Re: Age-old problem
The joys of poorly implemented password, and login processes!
Back in the late 90s, not long after starting my IT journey I was tasked with trying to hunt down a potential bug in some custom 'software' we were using. (Quotes, as it was mostly just shell scripts on an AIX UNIX box connected to a rack of diail-in modems (we were still a year or two away from starting using this new fangled thing called the Internet).
Anyway, it was a login process, using a simple username and a password, all over an old dial-up system, to download customer specific data. No encryption, no security of any sort really!
Somehow someone had noticed a certain user was accessing other customers data (they could see files being downloaded in the logs), and no one could figure out how. So I was asked to have a look, as I knew my way around shell scripts, and these had been written years earlier by someone long since retired.
I found out that the usernames were all assigned to customers, and they were all a simple 4 character ASCII, and uppercase only. e..g. ABCD
The customer data was all held in a directory structure that also matched this user ID, e.g. /path/path/abcd and files in there used the same ID in the name, e.g. abcd123456.csv which is how someone noticed files being downloaded by the wrong person. The issue was they couldn't figure out who the person was, they could see files being downloaded in the logs, but not which username was associated with the down-loader, as that field was blank!
I noticed on login the script would 'cd' into the users data directory, so for example an 'ls' would only show what was inside the abcd directory, but...
I found a few major issues:
1. The script did not check that the 'username' field being passed in, actually contained anything!
Plus worse still the 'test' the script did to see if they were a valid user, was to see if that user had a corresponding directory. i.e. If you log in as ABCD does /path/path/abcd exist? If not exit.
So passing nothing (e.g. "") would test for, and drop them into /path/path/!!
2. The login was not locked down in anyway, you could even use cd .. to move up the tree!
3. There was zero restrictions at the file system level, no assigning usernames to actual system users, the file and directory permissions were all set to full read for everyone!
So as this was the bad/good old days of 'just fix it', I added a null/empty check, and a 4 character length check for the username, and a 'chroot' to the script to lock users into just their own directory.
This was meant to be a tactical quick fix, whilst someone else would look at a more strategic solution, which of course never happened. The system chugged on like this for another 3 years or so, before it was replaced with something a bit more modern (it was already about 5 years at the time I joined the team).
I enjoyed the problem solving at lease :-)