAL/NOINTER/NOREM/NETW


2) Change the password for DECNET in your network executor database:

        NCP> set exec nonpriviliged password NEW_DECNET_PASSWORD
        NCP> define exec nonpriviliged password NEW_DECNET_PASSWORD

The important thing to remember is that the password must be changed in
BOTH places, otherwise your network WILL break.  The worm is breaking
nodes by penetrating the DECNET account, and changing only the UAF
password with the $SET PASSWORD command.  By not changing the NCP
password, the network no longer accepts INBOUND connections. 

For more information, consult the VAX/VMS manuals:

   VMS V4.X - Volume 6 "Networking Manual"
   VMS V5.x - Volume 5A&5B "Guide to DECnet-VAX Networking"
---------------------------------------------------------------------------
Ron Tencati                           |   NCF::TENCATI /6277::TENCATI
SPAN Security Manager                 |   Tencati@Nssdca.gsfc.nasa.gov
NASA/Goddard Space Flight Center      |   (301)286-5223
Greenbelt, MD. USA                    |
---------------------------------------------------------------------------
                                                                    
Downloaded From P-80 International Information Systems 304-744-2253