just finished a script that should be used by our hotline-agents... (will reinitialize the pcANYWHERE host Service on Comps in the Environment to (re-)enable our agents gain access to them)....
Script is called by a batchfile (Shortcut on Agents Desktop(NT4 with NTFS))

The Kixscript called by this batch asks the Agent for Workstationname where to reinitialize the Service and READS a FILE called 000.txt where the SuperAdminPassword
is in. (thats the Security hole)

Afterwards it calls another cmd where Domainname is determined ,ipc$ is mapped
(second Security Hole) and the Service is manipulated..... second cmd exits back to KixScript ; Kix exits back to origin batch which is paused in order to give agents the possibility to see results....

My Problem now is:

• to secure the pwd-file against access of agents but allow kix to read it.....
  
• prevent Agents to pause the 2nd cmd file by pressing ctrl-c while ipc$ is mapped..
  

any clue anyone ???

Thanks Jochen

_________________________

I'll throw out the following ideas just to get the juices flowing ...

In regards to your first point (the admin password).

First - put all your hotline agents into a domain group called "HOTLINE-AGENTS" ( if they aren't already )

Then, instead of using a file (hidden or otherwise) to host the administrator password, query the password remotely from an HKLM key/value pair located on a
centralized server somewhere, example...

$password = readvalue ( "\\SERVER\HKEY_LOCAL_MACHINE\SOFTWARE\JOCHEN","PASSWORD")

Then set the registry key permissions on the server to "HOTLINE-AGENTS" "Read"

Lock it up good - Get it into the state where no one but you and the agents can view/query it.

Then, as part of Windows NT policies or through the logon script - disable the Windows registry editing tools on the workstation for everyone in group "HOTLINE-AGENTS". At least, this way, the admin password won't be in a plain text file that is just a double-click away. They won't be able to use regedit or regedt32 either.

Now they'll have to do it programatically through a reskit utility or with some custom script/code. You'll can also enable registry auditing on this key so that you can track remote access from the server. This also gives you one-stop shopping when you have to change the admin password !

Maybe instead of using a registry key, you might create an admin share and use a hidden file ?

Or the other thought I had was that if you're HOT-LINE agents has "right-click" disabled on their desktop - bury the admin password in the shortcut as a parameter to your batch script. Without right-click, they won't be able to look at the shortcut properties.

The only other thing I can suggest is to invent some sort of custom KiX encryption algorithm (anyone?) or maybe look into elavating the domain privilege of HOTLINE-AGENTS to the point where they can start/stop remote services (?!?).

All of these ideas are not the absolute secure solution your looking for !

Have you had any other thoughts or brain-storms on this matter ?

Shawn.

Yep they are in a Global Group..... but i can't hide it the way You supposed .....Nice try ... sounds good ... but ids not eligible for our environment.....

thought about the NTreskit utility SU.exe
to run the shortcut with another user that has access on both script and pwd files ....
hiding the folder hirarchy and files (Super Script User)..... hmmm

a Kix level encryption would be valuable but
we all don't have too much spare time.....

Cheers Jochen and thx for reply
(i'll let all know if i finally have the perfect solution)

jochen.polster@gmx.net

_________________________