Question for those using SU in their logon scripts - KiXtart.org - official site

You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Basic Scripting » Question for those using SU in their logon scripts

Page 1 of 1

1

Topic Options

#32525 - 2002-11-16 12:42 AM Question for those using SU in their logon scripts
Vig Vig Starting to like KiXtart Registered: 2001-11-14 Posts: 166 Loc: Saudi Arabia	My question is how do you secure it? Currently I have an exe file (I converted a bat file and encrypted it) that starts the script that needs admin rights. My worry is some smart user or anyone who knows a little bit about scripting will figure out that the exe launches a script which has admin rights, domain admin at that. This person could then edit or create another script named the same as the one I'm launching and execute whatever they wanted with admin rights. Is there a way to set up permissions so that a normal user can execute a file on a remote share but... cannot copy or read that file? Thanks
Top

#32526 - 2002-11-15 02:38 PM Re: Question for those using SU in their logon scripts
Sealeopard Sealeopard KiX Master Registered: 2001-04-25 Posts: 11165 Loc: Boston, MA, USA	Simple answer: I do not use SU at all. Client management is accomplished via Task Scheduler, and a client-server management script. See Installing an Application as an Admin and KiXtart Systems Management Server (Part III, The Client) [a.k.a The Complete Package] _________________________ There are two types of vessels, submarines and targets.
Top

#32527 - 2002-11-15 03:19 PM Re: Question for those using SU in their logon scripts
Lonkero Lonkero KiX Master Guru Registered: 2001-06-05 Posts: 22346 Loc: OK	neither do I. but what comes to execute/read, not possible on windows machines. _________________________ ! download KiXnet
Top

#32528 - 2002-11-15 03:38 PM Re: Question for those using SU in their logon scripts
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Jens, Jooel, In the topic it says "Questions for those using SU..." Obviously not directed at either of you based on your reply. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#32529 - 2002-11-15 05:05 PM Re: Question for those using SU in their logon scripts
Sealeopard Sealeopard KiX Master Registered: 2001-04-25 Posts: 11165 Loc: Boston, MA, USA	I know, but I've looked beyond the problem of securing SU (hard to do) and provided a convenient alternative _________________________ There are two types of vessels, submarines and targets.
Top

#32530 - 2002-11-15 05:22 PM Re: Question for those using SU in their logon scripts
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Yes, us 'born again Christians' have a tendency to 'bible thump' on the sins of SU insecurity. That being said, a search on the keys SU and encrypt may reveal some suggestions. There are ways using KiXCrypt or Secure21 to ubfuscate the SU password. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#32531 - 2002-11-15 07:15 PM Re: Question for those using SU in their logon scripts
Vig Vig Starting to like KiXtart Registered: 2001-11-14 Posts: 166 Loc: Saudi Arabia	quote: That being said, a search on the keys SU and encrypt may reveal some suggestions. There are ways using KiXCrypt or Secure21 to ubfuscate the SU password. Thanks, but as you can see in my first post I already do this and this is not what I am concerned with. I was hopeing for some brainstorming on how to make SU "secure" but it seems people are set in their ways. Just curious, does everyone see SU as a security vulnerability because it has the encrypted password included in the file or is it because of the reason that I stated above?
Top

#32532 - 2002-11-15 07:23 PM Re: Question for those using SU in their logon scripts
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Vig, You are only half right. I pointed out two very different methodologies. You recognize a pitfall with the encrypted bat file approach but KiXCrypt encrypts the entire script. I saw your thread drifting from your intended discussion and tried to set it back on course. If you wish to expand the topic then by all means, we can discuss alternatives. I think many ppl use admin scripts that remotely achieve what admin rights are needed for. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#32533 - 2002-11-15 07:47 PM Re: Question for those using SU in their logon scripts
Vig Vig Starting to like KiXtart Registered: 2001-11-14 Posts: 166 Loc: Saudi Arabia	Thanks, didn't catch your point earlier. I guess SU is just to convienent for me. I preffer to have everything take place when the user is logging on rather than at a later time. I don't really trust my users to leave their computers on after normal work hours (plus their instructed not to) and most computers sre still in use after work hours anyways. I can just image a user rebooting their computer because it's to slow or for some other unknown reason. I like the idea of them having to sit and wait while they watch their computers software being updated. Thanks for the offer of discussing alternatives but I'm already fairly comfortable with using remote execution and job tasks. I was just looking for a way to make what I'm already doing more secure. Thanks
Top

#32534 - 2002-11-15 07:54 PM Re: Question for those using SU in their logon scripts
Les Les KiX Master Registered: 2001-06-11 Posts: 12734 Loc: fortfrances.on.ca	Then KiXCrypt is probably the best way to extend and secure what you have already. _________________________ Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
Top

#32535 - 2002-11-15 08:00 PM Re: Question for those using SU in their logon scripts
Lonkero Lonkero KiX Master Guru Registered: 2001-06-05 Posts: 22346 Loc: OK	ok, when you started going away from the idea I can continue. I just replied his last question and think I may such a thing even though I do not use su. _________________________ ! download KiXnet
Top

Page 1 of 1

1

Previous Topic

Previous Topic View All Topics

View All Topics

Index Next Topic

Next Topic

Moderator: Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart

Hop to:

Shout Box

Who's Online

1 registered (Allen) and 581 anonymous users online.

Newest Members

fgarcia, Viginette, ManuvdWielNL, Sir_Barrington, batdk82
17889 Registered Users

Generated in 0.082 seconds in which 0.023 seconds were spent on a total of 12 queries. Zlib compression enabled.

click tracking