Conference iosg::all-in-1_v30

    
    If they have bypass and/or sysprv they always could read anything
    they wanted, they simply had to set default to the VMS directory
    then type the files. 
    
    If you can't trust the user, take away the privs, or as Graham put
    it in another note, use the "salary continuation method" (sorry
    if I misquoted you Graham)
    
    --Bob
    

       And in V2.4 the equivalent functionality was called "NEWDIR"!!
       
       Cheers
       
       Stuart

    re:.1
    
      I believe that is what I said in .0. 
    
       And I agree 100%. If you don't trust the user.... It's one of those
     customers that (I am customer I am right attitude).
    
    t.y.

Sounds like a wonderful opportunity to sell some consultancy to customise
the DRM forms to do extra checking. If written well then maybe the code
could be made into an ASSET!

Of course, it would be the *System Manager* who makes this code live,
but surely you can trust him/her ;-)

Or maybe if this is a security concious site, maybe you want to re-classify
the System Management role into an Administrator role and disable interactive
access to the ALLIN1 account?

mb

    While all this is true, thre's no doubt that DRM makes it easier for a
    not very skilled manager to see other users' documents.
    
    It does sound as though it might be worth customising DRM, as .4
    suggests. But the customer _must_ be made aware that this would merely
    make it more difficult for the manager to see other users' stuff; it
    would _not_ make it impossible. (Otherwise we could get into trouble
    later).
    
    Dave.

    I've taken on Ricardo's call, and had a long chat with the customer.
    I think we've both been rationalizing "our views" on this and are
    coming from two opposite directions,
    
    My view (with the help of the previous replies here)
    - VMS and most things layered on it are not secure from a 
      privileged user. 
    - As long as the user has sysprv, bypass reading "private" material
      within ALL-IN-1 has always been possible. Newdir in V2.3,V2.4 or
      with DRM in V3.0. 
    - one should not give unsophisticated or untrustworthy user these privs.
    - V3.0 CM has been expanded such that many many applications can be
      developed within the A1 platform, and within its "privilege
      jurisdiction" so that there is little need for these kind of 
      powerful "blanket" vms privs.
    
    Customer's View:
    - VMS privileges granted to users who are working on applications
      totally outside of ALL-IN-1, but need to have access to 
      ALL-IN-1 for communication purposes.
    - Because of DRM it is EASIER for a less-sophisticated user (with
      those privs) to select and read another's mail.
    - Customer's management now has the impression of a less secure
      ALL-IN-1 system than they first imagined it would be.
    - Why was this "security hole" not specifically mentioned in
      the documentation.
    - customer is surprised that this was not brought up by more of 
      the customer base.
    
    Bottom line; he would like someone (read: someone to be an
    official Digital Voice on this) to write up something about 
    this so that he can make his management understand our point 
    of view on this.
    
    Volunteers? 8-)
    
    Monica

>            <<< Note 2794.6 by KAOFS::M_BARNEY "Formerly Ms.Fett" >>>
>                                 -< an update >-

>    Customer's View:
>    - VMS privileges granted to users who are working on applications
>      totally outside of ALL-IN-1, but need to have access to 
>      ALL-IN-1 for communication purposes.

The way we've approached this on our (internal Digital) system, is that people 
who need privileged accounts have 2 accounts. Possibly your customer could do 
something similar - users could then have ALL-IN-1 access only from their 
unprivileged account.

>    - Why was this "security hole" not specifically mentioned in
>      the documentation.

Historically, we've always tried to avoid documenting 'security holes'!! But 
yes, perhaps users could have been warned about possible surprises.

grahame

    I made the suggestion to him of 2 accounts (he liked that
    one) and we decided that an SPR would be appropriate.
    
    Monica

    Don't miss TR's discussion of this on p. 121 of "Managing and
    Programming in V3.0."