Password security is IMPORTANT!

[Ironclad Alibi]

Why stop there? Why not stash the key to the front door of the building under the doormat?

Who told you it was there? It's a secret!

[underemployeed]

Why stop there? Why not stash the key to the front door of the building under the doormat?

I'm sure it is already there, the IT person will probably just recommend that a sign is installed at eye level stating that the key is under the mat.

Just ran into this situation, for IT contractor I been doing stuff for I just got access to do their dell certs, I can already access another guys account because they want a specific password used, basically one that if your on their facebook you have all the required information to follow the scheme of InfoXInfoYInfoZ..... and they requested I mail them the username and password..... of Course, they have all my info too, so one would think I wouldn't need to send more than username and have them generate my password.

[Eric the Grey]

I talked to a guy once who took over a small shop that the previous admin (who had quite in a snit of some sort) set everybody's password on their AS/400 and prevented them from ever changing it. He knew what they all were, but apparently only kept them in his head.

When the guy took over, he had to have IBM help recover the sysadm (think root) passwords, and then he implemented new password rules, forcing everybody to change their passwords and keep them changed every 30 days.

He apparently only stayed for a few months before the top brass decided they didn't like his new rules and fired him. Don't know if they ever found anyone to do things different or not.


Eric the Grey

[Racket_Man]

When the guy took over, he had to have IBM help recover the sysadm (think root) passwords, and then he implemented new password rules, forcing everybody to change their passwords and keep them changed every 30 days.

most likely the user account would have been QSECOFC. If I remember correctly that IS the GOD account on an AS/400.

[draggar]

You don't need external access, just one disgruntled employee or one who needs some $$$.

[Eric the Grey]

most likely the user account would have been QSECOFC. If I remember correctly that IS the GOD account on an AS/400.

Yes, you are correct. I wasn't thinking right.


Eric the Grey

[EricKei]

Could be worse -- at the accounting place (where I was web dude and semi-computer guy -- anything dealing with the server, we called our Network Guy), we had a cheap wooden cabinet on the wall next to the server room door. This was inside the server/storage/file room, which of course did not seem to have a properly functioning A/C vent. When it did rained heavily, it tended to drip water down within scant inches of said server. On weekends, there was no A/C ventilation at all in there, due to the *building's* A/c setup. Anyhoo, where was I? Oh yes, the cabinet. It was on the wall inside the server room door. Cabinet lacked a lock of any kind. What it DID have was a little scrap of paper with the server/domain's master login name (3 guesses what it was....starts with an 'A') and password on it, where anyone who walked into the server room could easily see it. Boss made sure to have said password used on as many programs as possible within the server to make it easier to remember. Those that did not use this password invariably used his Windows logon password.

Note that the server itself was a rackmount unit...sans rack...sitting on a piece of plywood, cooled only by two desk fans and 2 or 3 little 3-inch personal fans all pointed at various parts of its anatomy. I refused to touch it physically, aside from powering it on when we needed to reboot the t1/TerminalServer (note: Server machine, singular, not plural. Housed Small Business Server, Exchange, TS, et al, all on one machine; the setup was so arcane that rebooting any given component usually required rebooting EVERYTHING, including the server, the VIOP system, and the t1. Best case scenario: 20 minutes' downtime (no network nor internet), 5 minutes of which without phones. Naturally, this had been setup on the cheap (thanks to the boss trying to save money) about 3 "Network dudes" back. I can only assume that our little company had a reputation, as it was hard to get people to service our net at times)