Re: auditing commands

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

"Graziano, Marie" wrote:

> First of All is the users tagged as Limited Users.  Then only the commands
> you specify to allow Limited users will be available to them.

Actually, there are lot's of ways for Limited Capability Users to enter
commands... just don't use the command line.  DDM, Client access, FTP (prior to
V4R2) all allow limited capability users to enter commnds.   And any one of 
those
could allow a limited capability user to create a command and program that 
allows
a user to execute otherwise restricted commands.

The limited capability flag is usefull, but it barely protects anymore.

jte



--
John Earl                    johnearl@400security.com
The PowerTech Group          206-575-0711
PowerLock Network Security   www.400security.com
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---