Subscribe to Windows IT Pro
August 01, 1996 12:00 AM

Reader to Reader - August 1996

Windows IT Pro
InstantDoc ID #2618
Rating: (0)

NT Security and the Internet
I'm concerned about the numerous NT servers people are connecting to the Internet. The Administrator password and the NT FTP service are a combination that is a serious security hazard.

The FTP service lets all NT accounts transfer files from anywhere! NT Server NT File System (NTFS) is great, but the Administrator user is everywhere on the disk. The Administrator password can be a maximum of 14 characters--not a big problem to hack. So, because the Administrator has access to the whole server, a hacker who breaks the Administrator password has access to the whole computer, regardless of the super NTFS security.

My request for NT Server 4.0: Do not let the Administrator log on to an NT Server through FTP! This way, if a hacker breaks the password, the FTP server will not let the hacker enter the server (via FTP), and no damage will occur. If the hacker breaks another user's password, the potential damage isn't as bad because other users have limited access.

I want Microsoft to take this request seriously so I can continue to use NT with peace of mind. Right now, I'm very worried. Thanks very much. I appreciate your assistance.


Microsoft and Banyan
Your June Trip Stiles column reported the rumor that Microsoft was interested in buying Banyan. I've been in the Banyan world for many years, and my company is now shipping a product for NT. Here's what I think about the Microsoft/Banyan deal.

OK, so Cairo isn't shipping yet, and Microsoft is stuck with LAN Manager 3.0--oops, I mean NT Server 3.51. Jim Alchin promised StreetTalk IV for NT within two to three years. He guaranteed a gazillion features far better than those in StreetTalk III. Two years later, things aren't going too well. The project is just a little too ambitious.

Microsoft's remedy? Following the company's rule of thumb, Microsoft first tried to create the solution, LAN Manager. It failed, and one day somebody at Microsoft said, "Wait a minute. This thing can't do what we really want it to do."

Then someone said something like, "OK, guys. I know we can do this, but we're late and out of time. Who can we buy?"

The reply was, "Banyan. Ten bucks a share and 18 million shares outstanding. Offer $18 to $20, about $360 million cash."

For Microsoft, $360 million is petty cash. Banyan owns the large networking customers, so Microsoft would get StreetTalk and own the Fortune 500 networking world with a nice growing piece of the Internet.

Everybody wants NT. Every magazine says VINES is hard to install and other network OSs aren't. Of course, nobody mentions what the product does once it's up and running. And nobody cares that a VINES server can stay up for a year without a reboot, while NT Server usually can't even do a week.

Well, NT is what everybody will get, and they'll get to keep StreetTalk. NT has the fancy autodetection and underlying file and print, and Microsoft doesn't have to make any effort to provide the most powerful directory service to tie everything together. Now we're talking.


Big Bug in Service Pack 4
Service Pack 4 for Windows NT 3.51 has a big bug. We have a Compaq Proliant 4000 with dual Pentium 90-MHz processors. Service Pack 4 did the upgrade, but it did not recognize that the machine had two processors.

We called Microsoft, and the Microsoft engineer said that reports of this problem were coming in from around the country. The fix is to install NT 3.51 in a separate directory and copy files for the correct kernel and HAL files from Compaq SSD 1.17. Thought you'd like to know.


NT/Alpha Support
Contrary to popular belief, Intel is not the only platform that runs NT software. We're on a Digital Equipment Alpha AXP XL 266, and is it hot!

We continually confront the question of which products are available for Alpha and other RISC systems that run NT. Finding product marketing and support people who can answer NT/Alpha product compatibility and availability questions is often fruitless. Even Microsoft people are confused. What happened to Bill and Bob's (Gates and Palmer) grand pronouncements about Microsoft and Digital Equipment teamwork and coordinated releases across platforms?

We recently bought Microsoft's Visual C++ compiler. The box clearly said "Alpha AXP." The compiler indeed generated Alpha-bits, but would execute only on an Intel platform!

Do other readers join me in wanting Windows NT Magazine's help? I'd like to see more emphasis on non-Intel product information, including readiness, release dates, and availability. Perhaps this magazine can encourage vendors to provide Alpha/RISC-ready dates and availability with all product announcements, advertisements, press releases, etc.


[Editor's Note: All our software reviews include a box with a pointer to each applicable system type. We are committed to covering Alpha-based systems and software, so we run more non-Intel product reviews than any other PC-oriented magazine. We regularly include Alpha-based software listings on our Web site.]

[Editor's Note: Share your NT discoveries, comments, problems, and solutions and reach out to other Windows NT Magazine readers (including Microsoft). Email your contributions (under 400 words) to Karen Forster at karen@winntmag.com. Please include your phone number and a photo (.bmp) of yourself. We will edit submissions for style, grammar, and length. If we print your letter, you'll get a Windows NT Magazine t-shirt.]

Related Content:

ARTICLE TOOLS

Comments
  • Gary A. Hopp
    13 years ago
    Aug 13, 1999

    Raul Lozano's concerns for NT security and the Internet are well founded. We need to be concerned with NT security as a whole.
    For protection, you can rename the Administrator account, which will not change the internal SID or other rights assigned to the account. Because every NT system has an individual SAM, you must rename the account in the domain SAM and in each NT server and workstation.
    For the domain SAM, log on to the domain as Administrator from any system, and rename the account from the User Manager for Domains tool. For all other NT servers and workstations, log on to each system as the local Administrator, and rename the account in the local SAM. While you're making these changes, disable the Guest account.

    --Gary A. Hopp, MCSE

  • Sean Lincolne
    13 years ago
    Aug 13, 1999

    I wonder whether you can work around the problem Raul Lozano mentions by setting up another Administrator account with some unguessable user ID. Then you can disable the Administrator ID or make it a weak user with negligible rights so you can track an intrusion.
    A major weakness of NT is the 14-character password limit. Microsoft needs to think seriously about addressing it. After all, we have long path names and long usernames, so why not long passwords?

    --Sean Lincolne,

    Australian Fisheries

    Management Authority

  • Keith Hageman
    13 years ago
    Aug 13, 1999

    In your August Reader to Reader, “NT Security and the Internet,” Raul Lozano expresses concern about someone hacking into a system through NT's FTP service with the Administrator password. I'd like to suggest two solutions: changing the name of the Administrator account and adding a new Administrator account with a secure password.

    --Keith Hageman




    Thanks, Keith. Apparently, great minds work alike. You'll see that Mike Reilly makes the same suggestions in his article, “Find Holes in Your NT Security,” on page 87. That article includes a list of publications that will be helpful to anyone interested in security, and this month's entire issue of Windows NT Magazine is devoted to that topic. Also, see the following letters.

    --Karen Forster

  • Thore Clausen
    13 years ago
    Aug 13, 1999

    I’d like to respond to Raul Lozano’s Reader to Reader piece. First, a 14-character, case-sensitive password that includes numbers and symbols has more combinations than I will bother to calculate. Second, change the name of the Administrator account to something less obvious, and a hacker has very little chance of breaking in. If these steps are too much for administrators, they deserve to be hacked or even fired.
    Security is up to the Admin/User. With so many viruses, hackers, and other disasters that we all know can and will happen, laziness in protecting data is inexcusable. Every day, I work with users whose passwords are too simple, who never back up their data, and who will download anything from the Web. You can’t complain about the cows running away when you leave the gate open.

    --Thore Clausen

  • Shawn M. Smith
    13 years ago
    Aug 13, 1999

    I have a comment about Raul Lozano’s August Reader to Reader item, “NT Security and the Internet.” I’m amazed that anyone leaves the Administrator account named “Administrator.” He complains about nonsecure FTP servers but misses one important fact: You can and should rename the Administrator account. Furthermore, if a user hacks the Administrator password, the FTP service is the least of your problems.

    --Shawn M. Smith

You must log on before posting a comment.

Are you a new visitor? Register Here

advertisement

advertisement

Windows is a trademark of the Microsoft group of companies. Windows IT Pro is used by Penton Media Inc. under license from owner.