RE: Disallowing RTVCMDSRC

[qsrvbas@xxxxxxxxxxxx (Tom Liotta)]

Rob:

RTVCMDSRC wouldn't be necessary to see the constants for profile and password; 
a simple DMPOBJ of the *CMD will print them out. However, maybe you don't need 
a command shell to hold these. Why not have your outer command-processing 
program be a CLLE rather than a CL? Go ahead and put your values into variables 
rather than as command parms in your outer command. Remove observability for 
more invisibility. Note that RTVCLSRC does not work on CLLE programs.

Try a DMPOBJ (and/or DMPSYSOBJ) on a CLLE version of the program to see what 
can be seen. I'm not sure where values are stored, but they're not immediately 
obvious. Perhaps in some associated/linked object.


midrange-l-request@xxxxxxxxxxxx wrote:

>We have a command that looks like the following:
<snip>
>
>Now we want to use this in CL programs.  However I didn't want to bury
>user id's and passwords in a program.  So I thought I'd be clever and
>create a second command that runs the same program.  Looks like this:
>Remote system or IP address  . .   GDIHQ
<snip>
>
>Notice, no user id and password?  That's done via this:
<snip>
>
>Due to the extremely weak security on our development machine, and the
>lack of permission to do anything about it, I kept the source off the
>system and thought I was being clever.  Well, the newest programmer, (who
>was working as an engineer at a different company before starting here and
>we just hired him as a programmer because he had the right aptitude and
>his brother and dad are good) figured out how to use RTVCMDSRC to
>decompile it.  (He wanted to change the size of the password and user id
>fields.)  Granted, even if I could figure out how to create this command
>so that RTVCMDSRC didn't work he'd figure it out (debug the CL program
>called - he told me this, dang these new guys are clever) I'd still like
>to do this if possible.  Is there some option on CRTCMD that would work?

-- 
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788 x313
Fax    253-872-7904
http://www.powertech.com


__________________________________________________________________
New! Unlimited Access from the Netscape Internet Service.
Beta test the new Netscape Internet Service for only $1.00 per month until 
3/1/04.
Sign up today at http://isp.netscape.com/register
Act now to get a personalized email address!

Netscape. Just the Net You Need.