COPS and Robbers-Unix System Security.txt

                      COPS and Robbers
                    UN*X System Security



     In the last few years, computer security has received a
great  deal  more attention than it has in the past.  Compu-
terized break-ins and criminal  activity,  once  merely  the
product  of  the imagination of science fiction writers, has
became a fairly common  occurence  in  both  commercial  and
academic  circles.   In this paper, I will go over the prob-
lems that face any multiuser computing system, then  discuss
how  these  problems  apply  to  UNIX[1]  specifically,  and
finally  present  in  detail  a  suite of programs that were
developed in an attempt to address some of the main problems
that  could  be  solved  via  software.  UNIX, although con-
sidered to be a fairly secure operating system  ([Wood  88],
[Duff  89], etc), has the advantage of having many published
works ([Grampp and Morris 84],  [Bishop  83],  etc)  on  the
problems  that  a computing site can have with security, and
in addition, on how a UNIX system administrator  might  make
his/her  system more secure by monitoring various aspects of
his/her UNIX site.  This, combined with  UNIX's  popularity,
make  it  an  ideal target for a software security system to
operate on.

     In this report I am not going to discuss specific  ways
of  breaking  into a given UNIX machine (for a more detailed
description on how to compromise UNIX security,  see  either
[Baldwin88],  [Bishop83],  [Wood & Kochran 86], or [Grampp &
Morris 84]) -- instead, I will concentrate on how to improve
and  strengthen  the  potentially good security of a generic
UNIX system by means of a software toolkit that examines the
weaker  areas  of UNIX that are either traditionally ignored
(due to the time constraints  or  ignorance  of  the  system
administrators) or are simply reoccurring problems that need
to be watched over.  In addition, this report is  not  meant
for  UNIX  neophytes -- although a great deal of proficiency
is not needed to read  this  report  and  use  the  programs
described  herein, a familiarity with basic UNIX features --
the file system and file permission modes for example -- and
commands  such  as awk,grep,sed  as  well  as a working
knowledge of  shell  and  C  programming  are  necessary  to
_________________________
9  [1] Although originally designed and developed by Ken
Thompson and Dennis Ritchie of AT&T, UNIX has grown far
beyond its' original design and now numerous  companies
market their own "flavor" of UNIX.  When I use the term
UNIX in this paper, I don't mean merely AT&T's version,
but  instead  I  mean  the majority of the most popular
varieties, made by developers at Berkely,  Sun,  and  a
host of other manufacturers.  I believe UNIX is still a
trademark of Bell Laboratories.
9


                     February 19, 1991





                           - 2 -


understand the internal  workings  of  the  security  system
described in this paper.

     Although there is no reasonable way that  all  security
problems  can  be solved (at least not with a software solu-
tion) on any arbitrary UNIX system, administrators and  sys-
tem  programs  can  be assisted by a software security tool.
The Computer Oracle Password and Security system (COPS) that
will  be described in this paper is just such a device.  The
COPS system is a collection of programs  and  shell  scripts
that  attempt to address as many of these problems as possi-
ble in an efficient, portable, and above all in  a  reliable
and  safe  way.  The main goal of COPS is one of prevention;
it tries to anticipate and eliminate  security  problems  by
making sure people don't get a chance to compromise security
in the first place.  Alerting the administrators of a poten-
tial  intruder  or  that  a virus has infected the system is
beyond the scope of the present system, although  with  work
with  such  capabilities could be added ([Bauer and Koblentz
88] and [Duff 89].)

     To understand the reason COPS might check any  specific
problem,  a look at computer security problems in general is
in order.  The problems listed below are  not  meant  to  be
inclusive,  but  they  are indicative of the myriad types of
dilemmas  a  typical   computer   multiuser   system   might
encounter:

     1)  Administrators, system  programmers,  and  computer
operators.   The  very  people  that (should) worry the most
about security are sometimes the ones  that  are  the  least
concerned.  Carelessness is one of the main culprits; a mis-
take by a user might cause little or no  problem,  but  when
someone  with no restrictions (or almost none) on their com-
puter activity makes a mistake, a security hole can  result.
"I  can  trust  my users" is a fine statement to make -- but
can you trust your users' friends?  How about the  users  of
computers  that  are networked to yours?  New software, sys-
tems, or procedures can facilitate extra problems; a comput-
ing  staff  is  often  ill  or completely non-trained on new
techniques and software.   Too  often  "RTFM"  is  the  only
training  that  they  will  ever receive.  Programs that are
created for in-house use are often  ill-documented  and  not
debugged  thoroughly,  and  when users other than the author
start to use/abuse the program, problems can result.   Espe-
cially  misunderstood,  even by experienced UNIX system pro-
grammers, is the SUID program or, worse yet, the SUID  shell
script ([Bishop 83].) When a user says that his/her password
was forgotten (or any other account/security  related  prob-
lem),  what  checks  are  made  to verify that the person is
really the owner of that account?  Are users that are  secu-
rity  problems kept track of, so that repeated abuses of the
system will result in punitive action?  Does your site  even
have  a  security  policy?  And of course, the last straw is



                     February 19, 1991





                           - 3 -


that most system administrators simply have too  much  other
work to do than to constantly check the system for potential
security flaws -- let alone to double-check  that  any  work
done  by  other  system programmers has been done correctly.
These are the actions that often get left unsaid and undone.

     A UNIX environment has no special defenses against this
kind  of "attack".  Fortunately, a number of these potential
problems  (unless  catastrophic  in  scope)  are  not   only
correctable,  but are easy to detect with a software toolkit
such as COPS.  Even the most careful UNIX guru will periodi-
cally  make  a  mistake;  COPS  has  been designed to aid in
her/his never ending battle against the forces of darkness.

     2)  Physical security.  This is perhaps the most  frus-
trating of all possible problems because it effects all com-
puter systems and is often the hardest to safeguard against.
Even  if the software is secure, even if the system adminis-
trators are alert to potential problems, what happens  if  a
user  walks  up to the root console and starts typing?  Does
the night janitorial staff let anyone into the machine  room
without  proper  identification?  Who  has access to the key
that opens up the computing center?  Are terminals that  are
logged on left unguarded or unlocked?  Are passwords written
on or near a users terminal or desk?   No  software  in  the
world   can  help  against  human  nature  or  carelessness.
Reiterating to your staff and users  that  terminals  should
not  be  left  alone  or unguarded and that passwords (espe-
cially root) should not be typed in front of unfriendly (and
in this case, _everyone_ is your enemy) eyes would be a good
start.  A simple analogy: since you  would  never  give  the
keys  to  the  company car away, why on earth would you give
away the keys to your computer, which is certainly  worth  a
hell  of  a lot more time and money (although it may not get
as good mileage on the interstate.)   Common  sense  goes  a
long ways to help prevent this kind of risk.

     3)   Authentication.   What  is  authentication?    All
modern computing systems that have capabilities for multiple
users have a means of identifying who is using the  computer
at  any  given time.  A common means of identification is by
using a password; and since the inception of this idea, poor
passwords have been a perennial problem.  People have a ten-
dency to use  their  own  name,  or  their  social  security
number,  or  some  other  common word, name, or phrase for a
password.  The problem then arises when an unauthorized user
wants to access clandestine information, he/she simply tries
one of these simple passwords until a  successful  match  is
found.

     Other  problems  with  authentication?   What  computer
hosts  are  "trusted"  and  allow users to log in from other
machines without any further authentication?  Are  incorrect
login   attempts  kept  and/or  monitored  so  as  to  allow



                     February 19, 1991





                           - 4 -


administrators to keep track of any unusual activity?   What
about  "Trojan  horses" -- programs that can steal passwords
and the privileges that a user owns -- is there a program or
a administrative method that detects a potential 'horse?

     Fortunately UNIX systems again have  some  fairly  good
tools  to  aid in this fight.  Although finding simple pass-
words is indeed a trivial task, forcing the users on a  sys-
tem  to  use  passwords  that  are  harder  to guess is also
trivial, by either modifying the mechanism  that  gets/gives
the  password  to  the  user,  and/or  by  having the system
administrators run a simple password detector  periodically,
and notifying users if their password is deemed too obvious.
The crypt command, although proven  to  be  insecure  for  a
knowledgeable and resourceful attacker ([Reed and Weinberger
84], [Baldwin 86]), does offer an added shield against  most
unauthorized  users.   Logs  can  be kept of incorrect login
attempts, but as with most security measures, to  be  effec-
tive  someone (usually the site administrator) must take the
time to examine the evidence.

     4)  Bugs/Features.  Massive software designs  (such  as
an  operating system) are usually the result of a team or of
teams of developers working together.   It  only  takes  one
programmer to make a mistake, and it will almost always hap-
pen.  "Back doors" that  allow  unauthorized  entrances  are
sometimes  purposefully  coded  in -- for debugging, mainte-
nance, or other reasons.  And there  are  always  unexpected
side effects when thousands of people using the system start
doing strange (stupid?) things.  The best  kind  of  defense
against  this  is to report the problems to the developer as
they are discovered, and if possible, to also report  a  way
to fix the problem.  Unfortunately, in many cases the source
code is needed to make a bug fix,  and  especially  in  non-
academic  areas,  this  is  simply  not available due to the
prohibitive costs involved.  Combining this with the  reluc-
tance of a (usually) commercial developer to admit any prob-
lems with their product, and the end result  is  a  security
hole  that  will not be mended unless some kind of financial
loss or gain is at stake -- for the developer  of  the  pro-
duct, not yours!

     5)  Ignorance.  Users who don't know or care can  be  a
problem  as  well.  Even if someone doesn't care about their
own security, they can  unwittingly  compromise  the  entire
system   --   especially  if  they  are  a  user  with  high
privileges.  Administrators and  system  operators  are  not
immune to this either, but hopefully are better informed, or
at least have access to a means of combating  this  dysfunc-
tion.   It  may  also  be due to apathy, an unwillingness to
learn a new system, a lack of time to  explore  all  of  the
features  of  a  large system, or simply not enough computer
savvy to learn more about a very complex system, and no  one
willing  to teach it to the user.  This problem is much like



                     February 19, 1991





                           - 5 -


illiteracy; it is a never-ending battle that will  never  go
completely  away.  And while a software toolkit such as COPS
can  help  combat  this  problem  by  calling  attention  to
neglected  or  misunderstood critical areas, by far and away
the best weapon against this is education.  An educated user
will simply not make as many mistakes; and while it may seem
impractical to teach _all_ users about (even) the  fundamen-
tals  of  computer  security,  think  of  all  the  time and
resources wasted tracking down the mistakes that keep recur-
ring time and time again.

     6)  Unauthorized permissions or privileges.  Are  users
given _too much_ freedom?  Do new computer accounts have any
default security at all, or are the new  users  expected  to
know  what  to do to protect their programs, data, and other
files.  System  files,  programs,  and  data  are  sometimes
shipped  with  minimal or no protection when gotten straight
from the manufacturer; someone at the installation site must
have  enough  knowledge to "tune" the system to be effective
and safe.  Password, memory, and log files especially should
all be carefully monitored, but unfortunately an experienced
user can often still find out any information they want with
perseverance and a little luck.  This is where a system such
as COPS can really shine.  After a new system is configured,
some  basic  flaws can be uncovered with just a small amount
of effort.  New system problems that  somehow  slip  through
the cracks of the site installers can be caught and modified
before any serious problems result.   The  key  here  is  to
prevent  your system users from getting a denial of computer
service that they need and deserve.  Service could mean any-
thing from CPU time, response time, file space, or any other
commodity that a computer has to offer.

     7)  Crackers/Hackers/Evil twin brothers.  Not  much  is
needed  on this subject, save to say that they are often not
the main problem.  Professional  evil-users  are  a  rarity;
often harmful acts are done by users who "just wanted to see
what would happen" or had no idea of  the  ramifications  of
their acts.  Someone who is truly experienced is very diffi-
cult to stop, and is certainly  outside  the  realm  of  any
software  security  tool  as  discussed in this paper.  For-
tunately,  most  evil-doers  are  fairly  inexperienced  and
ignorant,  and when they make a mistake, a watchful adminis-
trator can deal with a problem before it gets out  of  hand.
Sometimes  they  can even reveal security problems that were
previously undiscovered.   COPS  can  help  here  mostly  by
reducing  an  attacker's options; the less holes to exploit,
the better.

     The COPS system attempts to help protect as many of the
above  items  as possible for a generic UNIX system.  In the
proper UNIX spirit, instead of having a large  program  that
attempts  to solve every possible problem, it is composed of
several small programs that each check one or more potential



                     February 19, 1991





                           - 6 -


UNIX  security  holes.   The  COPS  system uses a variety of
these problems to see if there are any  cracks  in  a  given
UNIX security wall.  These methods correspond to some of the
problems discussed above;  specifically  to  administrators,
system  programmers, and computer operators; authentication;
ignorance;  unauthorized  permissions  or  privileges;   and
finally  crackers/hackers/evil twin brothers (numbers 1,3,5,
and 6.)  It is very difficult, almost a  practical  impossi-
bility  to  give software assistance to problems in physical
security, and finally bugs or features that are present in a
given  UNIX  system  are  possible  to  detect,  but are not
covered in this system (yet).  The design of most of the the
programs  were  at  least described if not outlined from the
following sources:

Aho, Kernighan, and Weinberger 88

Baldwin 87

Fiedler and Hunter 86

Grampp and Morris 84

Wood and Kochran 86


     Of course with all of the problems listed below,  look-
ing  at  the  actual  source  code  of  the  program is very
instructive -- each numbered section lists the corresponding
program that is used to perform the check:

     1)  COPS Checks "vital" system directories  to  see  if
they are world-writable.  Directories listed as critical are
in a configuration file and are initially:

/ /etc /usr

/bin /Mail /usr/spool

/usr/adm /usr/etc /usr/lib

/usr/bin /usr/etc /usr/spool/mail

/usr/spool/uucp /usr/spool/at

     The method COPS uses to detect problems -- read through
a  configuration  file  (dir.chklst)  containing  all of the
potential danger  spots,  and  then  simply  comparing  each
directory  modes with a bit mask to see if it is world writ-
able.  The program that performs this task is dir.chk

     2)  Check "vital" system  files  to  see  if  they  are
world-writable.   Files  listed  as critical are in a confi-
guration file (file.chklst) and are initially:



                     February 19, 1991





                           - 7 -


/.*

/etc/*

/bin/*

/usr/etc/yp*

/usr/lib/crontab /usr/lib/aliases /usr/lib/sendmail


The wildcards are used like in UNIX, so these would  include
(some of the more important files):

/.login /.profile /.cshrc /.crontab /.rhost

/etc/passwd /etc/group /etc/inittab /etc/rc

/etc/rc.local /etc/rc.boot /etc/hosts.equiv /etc/profile

/etc/syslog.conf /etc/export

As well as the executable command files (among others):

sh,csh, and ls.


     Method -- again read through a configuration file list-
ing  all  of the files to be checked, comparing each in turn
with a write mask.  The program that performs this  task  is
file.chk

     3)  Check "vital" system  files  to  see  if  they  are
world-readable,  plus  check  for  a NFS file system with no
restriction.  These critical files are:

/dev/kmem /dev/mem

All file systems found in /etc/fstab

Plus a small number of user selectable  files  --  initially
set to include /.netrc, /usr/adm/sulog, and /etc/btmp.

Method -- checking each in turn  against  a  read  mask  for
their  read  status.   The  file  system names are read from
/etc/fstab, the selectable files are  kept  in  a  variable.
The program that performs this task is dev.chk

     4)  Check all files in system for SUID status,  notify-
ing the COPS user of any changes in SUID status.

Method -- Use the "find" command on the root directory (this
must  be  done by root to avoid missing any files unreadable
but still dangerous.) The previous run will  create  a  file



                     February 19, 1991





                           - 8 -


that can be checked against the current run to keep track of
changes in SUID status and any new SUID files.  The  program
that performs this task is suid.chk and was written by Pren-
tiss Riddle.

     5)  Check the /etc/passwd file (and  the  yellow  pages
password   database,  if  applicable)  for  null  passwords,
improper #  of  fields,  non-unique  user-id's,  non-numeric
group id's, blank lines, and non-alphanumeric user-id's.

Method -- Read through password file, flag  any  differences
with  normal password file, as documented in "man 5 passwd".
Fortunately, the syntax of the password file  is  relatively
simple  and  rigid.  The  program that performs this task is
passwd.chk


     6)  Check the /etc/group file  (and  the  yellow  pages
database, if applicable) for groups with passwords, improper
# of fields, duplicate users in  groups,  blank  lines,  and
non-unique group-id's.

Method -- Read through group file, flag any differences with
normal  group  file  as documented in "man 5 group".  Again,
the syntax of this file is fairly simple.  The program  that
performs this task is group.chk

     7)  Check passwords of users on system.

Method -- using  the  stock  "crypt"  command,  compare  the
encrypted password found in the /etc/passwd file against the
following (encrypted) guesses:

The login id (uid), information in the gecos field, and  all
single letter passwords.

The program that performs this  task  is  pass.chk  and  was
written  by  Craig  Leres  and  was modified by Seth Alford,
Roger Southwick, Steve Dum, and Rick Lindsley.

     8)  Check the root path,  umask,  and  if  root  is  in
/etc/ftpuser.

Method -- look inside the /.profile  and  /.cshrc  files  to
ensure  that  all  of  the  directories listed are not world
writable, that "." isn't anywhere in the path, and that  the
umask  is  not set to create world writable files.  The pro-
gram that performs this task is root.chk

     9)  Examine the commands in  /etc/rc*  to  ensure  that
none of the files or paths used are world-writable.

Method -- grep through the files  and  examine  any  strings
that  start  with  "/"  for  writability.   The program that



                     February 19, 1991





                           - 9 -


performs this task is rc.chk

     10)  Examine the commands in /usr/lib/crontab to ensure
that none of the files or paths used are world-writable.

Method -- grep through the  crontab  file  and  examine  any
strings  after field five (first five are not files, but how
crontab is to be run) that start with "/"  for  writability.
The  program  that performs this task is cron.chk 11)  Check
all of the user home directories  to  ensure  they  are  not
world writable.

Method -- get all of the home directories using  the  system
call  getpwent()  and  then  for every home directory found,
check the write permissions of of the home directory against
a bit mask.  The program that performs this task is home.chk
and it was written by John Owens.

     12) Check important user files in  user's  home  direc-
tories  to  ensure  they  are not world writable.  The files
checked (all in the individual users'  home  directory,  all
with the prefix "."):

rhost profile login cshrc kshrc tcshr crhost

netrc forward dbxinit distfile exrc emacsrc

Method -- using the same system call as #10, determine  user
home  directory.   Then  simply check all of the above files
against a bit mask.  The program that performs this task  is
user.chk

     13) Given a goal to compromise, such as user root,  and
a list of user and group id's that can be used in an attempt
to achieve the goal, this security tool will search  through
the  system until it verifies that the goal is compromisible
or not.  The program that performs this tricky task is  part
of the U-Kuang (rhymes with "twang") system.  Robert Baldwin
was kind enough to allow me to include this security checker
(a fine security machine in it's own right) within this dis-
tribution.  For more information on this  fascinating  secu-
rity  checker,  see  kuang.man.ms  and [Baldwin 87].  I have
rewritten it in Bourne shell (it was in C-Shell) for further
portability.

     None of programs listed above certain cover all of  the
possible  areas  that can harm a system, but if run together
they can aid an overworked administrator to locate  some  of
the  potential  trouble spots.  The COPS system is not meant
to be a panacea against  all  UNIX  security  woes,  but  an
administrator who examines the security toolbox programs and
this research paper might reduce the danger  of  their  UNIX
system being compromised -- and that's all any security tool
can ever hope to do.  The COPS system could never replace  a



                     February 19, 1991





                           - 10 -


vigilant  administration  staffed with knowledgeable people,
but hopefully, as administrators look into the package, more
comprehensive  programs  will come into being, covering more
of the problems that will continue as the latest versions of
UNIX continue to grow.

     Design Notes:

     The programs that are described here were  designed  to
address the problems discussed above, but still be usable on
as many UNIX "flavors" as possible.   Speed  was  sacrificed
for  simplicity/portability;  hopefully  the tools here will
either be replaced or modified, as by no means are they  the
final  word  or solution to _any_ of these problems; indeed,
it is my hope that  after  other  programmers/administrators
see  this  report,  they will create newer, better, and more
general tools that can be re-distributed periodically.  None
of the programs need to be run by root to be effective, with
the exception of the SUID checker (to ensure that all  files
are  checked.) Some of the tools were written by myself, the
others were written by other programmers on the network  and
(with their permission) presented here.  All of the programs
in this report are in the public domain, with the  exception
of Robert Baldwin's U-Kuang system; they all exist solely to
be used and modified to fit your needs.   If  they  are  re-
distributed,  please keep them in their original form unless
it is clearly stated that they were modified.  Any  improve-
ments (that might not be too hard :-), suggestions, or other
security programs that you would like  to  see  get  further
distribution can be sent to:

     df@medusa.cs.purdue.edu

     (That's me)

     or

     spaf@uther.cs.purdue.edu

     (Dr. Eugene Spafford)

     Note that the COPS system is still in an infancy  stage
--  although it has been tested on a variety of computers at
Purdue, it has not undergone any serious trials.

     Enhancements I envision include:

i) Improved speed and portability without sacrificing  func-
tionality (pretty obvious, I guess....)

ii) A level of severity assigned to each  warning;  anything
that  could  compromise root instantly (root having no pass-
word, for example) might have a level 0 priority, while sim-
ply  having a user with a writable home directory might only



                     February 19, 1991





                           - 11 -


be level 3.  This way the system could be run at  a  certain
threshold  level, or simply have the set of warnings priori-
tized for a less sophisticated administrator.

iii) Better handling of SUID programs.  The current  program
needs  more  work  to be done on it to be run effectively by
most people; many will not be willing to put the time needed
to  go  through  the list of SUID files by hand to decide if
they are needed or not.  Perhaps also an alarm  would  sound
if a shell script is SUID; doubly so if root owned.

iv) A CRC checker that would check a file  system  (possibly
just  the  most  important  programs  (such as this :-)) and
report if any of the executable files were changed -- possi-
bly signalling a viral infection.

v) The eradication of any design flaws or coding errors that
are in the COPS system.

     The main purpose of creating the COPS system  was  two-
fold;  the first was to foster an understanding of the secu-
rity problems common to most UNIX systems,  and  the  second
was  to  try  to  create and apply software tools that, when
run, will inform system administrators of potential problems
present in their system.  No attempt is made by the tools to
correct any problems because a potential security problem at
one  site  may  be  standard policy/practice at another.  An
emphasis on furthering education and knowledge about UNIX in
general is the key to good security practices, not following
blindly what an unintelligent tool might say.

     Some of the advantages to using a system such  as  COPS
are:

i)  Nearly  Continuous  monitoring  of  traditional  problem
areas.

ii) A new system can be checked before being put  into  pro-
duction.

iii) New or inexperienced administrators can not  only  stop
some  of  their  problems in security they may have, but can
also raise their consciousness about the potential for secu-
rity dilemmas.

     And a couple of disadvantages:

i) An administrator could get a false sense of security from
running  these  programs.  Caveat emptor (ok, they are free,
but still beware.)

ii) A specific path to the elimination of the problem is not
presented.   This  could  also be construed as an advantage,
when considering the third point.



                     February 19, 1991





                           - 12 -


iii) Badguys can get these tools.  You know -- the guys with
black hats.  What happens when they get a copy of this pack-
age?  With any sensitive subject like security, knowledge is
zealously   guarded.    People   are  afraid  that  absolute
knowledge corrupts -- who knows, they may be right.   But  I
staunchly  stand by the tree of knowledge.  Let the bad guys
taste the fruit, and they may see the light,  so  to  speak.
In  addition,  the  system  does  not say how to exploit the
hole, just that it exists.

     Results of Running COPS:

     Not surprisingly, the results when COPS was run  varied
significantly  depending  on what system and site it was run
on.  Here at Purdue, it was run on a Sequent  Symmetry  run-
ning DYNIX 3.0.12, on a pair of Suns (a 3/280 and 3/50) run-
ning UNIX 4.2 release 3.4, a  VAX  11/780  running  4.3  BSD
UNIX,  a  VAX  8600  running  Ultrix 2.2, and finally a NeXT
machine running their 0.9 O/S version of UNIX.  The  results
of  the  COPS  system showed a reasonable amount of security
concern on all of the machines; the  faculty  only  machines
showed  the  weakest security, followed by the machines used
by the graduate  students,  and  finally  the  undergraduate
machines  had  the  strongest  security  (our administrators
_know_ that  you  can't  trust  those  (us?)  young  folks.)
Whether  this was showing that Purdue has a good administra-
tion, or that the UNIX vendors have a fairly good  grasp  on
potential  security problems, or if it was merely showcasing
the shortcomings of this system wasn't clear to me from  the
results.

     The security results probably will  vary  significantly
from  machine  to  machine  --  this is not a fault of UNIX;
merely having the same machine and software  does  not  mean
that  two  sites will not have completely different security
concerns.  In addition, different vendors and administrators
have  significantly varying opinions on how a machine should
be set up.  There is no fundamental reason  why  any  system
cannot  pass  all  or nearly all of these tests, but what is
standard policy at one sites may be an unthinkable  risk  at
another,  depending  upon the nature of the work being done,
the information stored on the computer, and the users of the
system.

     When I first started researching this report, I thought
it  would  be  a  fairly  easy  task.  Go to a few computing
sites, read some theoretical papers, gather all the programs
everyone  had written, and write a brief summary paper.  But
what I found was an tremendous  lack  of  communication  and
concerted  effort towards the subject of security.  AT&T had
written a couple of programs ([Kaplilow and Cherepov 88], as
had   Hewlett   Packard   ([Spence   89]),   but  they  were
proprietary.  I heard rumors that the government was  either
working on or had such a security system, but they certainly



                     February 19, 1991





                           - 13 -


weren't going to give it to me.  The  one  book  devoted  to
UNIX security ([Kochran and Wood 86]) was good, but the pro-
grams that they presented were not expansive enough for what
I  had  in  mind,  plus the fact that they had written their
programs mostly based on System V.  And  while  most  system
administrators  I  talked  to  had  written at least a shell
script or two that performed a  minor  security  task  (SUID
programs seemed the most popular), no one seemed to exchange
ideas or any their problems with  other  sites  --  possibly
afraid  that the admission of a weakness in their site might
be an invitation to disaster.  There is an  excellent  secu-
rity  discussion  group on the network ([Various Authors 84-
]), from which I received some excellent ideas for this pro-
ject, but it is very restrictive to whom it allows to parti-
cipate.  I hope that with the release of this security  sys-
tem it will not only help stamp out problems with UNIX secu-
rity, but would encourage people  to  exchange  ideas,  pro-
grams,  problems  and solutions to the computer community at
large.

Dan Farmer September 29, 1989

     Acknowledgements: I would like to thank Eugene Spafford
for  his  invaluable  help in the researching, planning, and
development of this project.  Without the writings and  pro-
grams created by Robert Morris, Matt Bishop, and other capa-
ble UNIX programmers, this project could never  have  gotten
off  the  ground.  Thanks also go to Brian Kernighan, Dennis
Ritchie, Donald Knuth, and Ken Thompson, for  such  inspira-
tional  computer  work.   And of course without Peg, none of
this would have come into being.  Thanks  again  to  all  of
you.

























                     February 19, 1991





                           - 14 -


                        BIBLIOGRAPHY


_, UNIX Programmers Manual, 4.2 Berkeley Software  Distribu-
tion,  Computer  Science  Division, Department of Electrical
Engineering and Computer Science University  of  California,
Berkeley, CA, August 1983.

_, DYNIX(R) V3.0.12 System Manuals,  Sequent  Computer  Sys-
tems, Inc., 1984.

Aho, Alfred V., Brian W. Kernighan, and Peter J. Weinberger,
The AWK Programming Language, Addison-Wesley Publishing Com-
pany, 1988.

Authors, Various, UNIX Security Mailing  List/Security  Dig-
est, December 1984 -.

Baldwin,  Robert  W.,  Crypt  Breakers  Workbench,   Usenet,
October 1986.

Baldwin, Robert W., Rule Based Analysis  of  Computer  Secu-
rity, Massachusetts Institute of Technology, June 1987.

Bauer, David S. and Michael E. Koblentz, NIDX - A  Real-Time
Intrusion Detection Expert System, Proceedings of the Summer
1988 USENIX Conference, Summer, 1988.

Bishop, Matt, Security Problems with the UNIX Operating Sys-
tem,  Department  of  Computer  Sciences, Purdue University,
January 31, 1983.

Bishop, Matt, How to Write a Setuid Program, April 18, 1985.

Denning, Dorothy, Cryptography and Data  Security,  Addison-
Wesley Publishing Company, Inc, 1983.

Duff, Tom, Viral Attacks On UNIX System  Security,  Proceed-
ings of the Winter 1988 USENIX Conference, Winter, 1988.

Fiedler, David and Bruce Hunter, UNIX System Administration,
Hayden Book Company, 1986.

Grampp, F. T. and R. H. Morris, "UNIX Operating System Secu-
rity,"  AT&T  Bell  Laboratories  Technical Journal, October
1984.

Kaplilow, Sharon A. and Mikhail Cherepov, "Quest -- A  Secu-
rity  Auditing Tool," AT&T Bell Laboratories Technical Jour-
nal, AT&T  Bell  Laboratories  Technical  Journal,  May/June
1988.

Morris, Robert and Ken Thompson, "Password Security : A Case
History," Communications of the ACM, November 1979.



                     February 19, 1991





                           - 15 -


Reed, Brian, "Reflections on Some Recent Widespread Computer
Break-ins,"  Communications  of the ACM, vol. Vol 30, No. 2,
February 1987.

Reed, J.A. and P.J. Weinberger, File Security and  the  UNIX
System  Crypt Command, Vol 63, No. 8, AT&T Bell Laboratories
Technical Journal, October 1984.

Smith, Kirk, Tales of  the  Damned,  UNIX  Review,  February
1988.

Spafford, Eugene H., The Internet Worm Program: An Analysis,
Purdue Technical Report CSD-TR-823, Nov 28, 1988.

Spafford, Eugene H., 1989.  Private Communications

Bruce Spence, spy: A  UNIX  File  System  Security  Monitor,
Workshop  Proceedings  of  the  Large  Installation  Systems
Administration III, September, 1988.

Stoll, Clifford, Stalking the Wily Hacker, Volume 31, Number
5, Communications of the ACM, May 1988.

Thompson, Ken, Reflections on  Trusting  Trust,  Volume  27,
Number 8, Communications of the ACM, August 1984.

Wood, Patrick and Stephen  Kochran,  UNIX  System  Security,
Hayden Books, 1986.

Wood, Patrick, A Loss of Innocence,  UNIX  Review,  February
1988.