3 ms·

Alright, did I tell my college sysadmin story already? This is the perfect place to drop it. 1990, freshman in college, Pascal class on AT&T Unix SVR3 3B2 clus

Alright, did I tell my college sysadmin story already? This is the perfect place to drop it. 1990, freshman in college, Pascal class on AT&T Unix SVR3 3B2 cluster named "earth", "wind", and "fire". We'd just learned our way around "vi" and how to "uvapc" our Pascal source into a.out. I discovered anonymous ftp, and "make", and I quickly rose to become the gaming king of Pascal class. I had ularn, nethack, megs and megs of games crammed in my no-quota $HOME, and I'd opened permissions for everyone else to access and play them. I often chit-chatted with a classmate or two over "write" or "ytalk". Not content to merely play games, I became mischievous with the system and its inner workings. I created a .profile and a .plan, the latter of which used VT100 cursor escape sequences to self-modify the screen, such as changing my $HOME to "/" and I also made a boastful comment about having root access. It was all in good fun, and then came the day that I discovered /etc/passwd and I attempted to "su" to every single system account I found listed. I mean some of their passwords were just "*" so they must've been wide open!!1 I soon received ominous, chilling email from the unseen sysadmin of the whole cluster. He described to me everything I'd done up to this point, and he informed me that saying I have root access is like telling airport officials that I have a bomb. That point definitely drove it home to me as a young and dumb hacker. So, for the rest of my short college career, while I did some silly "extra-curricular" things with my own compute resources, I was careful to not try and break system security, or even say that I had, for fear of the wrath of the unseen sysadmin.

Aeolun 4y ago
So did you have root access? I can’t figure out if you attempt to su all the system accounts worked or not.
- judge2020 4y ago
  Nowadays /etc/passwd is world-readable and passwords are in /etc/shadow but perhaps /etc/passwd used to store the hashed passwords as well.
  - NoZebra120vClip 4y ago
    I, of course, did not have root access or any access that I shouldn't have had. /etc/passwd indeed stored the hashes in SVR3, and there was no such thing as /etc/shadow. I was naive enough not to understand hashes, and so I figured that those jumbled letters in the file had to be the actual passwords, and if "*" was in an entry then "*" was, of course, the password! Why didn't it work?!!?
    - tokamak-teapot 4y ago
      If you read the source of ‘cat’ and ‘more’ you’ll see that if they are reading /etc/passwd they replace the passwords of system users with ‘*’, unless you are uid 0. When ‘less’ was created, there was a bug where when you scrolled upwards the passwords would be revealed, so it was decided that the passwords should be replaced with actual asterisks and stored in individual files per-user. For security, these files were given access rights only for the owning user, and immediately deleted, with an encoded copy of their inode number being stored in /etc/shadow. Fun fact: forced password changes were initially introduced when disks were getting full and deleted inodes of user password files were due to be overwritten. “For security reasons” was correct but misinterpreted.
      - MayeulC 4y ago
        > If you read the source of ‘cat’ and ‘more’ you’ll see that if they are reading /etc/passwd they replace the passwords of system users with ‘*’, unless you are uid 0. That sounds so wrong, anything from a user-written program, `ed`, etc to a symlink/hardlink could read the password.
        NoZebra120vClip 4y ago
        Sounds wrong because it is wrong, pure unadulterated intentional B.S.; don't know why the commenter decided to yank our chains like this. I believe there is a meme in chat rooms where trolls get unsuspecting users to reveal their passwords by convincing them that the chat replaces it with "***" and so forth. Perhaps the GP is riffing on this.
ww520 4y ago
Schools are supposed to be the place where students can break things and break rules. It's part of the education.
- notatoad 4y ago
  learning that if you get caught you're going to be held accountable for your actions is also part of the education. it's not as if they executed OP. telling a kid to stop screwing around is pretty reasonable.
  - fy20 4y ago
    During college in the mid 2000s I discovered that the network share with all corporate data was accessible (read only) to everyone. The only way it was not immediately obvious was because only sub folders were assigned a drive letter, and the network share was hidden in the UI. I found a way around that in the Windows open dialog and then was able to trigger Explorer to the top level directory. The share also contained private data of applicants (names, addresses, date of birth, education history) which was most concerning to us. With some friends we wrote a document showing what we found (not explaining how to do it) and posted it to an internal message board. We also sent copies via email to our IT teacher, sysadmin and the principle. Shortly after the sysadmin invited us for a chat and basically told us not to do that again. A couple of hours later we were invited to the principles office. The principle was away at the time, but the vice principle - who wanted to make a name for himself - immediately suspended us all and said he'd discuss it with the principle but said most likely we would be expelled, and they may need to involve the police. Our main concern in the post we made was that personal data was effectively publically accessible (to anyone who connects to ethernet - you didn't even need to log in). Even before GDPR, our country had very strong data protection laws which this would have breached. A few days later a parent sent a letter to the principle, effectively restating what we said, with added threats of reporting them for violating data protection of minors. Strangely after that the issue was dropped and we were allowed back...
    - Fnoord 4y ago
devenvdev 4y ago
My similar story: I wrote a script that tries all the words from a spellchecker I found as passwords for each user (a really naive dictionary attack). The angry admin did came as apparently each wrong attempt generated a beep on some station in their room (these were dos times iirc and the admins were just high school kids).
squeaky-clean 4y ago
> AT&T Unix SVR3 3B2 cluster named "earth", "wind", and "fire". Not related to sudo, but this brought back a memory of the cluster I had access to during my college internship. 6 computers, I don't remember what kind or vendor. Named after the starter Pokemon for generations 1 & 2. They were in the rear of the room behind a cage I did not have a key for. One day a sysadmin came into the room asking "Uhhh... I'm looking for a... totodile?" The way he pronounced totodile made it clear he had no idea what a pokemon was. He had to remove it and replace something, didn't really give us any details. A few days later he brought the server back and hooked it back up to the cluster. The very first thing we did was rename it to Croconaw. (The evolved form of Totodile).

Aeolun 4y ago

So did you have root access? I can’t figure out if you attempt to su all the system accounts worked or not.

judge2020 4y ago
Nowadays /etc/passwd is world-readable and passwords are in /etc/shadow but perhaps /etc/passwd used to store the hashed passwords as well.
- NoZebra120vClip 4y ago
  I, of course, did not have root access or any access that I shouldn't have had. /etc/passwd indeed stored the hashes in SVR3, and there was no such thing as /etc/shadow. I was naive enough not to understand hashes, and so I figured that those jumbled letters in the file had to be the actual passwords, and if "*" was in an entry then "*" was, of course, the password! Why didn't it work?!!?
  - tokamak-teapot 4y ago
    If you read the source of ‘cat’ and ‘more’ you’ll see that if they are reading /etc/passwd they replace the passwords of system users with ‘*’, unless you are uid 0. When ‘less’ was created, there was a bug where when you scrolled upwards the passwords would be revealed, so it was decided that the passwords should be replaced with actual asterisks and stored in individual files per-user. For security, these files were given access rights only for the owning user, and immediately deleted, with an encoded copy of their inode number being stored in /etc/shadow. Fun fact: forced password changes were initially introduced when disks were getting full and deleted inodes of user password files were due to be overwritten. “For security reasons” was correct but misinterpreted.
    - MayeulC 4y ago
      > If you read the source of ‘cat’ and ‘more’ you’ll see that if they are reading /etc/passwd they replace the passwords of system users with ‘*’, unless you are uid 0. That sounds so wrong, anything from a user-written program, `ed`, etc to a symlink/hardlink could read the password.
      - NoZebra120vClip 4y ago
        Sounds wrong because it is wrong, pure unadulterated intentional B.S.; don't know why the commenter decided to yank our chains like this. I believe there is a meme in chat rooms where trolls get unsuspecting users to reveal their passwords by convincing them that the chat replaces it with "***" and so forth. Perhaps the GP is riffing on this.

ww520 4y ago

Schools are supposed to be the place where students can break things and break rules. It's part of the education.

notatoad 4y ago
learning that if you get caught you're going to be held accountable for your actions is also part of the education. it's not as if they executed OP. telling a kid to stop screwing around is pretty reasonable.
- fy20 4y ago
  During college in the mid 2000s I discovered that the network share with all corporate data was accessible (read only) to everyone. The only way it was not immediately obvious was because only sub folders were assigned a drive letter, and the network share was hidden in the UI. I found a way around that in the Windows open dialog and then was able to trigger Explorer to the top level directory. The share also contained private data of applicants (names, addresses, date of birth, education history) which was most concerning to us. With some friends we wrote a document showing what we found (not explaining how to do it) and posted it to an internal message board. We also sent copies via email to our IT teacher, sysadmin and the principle. Shortly after the sysadmin invited us for a chat and basically told us not to do that again. A couple of hours later we were invited to the principles office. The principle was away at the time, but the vice principle - who wanted to make a name for himself - immediately suspended us all and said he'd discuss it with the principle but said most likely we would be expelled, and they may need to involve the police. Our main concern in the post we made was that personal data was effectively publically accessible (to anyone who connects to ethernet - you didn't even need to log in). Even before GDPR, our country had very strong data protection laws which this would have breached. A few days later a parent sent a letter to the principle, effectively restating what we said, with added threats of reporting them for violating data protection of minors. Strangely after that the issue was dropped and we were allowed back...
  - Fnoord 4y ago

devenvdev 4y ago

My similar story: I wrote a script that tries all the words from a spellchecker I found as passwords for each user (a really naive dictionary attack). The angry admin did came as apparently each wrong attempt generated a beep on some station in their room (these were dos times iirc and the admins were just high school kids).

squeaky-clean 4y ago

> AT&T Unix SVR3 3B2 cluster named "earth", "wind", and "fire". Not related to sudo, but this brought back a memory of the cluster I had access to during my college internship. 6 computers, I don't remember what kind or vendor. Named after the starter Pokemon for generations 1 & 2. They were in the rear of the room behind a cage I did not have a key for. One day a sysadmin came into the room asking "Uhhh... I'm looking for a... totodile?" The way he pronounced totodile made it clear he had no idea what a pokemon was. He had to remove it and replace something, didn't really give us any details. A few days later he brought the server back and hooked it back up to the cluster. The very first thing we did was rename it to Croconaw. (The evolved form of Totodile).