Re: [44net] JNOS2 vulnerable to outside hack

Rob: The "@" command is the "sysop" command. In your autoexec.nos boot file add this command "mbox password somerealpasswordhere" This "mbox password ..." command then requires anyone issuing the sysop command to enter a password to gain sysop access. And also, the "@" sysop command is not just for anyone connecting via BPQ, but rather anyone at a bbs prompt wanting remote sysop access. This is documented in the JNOS manual. Here is a copy of that part of the manual. ---------------------------------------------------------------------------------- mbox password <newpassword> This sets a new remote sysop password. A remote sysop is a user whose entry in the ftpusers file has the SYSOP_CMD bit set. When a remote sysop enters the '@' command to the JNOS mailbox, and there is a non-null mbox password established, five random numbers are displayed. The remote sysop is expected to then transmit the letters corresponding to these numbers, taken as zero-relative positions in the password string. Several lines of five letters can be sent, only one of which need be correct. The last line sent must be empty, i.e., just a CR. If the response is correct, the remote sysop is then given the JNOS command-line prompt, and may issue most JNOS console commands. Commands which would require creation of a new session are disallowed. Use the "exit" command to exit from the JNOS command level. ------------------------------------------------------------------------------------ Per the notes, please make sure your users in the ftpusers file DO NOT HAVE THE SYSOP_CMD bit set. If you also set the password, then anyone trying to access can't get in without it. Bill At 04:51 AM 1/31/2015, you wrote: