From:	CSBVAX::CSBVAX::MRGATE::"SMTP::CRVAX.SRI.COM::RELAY-INFO-VAX" 24-DEC-1988 20:37
To:	MRGATE::"ARISIA::EVERHART"
Subj:	Re: Locking a terminal


Received: From KL.SRI.COM by CRVAX.SRI.COM with TCP; Fri, 23 DEC 88 22:41:11 PDT
Received: from ucbvax.Berkeley.EDU by KL.SRI.COM with TCP; Fri, 23 Dec 88 22:20:46 PST
Received: by ucbvax.Berkeley.EDU (5.61/1.33)
	id AA06078; Fri, 23 Dec 88 22:15:56 PST
Received: from USENET by ucbvax.Berkeley.EDU with netnews
	for info-vax@kl.sri.com (info-vax@kl.sri.com)
	(contact usenet@ucbvax.Berkeley.EDU if you have questions)
Date: 23 Dec 88 12:09:47 GMT
From: mcvax!unido!tub!tmpmbx!pengo@uunet.uu.net  (Hans H. Huebner)
Organization: netmbx GbR, Berlin, West Germany
Subject: Re: Locking a terminal
Message-Id: <1438@tmpmbx.UUCP>
References: <816@auvax.UUCP>
Sender: info-vax-request@kl.sri.com
To: info-vax@kl.sri.com

In article <816@auvax.UUCP> terryt@auvax.UUCP (Terry Tanski) writes:
>Here is a little command file which will, when executed, will lock
>your terminal until a correct password is typed. The only way to find
>out the password is to look at the command file. This can be prevented
>by modifing the access to the file.

>[...]
>$ INQUIRE PASS_WORD "Password "
>[...]

There is a major problem with the suggested procedure:  One should NEVER
use INQUIRE to request user input, unless the user has read access to the
procedure anyways.
Why not ?  Well, first off, user input to inquire is subject to
interpretation by DCL, i.e. the user can include variable references and
calls to lexical functions in the input line.

Example:

$ inquire a
A: 'f$time()'
$ show symbol a
  A = "23-DEC-1988 12:52:26.23"

It's trivial to set command procedure verification to ON using F$VERIFY and
look what the password is.

Secondly, user input read with INQUIRE will be stored in the DCL recall
buffer, which is not desireable as well.

Always use "READ/END=label/PROMPT=prompt SYS$COMMAND variable" instead of
inquire in command procedures you want to be hacker-proof.

This is my LOCK.COM, hope it's useful to someone:

$	old_ver = f$verify(0)
$	say := write sys$output
$	set nocontrol=(y,t)
$	set term/noecho
$	read/end=exit/prompt="Password: " sys$command pw1
$	say ""
$	read/end=exit/prompt="Again: " sys$command pw2
$	if pw1 .nes. pw2 then $ goto exit
$loop:
$	say ""
$	read/prompt="Lock password: "/end=loop sys$command try
$	if try .eqs. pw1 then $ goto exit
$	goto loop
$exit:
$	set control=(y,t)
$	set term/echo
$	if old_ver then $ set ver


	Merry XMas to all of you !
					Hans
-- 
Hans H. Huebner, netmbx     | PSIMail: PSI%026245300043100::PENGO
Woerther Str. 36            | DOMAIN:  pengo@tmpmbx.UUCP
D-1000 Berlin 20, W.Germany | Bang:    ..!{pyramid,unido}!tmpmbx!pengo
Phone: (+49 30) 262 93 01   | BITNET:  huebner@db0tui6

