The password is secure, really!

This was during my time as a (sort-of) network administrator of a students' dormitory. The network hardware was owned by the students with a symmetrical Gbit uplink to the university's network.

Our job entailed all kinds of jobs: Being the go-to guy for all kinds of computer issues, user administration (signing up and removing accounts), hardware maintenance, network security and copyright watchdogs (because we'd get at least one letter per month of some movie company or other and the university threatened to cut us off if we didn't police our students regarding that matter).

However, as we were self-administrated (the students owned the hardware) we had some leeway as how to go about it. Here are some of the highlights of those years:

**The clueless admin**

At some point during my studies, the powers-that-be at the university decided that we'd need to switch to a unified user account system for all the dorms. At that point, we already had some experience with the university's admin and thus were leery of giving him root access to our router to install his scripts.

Instead, we asked him if he could show us his scripts and simply give us access to the database so that we could use our working system to create a two-way sync with his system.

And it was a good thing we demanded that. The PHP code he gave us was littered with stuff life *dofunction()*, *doFunction2()* and *dofnuction()*, included a hardcoded root-password and, to top it off, a

require("http://"+$["GET"]);

at the top of the code with *allow_url_include* set to "on" in his php.ini. And the PHP script ran with root rights. **And** this script was installed on quite a lot of our dormitories' servers.

The reasoning was that he didn't want to update every server every time he changed some function so he installed the script which then proceeded to get a remote PHP function.

Which meant that if you knew about this script (only 60 people changing averagely on a two-year basis), you could create quite a lot of havoc on the servers.

That was the script. The database didn't look any better. The guy obviously had never heard of stuff like "normalization" or "foreign keys" which meant that all data resided in one huge table (every user was allowed to have several connected devices). To top it off, he had **two** id columns. One called "id" which he never used but was auto_increment. The other one called "uid" (for "unique id") he did use but was neither set unique nor auto_increment.

His routine for adding a new user thusly included a "SELECT uid FROM users ORDER BY uid DESC LIMIT 1" and a following INSERT with the returned uid incremented by one. You can guess what happened if two users were to sign up at the same time.

**Wake up call**

My "consulting hours" were from 10am to 8pm if I was actually in the dormitory.However, some users were not content with those hours. Some rang the bell at 3am on a sunday morning. Or didn't seem even a little bit fazed by the fact that I was just carrying a hot pizza into my room (yes, of course, I'm not really paid for this stuff but I'm willing to let cool my lunch because you can't be arsed to figure out where the on-switch is on your laptop (yes, the role was voluntary))

Sometimes I forgot to lock the door to my room. Which meant that I discovered that some foreign countries have a weird notion of what a closed door means: It's anm invitation to enter at any time!

Seriously, once I woke up at 6am only to see a Chinese guy standing in the open door. When I looked at him with bleary eyes from my bed, he obviously interpreted my stunned expression as an invitation of sorts, entered my room completely and closed the door.

Needless to say, I was not amused and promptly woke the rest of the floor (I was a drill sergeant in a former life).

**Was nicht passt, wird passend gemacht**

Then it's the little things. So, there you have this little box on the wall with some connectors and you desperately want to get your internet. And you know that the cable that you just put in your laptop delievered this very internet at *your previous location*.

But it doesn't quite fit. So you take a hammer and give it a good whoppin' and Bob's your uncle. Well, almost.

The user in question previously accessed the internet through his modem and an analog telephone line. Which required an RJ11 jack (the connector is almost square like). Ethernet required RJ45 (which is **not** a square).