[HECnet] How much should you be allowed to shoot yourself in the foot?

[Robert Armstrong]

> Peter Lothberg <roll at stupi.com> wrote:
>So if you can read sysuaf.dat....... 

  VMS has "one way" password encryption (like Un*x) so you can't get an account's password by reading the SYSUAF file (well, OK you can guess it, but only by very brute force).  So you could figure out which accounts were privileged, but it wouldn't automatically give you access to those accounts.

  FWIW, the VMS manuals had a table of privilege bits that, if granted to a user, in theory gave that user the ability to gain any other privilege.  Some were obvious, like SETPRIV (which literally meant "this process can set any privilege bit it wants, regardless of authorization") but others were more subtle.  For example, CMKRNL (change mode to kernel) would allow a clever enough user to write a program accessed any memory location anywhere, and from there the user could theoretically change the privilege mask for his process.  There were actually quite a few privileges which could be leveraged into any privilege.

  Also, on VMS network (DECnet network, of course) is a privilege.  This one is enabled by default for new accounts, but you can deny a user network access if you want.

Bob