Post #133,408
1/3/04 5:09:19 PM
|
Can you be logged in as two people at once?
With the two people having different access levels?
Without paying for an additional product like Windows Terminal Server that is.
This capability is central to how *nix works. You always have processes around who are logged in as different users with different privileges. You can even have many GUIs running.
Cheers,
Ben
"good ideas and bad code build communities, the other three combinations do not"
- [link|http://archives.real-time.com/pipermail/cocoon-devel/2000-October/003023.html|Stefano Mazzocchi]
|
Post #133,409
1/3/04 5:13:05 PM
|
Not log in, no.
But you can have multiple processes running under different user permissions at the same time.
Regards,
-scott anderson
"Welcome to Rivendell, Mr. Anderson..."
|
Post #133,418
1/3/04 7:33:08 PM
|
I'll tuck that away in case I ever need it
"good ideas and bad code build communities, the other three combinations do not"
- [link|http://archives.real-time.com/pipermail/cocoon-devel/2000-October/003023.html|Stefano Mazzocchi]
|
Post #133,428
1/3/04 8:10:23 PM
|
Yes you can and it is a weak security system
that allows it. If you can run CMD.EXE in the NT/2K/XP/2003 schedule program, it will be run as Admin access. Any program you open from that CLI will get run with Admin access inculding NET.EXE, horror of horrors!
Users can bypass the program install block by installing certain software to their Documents directory which has write access. A real secure system wouldn't even let them run the install program. Some programs check for Admin rights before installing, but some like OOo does not. It is up to the install program to check for access rights before installing.
If the user has access to the Notepad or Wordpad, they can give themselves access to almost anything. Usually by "Viewing Source" in IE, they get a Notepad program, even if their policies and rights disable it. All they do is clear out the HTML source and write in a batch file and save it somewhere writable, like their start menu or documents folder. Then click on it. Create a command to add CMD.EXE to the scheduler, and they can get Admin access or whatever the system runs those programs as.
Also IIS and other programs run as certain users and have a certain level of access that the logged in user may not have. So an ASP web page can be used to write to a file or database, when the user cannot, via IIS.
"Lady I only speak two languages, English and Bad English!" - Corbin Dallas "The Fifth Element"
|
Post #133,451
1/3/04 11:54:08 PM
|
Re: Yes you can and it is a weak security system
If you can run CMD.EXE in the NT/2K/XP/2003 schedule program, it will be run as Admin access. Wrong. The CMD.EXE process will be run as the user that started it, and security will work accordingly.
Peter
[link|http://www.debian.org|Shill For Hire]
[link|http://www.kuro5hin.org|There is no K5 Cabal]
[link|http://guildenstern.dyndns.org|Blog]
|
Post #133,510
1/4/04 12:10:45 PM
|
Certainly
Telnet Server is available
Terminal Server comes bundled with XP
Every service runs on an account different from the currently logged on user: either a special "system" account, or whatever the adminstrator chose.
Any process can start a subprocess as different user. API has full support for it, even though shell has none.
In any case, "paying for additional products" reflects price structure and marketing, not technology.
--
"It\ufffds possible to build a reasonably prosperous society that invests in its people, doesn\ufffdt invade its neighbors, opposes Israel and stands up to America. (Just look at France.)"
-- James Lileks
|
Post #133,517
1/4/04 12:57:05 PM
|
Re: Certainly
Exactly - Terminal server is an add-on to the base operating system, because the latter is not really a multi-user OS. Only one user in base NT has a "desktop" context. In order to have many desktops you have to change the OS in such a way that large parts of it are replicated for every user. And this is just the login context.
-drl
|
Post #133,576
1/4/04 8:35:49 PM
|
You keep hearing yourself, not me
NT can have arbitrary number of desktops, only one of them normally visible on a given console. All services run on an invisible desktop (I am not aware of any way to make that one visible). Terminal server gives you the ability to make invisible desktops visible. Another way to get an alternative desktop, I believe (I may be wrong here) is to hit ctrl-alt-del. The visual you see is actually a different desktop.
Also, you don't have to have a desktop to run a process, hence telnet server.
--
"It\ufffds possible to build a reasonably prosperous society that invests in its people, doesn\ufffdt invade its neighbors, opposes Israel and stands up to America. (Just look at France.)"
-- James Lileks
|
