Member Discussions

How secure is a Mu? How often will we have to worry about attempts to crack our server? What sort of security measures can we take to prevent staff accounts from being taken?

How secure is a Mu?

That depends entirely on the specific MUD server you're using. I wouldn't trust most Diku-derived codebases, as they typically handle strings in very stupid and unsafe ways. Interpretive environments like MOO or ColdC are a much safer bet.

How often will we have to worry about attempts to crack our server?

I can't really say. It depends on the sort of users you attract.

What sort of security measures can we take to prevent staff accounts from being taken?

It's really the same as any other account (e.g. on a website), but I should note that many mudlibs have quite simplistic security models, often granting numerous privileges based on level or flag bits, with no granularity. This is even worse when similar logic is extended not only to players, but to objects; in some systems, objects can even inherit the permission bits of their owner, creating a security headache of epic proportions. Servers to watch out for include the MUSHes, MUCKs and other relatives.

Backups backups backups!

use CVS or RCS!

RSA can be cracked! Sometimes quite easily- require
non-dictionary word passwords that are alpha-numeric
mixes! (more on this: www.attrition.org)

Do not use email to correspond when giving out passwords,
do it over the phone (where the FEDs are probably the only
ones listening)

If you do use email, encrypt the password in a file (word
doc w/ password).



(Comment added by m_m on Sun Aug 14 10:35:17 2005)

RSA is the unix standard password (authentication) and
encryption platform, copyrighted in 1993, which has been
served patents and licensing for operating systems
worldwide, supplied jointly by the DOC and the NSA.

From the RSA / Cryptosystems FAQ:

2 RSA

2.1 What is RSA?

RSA is a public-key cryptosystem for both encryption and
authentication; it was invented in 1977 by Ron Rivest, Adi
Shamir, and Leonard Adleman [74]. It works as follows:
take two large primes, p and q, and find their
product n = pq; n is called the modulus. Choose a number,
e, less than n and relatively prime to (p-1)(q-1), and
find its inverse, d, mod (p-1)(q-1),
which means that ed = 1 mod (p-1)(q-1); e and d are called
the public and private exponents, respectively. The public
key is the pair (n,e); the private key is d. The factors p
and q must be kept secret, or destroyed.

It is difficult (presumably) to obtain the private key d
from the public key (n,e). If one could factor n into p
and q, however, then one could obtain the private key d.
Thus the entire security of RSA is predicated
on the assumption that factoring is difficult; an easy
factoring method would ``break'' RSA (see Questions 2.5
and 4.4).

Here is how RSA can be used for privacy and authentication
(in practice, actual use is slightly different; see
Questions 2.12 and 2.13):

RSA privacy (encryption): suppose Alice wants to send a
private message, m, to Bob. Alice creates the ciphertext c
by exponentiating: c = m^e mod n, where e and n are Bob's
public key. To decrypt, Bob also exponentiates: m = c^d
mod n, and recovers the original message m; the
relationship between e and d ensures that Bob correctly
recovers m. Since only Bob knows d, only Bob can decrypt.

RSA authentication: suppose Alice wants to send a signed
document m to Bob. Alice creates a digital signature s by
exponentiating: s = m^d mod n, where d and n belong to
Alice's key pair. She sends s and m to Bob. To verify the
signature, Bob exponentiates and checks that the message m
is recovered: m = s^e mod n, where e and n belong to
Alice's public key.

Thus encryption and authentication take place without any
sharing of private keys: each person uses only other
people's public keys and his or her own private key.
Anyone can send an encrypted message or verify a signed
message, using only public keys, but only someone in
possession of the correct private key can decrypt or sign
a message.


(Comment added by m_m on Sun Aug 14 10:47:17 2005)

Sorry, the copyrighted in 1993 thing refers actually to
the document, RSA FAQ, and not to RSA itself which was
patented in 1983.