Local Access Manual
 Contents Local Access Manual

This manual covers the following topics:

 Introduction

 Installation and Registration

 User Management

 Local Access Utilities

 Appendixes

License Agreement/Warranty

Ordering Information

 Software

October 1994


Local Access Manual
 Contents Local Access Manual

This manual covers the following topics:

 Introduction

 What is Local Access?

 Basics of Practical System Security

 Logging On and Off

 Access to Programs and Program Groups

 System Shutdown

 If You have Questions or Remarks

 Installation and Registration

 User Management

 Local Access Utilities

 Appendixes

License Agreement/Warranty

Ordering Information

 Software

October 1994


Local Access Manual
 Contents Local Access Manual

This manual covers the following topics:

 Introduction

 Installation and Registration

 System Requirements

 Installation and Registration

 De-installation

 Manual Fine-Tuning

 User Management

 Local Access Utilities

 Appendixes

License Agreement/Warranty

Ordering Information

 Software

October 1994


Local Access Manual
 Contents Local Access Manual

This manual covers the following topics:

 Introduction

 Installation and Registration

 User Management

 User Manager

 Users and User Groups

 The Definition of Users

 Modification of Users and Groups

 Managing User Files

 Logon Options

 Local Access Utilities

 Appendixes

License Agreement/Warranty

Ordering Information

 Software

October 1994


Local Access Manual
 Contents Local Access Manual

This manual covers the following topics:

 Introduction

 Installation and Registration

 User Management

 Local Access Utilities

 Screen Saver

 Who Am I?

 Appendixes

License Agreement/Warranty

Ordering Information

 Software

October 1994


Local Access Manual
 Contents Local Access Manual

This manual covers the following topics:

 Introduction

 Installation and Registration

 User Management

 Local Access Utilities

 Appendixes

 Password Security

 Common Problems and Solutions

 Keys in LALOGON.INI

 Version History

 Acknowledgements

 List of Installed Files

License Agreement/Warranty

Ordering Information

 Software

October 1994


Copyright/License Agreement/Warranty
Copyright/License/Warranty

For ordering information, see the section Ordering Information.

Local Access Copyright  1993-1994 by M2w Software and Mart van Ineveld - All rights reserved.

License Agreement and Warranty Disclaimer

You should carefully read the following terms and conditions before using this software.  Use of this software indicates your acceptance of these terms and conditions.  If you do not agree with them, do not use the software.

Unregistered version

You are hereby licensed to: use the Unregistered Version of the software for a three week evaluation period; make as many copies of the Unregistered version of this software and documentation as you wish; give exact copies of the original Unregistered version to anyone; and distribute the Unregistered version of the software and documentation in its unmodified form via electronic means.  There is no charge for any of the above.

You are specifically prohibited from charging, or requesting donations, for any such copies, however made; and from distributing the software and/or documentation with other products (commercial or otherwise) without prior written permission,.

Unregistered use of Local Access after the three week evaluation period is in violation of copyright laws.

Evaluation and Registration

This is not free software.  This license allows you to use this software for evaluation purposes without charge for a period of three weeks.  If you use this software after this evaluation period a registration fee is required as described in the Ordering Information section.

One registered copy of Local Access may be dedicated to a single person who uses the software on one computer, or to a single workstation used by multiple people.

You may access the registered version of Local Access through a network, provided that you have obtained individual licenses for the software covering all workstations that will access the software through the network.

Governing Law

This agreement shall be governed by the laws of the European Community.

Disclaimer of Warranty

This software and the accompanying files are sold "as is" and without warranties as to performance of merchantability or any other warranties whether expressed or implied. Because of the various hardware and software environments into which Local Access may be put, no warranty of fitness for a particular purpose is offered.

Good data processing procedure dictates that any program be thoroughly tested with non-critical data before relying on it.  The user must assume the entire risk of using the program.  Any liability of the seller will be limited exclusively to product replacement or refund of purchase price.


How to Register Local Access

There are several ways to register yourself for  Local Access Logon:

Ordering with CompuServe's Software Registration Service:  enter GO SWREG at the CompuServe ! prompt and follow the menus.  Local Access's registration id is 1947. You will receive the latest version of Local Access Logon on disk, together with your registration number.

Credit card ordering

1.	By ordering a distribution disk with the newest version of Local Access Logon. A registration number for this version, based on your name, will be included.

2.	By ordering a site-license for an organization. A site license for Local Access Logon entitles an organization to receive one copy of the distribution package and duplicate the distribution disk for the specified number of copies.

If you order with a credit card, please print one of the order forms:

International Order Form

Dutch Order Form

Send the order form to:

Address:	M2w Software

P.O. BOX 8158

3009 AD ROTTERDAM

THE NETHERLANDS

or fax:	+31-104568845


International Order Form Local Access Logon

>>>To print this order form, click on Print Topic in the File menu<<<

Register Local Access Logon to:

Name	:

Company	:

Address	:

Telephone #	:

Electronic Mail address:

How did you hear about Local Access?

Credit card orders: Mastercard / Visa / American Express (circle one)

Credit Card Number:	Expires:

Exact name on card:

I have read and agree to abide by the Local Access license agreement:

(Signature - required):

I want (See How to Register):

O	A single copy (distribution package with disk)

____ copies at US$ 29 each =	__________

O	A site license

for 5 computers at US$ 19 each = US$ 95	__________

for 10 computers at US$ 15 each = US$ 150	__________

for 25 computers at US$ 14 each = US$ 350	__________

for 50 computers at US$ 12 each = US$ 600	__________

for 100 computers at US$ 9 each = US$ 900	__________

for 250 computers at US$ 6.50 each = US$ 1625	__________

Disk size: ___ 3.5 ; ___ 5.25

SUBTOTAL	__________

In the European Community only:

Value Added Tax (17.5% of subtotal)	__________

Or (companies only) enter your

VAT-identification number:______________________

TOTAL INCLUDED:	__________

__________

Prices guaranteed through December 1994.

Comments:


Dutch Order Form Local Access Logon

>>>Druk dit bestelformulier af door "Print Topic" in het File menu te kiezen.<<<

Registreer Local Access Logon voor:

Naam	:

Bedrijf	:

Adres	:

Telefoon	:

Electronische post:

Hoe heeft u kennis gemaakt met Local Access?

O	Ik heb het onderstaande totaalbedrag gestort op Postbank rekening 6065848 ten name van M2w Software Rotterdam onder vermelding van "Local Access"

O	Ik betaal met een credit card:

Credit cards: Mastercard / Visa / American Express (omcirkel de keuze)

Credit Card Nummer:	Geldig t/m:

Exacte naam op de kaart:

Ik heb de Local Access licentie overeenkomst gelezen en ga daarmee akkoord

(Handtekening - verplicht):

Stuur mij (Zie How to Register):

O	Distributiepakket met diskette

____ kopieen a fl 52,50 p/stuk =	__________

O	Een site licentie

voor 5 computers a fl 35,- p/stuk = fl 175	__________

voor 10 computers a fl 27,- p/stuk = fl 270	__________

voor 25 computers a fl 25,- p/stuk = fl 625	__________

voor 50 computers a fl 21,50 p/stuk = fl 1075	__________

voor 100 computers a fl 16,- p/stuk = fl 1600	__________

voor 250 computers a fl 11,50 p/stuk = fl 2875	__________

Diskette type: ___ 3.5 ; ___ 5.25

SUBTOTAAL	__________

BTW (17.5% van subtotaal)	__________

TOTAAL:	__________

__________

Prijzen gegarandeerd tot en met December 1994.

Commentaar:


Copyright
Local Access (TM) Logon version 2.20

Copyright (c) 1993/1994 M2w Software

Written by Mart van Ineveld

 Software

P.O. Box 8158

3009 AD Rotterdam

The Netherlands

M2w Software is a member of the Association of Shareware Professionals


What is Local Access?
Introduction

What is Local Access?

Local Access for Windows

Local Access for Windows consists of three modules:

The Logon Module manages access to Windows and Windows or DOS applications.

The File Access Module manages read and write access to files and directories. (Currently only a Dutch version is available under the product name Shelter Security)

The Boot Protection Module prevents access to the hard disk if the system booted from a system diskette. (Currently only a Dutch version is available in the product Shelter Security)

These modules form together a strong and flexible security platform for Microsoft Windows.

Local Access Logon Module:

The Logon Module offers too many functions to list here exhaustively. The main functions are:

The System Administrator defines users (maximum 500) and user groups (maximum 100).

Access rights are managed per user group.

Access rights include: what applications may be used? May the user install applications? Does the user have access to the DOS prompt? What Program Manager groups are accessible? Etcetera, etcetera.

Start-up files for Windows are protected automatically for all users who are not allowed to install applications.

Logon asks for a valid combination of user name and optional password before access to pre-defined Windows and DOS-applications is allowed.

The System Administrator may define an Automatic Logon User. As soon as Windows is started, this user is allowed access immediately. In this case there is no Logon procedure. This feature is especially usefull for schools and business purposes.

The software

The Logon Module consists of four main applications and some helper libraries and programs:

Local Access Logon (LALOGON.EXE). This program asks for a username and password before access to Windows and Windows or DOS applications is allowed.

User Manager. This application allows the System Administrator to view and modify all user accounts and several logon options (like automatic logon).

Screen Saver (LASAVE.EXE). This program asks for the user password before a sleeping Windows session is reactivated.

The DOS device driver LADOS.SYS. This driver ensures that AUTOEXEC.BAT cannot be terminated with Ctrl+Break, and that a user cannot enter the DOS prompt after irregular termination of Windows (for instance because of a protection fault). If such a termination occurs, LADOS.SYS will first flush all disk caches and then reboot the computer with a message.

See the section List of Installed Files for a complete list of the files that are used by LA Logon.

For whom may Local Access be interesting?

Local Access was not written with a special group in mind. It is therefore very flexible for all:

who want no other users to have access to the computer,

system administrators who want their users to work without unnecessary problems,

home PC users with little brothers or sisters that want to play games,

schools where many students share the same computers,

public places where many clients have access to a computer,

shops and demonstration rooms where many clients may try the computers and software.


Basics of System Security
Introduction

Basics of Practical System Security

Practical PC security falls apart in three pieces:

The logon process to identify the user.

Give access to system resources, like files and programs, after identification.

Close all backdoors to be sure that the logon process cannot be interrupted, or to be sure that resources are not accessed without authorization.

It depends heavily on the purpose and users which type of security is optimal. But keep in mind: the more security a system offers, the more effort it will cost for both the system administrator and the users. Try to find a practical solution.

The logon process

During the logon process the user is asked for a logon name and password. This public name and secret password identify the user.

Local Access offers the possibility of automatic logon too. In this case the system administrator defined a user to be the default logon user. After the start up of Windows, there is no logon dialog. This default user will log on automatically. Other users have to log on from within Windows.

Give access to resources

With Local Access Logon, you allow users access to Windows and DOS programs and program groups. The System Administrator defines per group of users what application should start after logging on, or which program groups should be displayed in Program Manager.

Furthermore, Local Access automatically marks system start-up files (like CONFIG.SYS) as read-only if a common user with restricted access logs on.

You may furthermore restrict access to other files by setting the file attributes to "Read-only" or "Hidden" with File Manager. By preventing common users to start File Manager, these users cannot change the file attributes.

If you need enhanced file access management, you should buy the LA File Access Module.

Close the backdoors

There are several backdoors you should close:

Prevent booting from a system diskette.

Prevent editing or corruption of important files. See: Logon Options

The section Manual Fine Tuning contains further information on this subject.


Logging On and Off
Introduction

Logging On and Off

As soon as Windows starts up, Local Access Logon asks for a valid combination of a logon name and optional password. If no valid combination has been entered, access is denied.

If a valid combination has been entered, access is permitted to certain  programs and program groups. The system administrator permits the access rights per group of users. A group of users may start up with Program Manager, or with any valid DOS or Windows application, like Word for Windows. If a user group starts with Program Manager, the administrator may specify the program groups that should be accessible.

The Logon Dialog contains a Shutdown button. If a user presses this button, the system shutdown procedure starts immediately.

Automatic Logon

The System Administrator may allow public access, based on the definition of a certain user. In that case, no logon dialogs are displayed, but Windows immediately starts up with the programs or program groups that have been defined for that particular user. Other users should click the LA Logon icon on the desktop to log on.

Logging off

If the user closes the startup program, LA Logon displays the well known "Exit Windows Session" dialog. System Administrators see, besides the OK and Cancel button,  a third button in this dialog: "Exit to DOS". Click this button to exit Windows and return to the DOS prompt. All other users (not system administrators), only see the OK and Cancel buttons. If the OK button is chosen, the LA Windows Shutdown program is started.


Access to Programs and Program Groups
Introduction

Access to Programs and Program Groups

After successfully logging on, the user starts with a predefined application:

either Program Manager

or any other valid Windows or DOS application.

The System Administrator defines per group of users what application should start up after the logon process. If Program Manager is the start-up program, the system administrator furthermore decides which program groups should be accessible and visible to this user(s).

Access to the DOS prompt

In order to prevent users from (accidentally) entering the DOS prompt, the system administrator should exclude the "Main" program group from access to users. Normally, this program group contains all applications (File Manager, Windows Control Panel) that should only be used by system administrators.

The Local Access Windows Shutdown procedure ensures that users are not confronted with the DOS prompt if they leave Windows. The device driver LADOS.SYS makes sure that even irregular termination of Windows, for instance because of a Protection Fault, will not return the user to the DOS prompt.


System Shutdown
Introduction

System Shutdown

If the user closes the application he/she started with, LA Logon displays the Exit Windows dialog. Only System Administrators may choose to leave Windows and enter the DOS prompt. All other users only have the right to terminate the Windows session. LA Logon executes the LA Shutdown program.

This shutdown program flushes all disk buffers (including SmartDrive), and locks up the machine.

If somebody presses the Enter key, the Logon procedure is started again, and another user may start working with Windows.


If You have Questions or Remarks
Introduction

If You have Questions or Remarks

If you have questions, remarks (on the software or documentation) or if you ever encounter problems: do not hesitate to contact me! If you are a registered user: do not forget to mention your registration name and number.

Mart van Ineveld

CompuServe: 	100120,2335

Internet:	100120.2335@compuserve.com

Fax: 	+31-104568845

Post Address:	M2w Software

P.O Box 8158

3009 AD ROTTERDAM

THE NETHERLANDS

ASP Ombudsman

M2w Software is a member of the Association of Shareware Professionals (ASP). ASP wants to make sure that the shareware principle works for you. If you are unable to resolve a shareware-related problem with an ASP member by contacting the member directly, ASP may be able to help. The ASP Ombudsman can help you resolve a dispute or problem with an ASP member, but does not provide technical support for members' products. Please write to the ASP Ombudsman at 545 Grover Road, Muskegon, MI 49442-9427 USA, FAX 616-788-2765 or send a CompuServe message via CompuServe Mail to ASP Ombudsman 70007,3536

See Also:

 Appendix: Common Problems and Solutions


System Requirements
Installation and Registration

System requirements

Local Access Logon needs:

0.7 MB of hard disk space

Microsoft Windows version 3.1 (enhanced or standard mode) or Microsoft Windows for Workgroups version 3.1 or higher.


Installation and Registration

Both the installation and de-installation of Local Access are fully automated.

Installation

Local Access must be installed with the Setup program on the Local Access disk or directory where you unzipped the unregistered version.

In Windows, you may run Setup as follows:

1. 	Choose "Run.." from the Program Manager File menu.

2.	Enter the full pathname of the Setup program, for instance:

A:SETUP

or

C:\WINZIP\UNZIP\SETUP

Setup will ask for the name of the directory where LA should be installed. If this directory does not exist, it will be created.

Setup asks whether or not the Local Access screen saver should be installed. If you do not want Setup to install this screen saver, you can do it later manually in Control Panel or by running Setup later again.

Registration and First Logon

After correct installation Windows will be rebooted, and Local Access Logon will start up as the first program. After the first time installation, two dialogs will be displayed:

The registration dialog. Because Local Access is still unregistered, you should register now your registration name and number. If you do not register yourself, you may either evaluate the unregistered copy, or de-install Local Access immediately.

As soon as you have registered yourself, this dialog will disappear.

After registration or evaluation, you will be asked for your personal system administrator account. This account is necessary in the future to log on as a system administrator with full access rights.

After logging on as the system administrator, you are able to use all Local Access applications in order to define new users and to define the Local Access options with User Manager.

Registration

As long as you did not register the Local Access Logon software, the logon procedure will be preceded by a registration dialog. This dialog asks for the registration name and number. Click the "Ordering Information" button to find out how you should register yourself. After you have payed the registration fee, you will receive a registration number that depends on your registration name.

Setup Log File

The Setup program creates the logfile LOGSETUP.TXT in the directory where Local Access has been installed. This file contains all actions that Setup undertook during installation.

For more information about the Setup process you should inspect LOGSETUP.TXT, for instance with NotePad.

See also:

 Uninstall Local Access

 Ordering Information

 List of Installed Files


Deinstallation
Installation and Registration

Uninstall Local Access

Setup automatically installs the de-installation program, that is present as an icon in the Local Access program group. Only the System Administrator may use this program to uninstall Local Access.

All Local Access files will be deleted, and the system is brought back to the situation before LA Setup was run.

Warning: In the unregistered version, any user may de-install Local Access with this program, even before Logging on!

See also:

 Install Local Access

 Ordering Information


Manual Fine Tuning
Installation and Registration

Manual Fine Tuning

As explained in the Introduction, there are always backdoors you should close to ensure optimal security.

There are several things you could do:

Prevent booting from a system diskette.

Install LADOS.SYS

Prevent editing of startup files.

Prevent booting from a system diskette

Any user could access the hard disk easily by starting up with a MS-DOS system diskette. There are several ways to prevent this:

By physically locking the A:-drive. There are several diskette drive locks available on the market.

By changing the computers BIOS setup. Many Personal Computers can be set up in such a way that booting from a diskette is only performed if the hard disk is physically damaged. Please see your computer's manual for information on this topic. By the way: do not forget to secure the PC Setup with a password!

By rearranging the diskette cabling in such a way that unit A: will be known as unit B:. Most computers cannot boot from unit B:.

If none of these tricks is sufficient or possible, you should order the LA Boot Protection Module. This module offers you three levels of boot protection, up to a complete encryption of the hard disk.

Install LADOS.SYS

The DOS device driver LADOS.SYS adds the following functionality to LA:

It prevents the abortion of AUTOEXEC.BAT with Ctrl+C or Ctrl+Break. This may be very useful if Windows is started in AUTOEXEC.BAT.

It prevents that MS-DOS will show up with the DOS prompt "c:\:>" after abnormal termination of Windows. This could happen after a hardware error or after a General Protection Fault because of a buggy application. Instead, LADOS reboots the PC completely.

It must be present to facilitate Automatic Logon. Without the presence of LADOS.SYS you cannot use Automatic Logon.

LADOS.SYS is not added to CONFIG.SYS automatically during Setup, it is only copied to the LA directory of your choice.. You should add the following line to CONFIG.SYS manually (for instance with NotePad):

>DEVICE=c:\xxx\LADOS.SYS

where c:\xxx is the path where LADOS.SYS resides.

If you are using MS-DOS version 6 or higher, you could furthermore:

Run MemMaker to optimize the memory this driver is using.

Add the line:

>SWITCHES=/N/F

to CONFIG.SYS. This prevents the use of F5 or F8 during start-up of MS-DOS. Now CONFIG.SYS and AUTOEXEC.BAT can no longer be skipped during start-up.

Prevent editing of startup files

The correct startup of Local Access depends on the following files:

CONFIG.SYS, where LADOS.SYS and other parts of the DOS system are loaded.

AUTOEXEC.BAT, where Windows is started,

SYSTEM.INI, where LALOGON.EXE and the screen saver are loaded

LALOGON.INI, where LALOGON.EXE obtains its configuration data. (See: Keys in LALOGON.INI)

PROGMAN.INI, where the program groups are defined.

All these files are ordinary text files, that can be edited with most word processors like Word for Windows or Write and NotePad.

Local Access automatically marks all these files read-only if a common user logs on.

Other files should be protected manually. You can prevent users to edit or corrupt files by:

Making the files hidden. Use the DOS command ATTRIB or use File Manager to change the file attributes.

Preventing access to File Manager and the DOS prompt for all users who may not edit the startup files. If users have no access to these (or alike) programs, these users cannot change the attributes of the startup files, and thus not edit them.

You could also apply the LA File Access Module. In that case, the system administrator may give access to files depending on the active user.

See also:

 Install Local Access

 Logon Options

 Ordering Information


User Manager
User Management

User Manager

User Manager is the Local Access application for the management of users and user groups.

This manual does not document the commands and dialogs of User Manager. All commands and details of the dialogs are described in the User Manager Help File.


Users and User Groups
User Management

Users and User Groups

Users

A user consists of all personal attributes of a user account, like:

the logon name,

the full username

the password,

several password options

These attributes are used by LA Logon during the logon procedure. The access rights of each user are determined by the user group.

User Groups

Every user is a member of at least one user group. The user group is used to set the access rights after a successfull logon. Every user group defines the access rights, such as:

are members System Administrators?

may members install programs?

may members use all Program Manager program groups?

what program(s) should be started after the logon process?

These attributes determine the access rights of all member users.

Because of this distinction between groups and users, it is much more easy to change the access rights of users. Instead of changing all users, the system administrator simply changes the group, and all member users are automatically modified.

Multiple membership

A user may be a member of more than one group. In that case, LA Logon adds up all attributes of all user groups. If, for instance, two user groups give access to different sets of Program Manager program groups, and one user is a member of both user groups, then all program groups in both user groups will be accessible to that user.

An example

Suppose LA is used in a classroom, where different students use groups of applications. The system administrator could define the following user groups:

Teachers, with access to all program groups,

Students: with access to the program groups where the educational software is present.

Automatic logon

The system administrator could furthermore define a student as the Automatic Logon User. In that case, Windows will automatically start up with the program groups for all students. Teachers or system administrators must log on by clicking on the LA Logon icon on the desk top. Students don't have to log on anymore.


The Definition of Users
User Management

The Definition of Users

The definition of users is a two step process:

First create the user group(s)

Second: create the member users

As explained in the section Users and User Groups, all access rights are defined in the user group. Upon the creation of the user accounts, you should modify the group membership of each user to the previously created user group.

The group "Users"

If you only use one kind of user, you could modify the user group "Users" according to your own needs. User Manager uses this group as the default membership if a new user is created.


Modification of Users and Groups
User Management

Modification of Users and Groups

Changing access rights

To change the access rights of a user, the system administrator must change the attributes of the user group. All member users will be modified accordingly.

Changing user accounts

Other personal attributes should be modified on a per user basis.

Deleting users and groups

The deletion of a group is, of course, only permitted if no member-users are present. A user may be deleted always. There is, however, always the possibility to disable a user account. In this case, the user is not deleted permanently. A disabled user cannot log on anyway.


Managing User Files
User Management

Managing User Files

User Manager stores all users and groups in Local Access User Files (.LAU). In special cases, a system administrator could decide to create more than one user file. For instance to change a complete access scenario very quickly.

All logon information, except data regarding the Auto Logon User, is stored in the user file. User passwords are DES encrypted. Auto Logon data are stored in LALOGON.INI.

Default Logon File

There is only one file that can be used at logon time by LA Logon. This file is marked in LALOGON.INI as the Default Logon File.

If the system administrator markes a user file as the Default Logon File, all program groups, present in the user group definitions, will be regenerated. This is because in the meantime program groups may have been installed or deleted.


Logon Options
User Management

Logon Options

There are two kinds of options that can be defined:

Account Policy

Automatic Logon User

Protect Files

Account Policy

The Account Policy determines the kind of validation of passwords at logon time. Only users that may change their passwords are affected by these options.

Automatic Logon

If the system administrator enables automatic logon, users don't see the logon dialog. There are two alternatives:

mark a user account as the Automatic Logon User. In that case LA Logon will not show up with the logon dialogs, but starts immediately with the access rights of this user.

use the active Windows for Workgroups username for logon. In that case, the logon dialog of Windows for Workgroups, or any other compatible network, will be used. If no user has logged onto Workgroups, or this user logged on to Windows for the first time, Local Access will ask for a logon name and password anyway. User passwords are stored in the encrypted Windows for Workgroups password cache file. The Workgroup password is used by Windows to decrypt all passwords in this cache file.

Other users must log on by clicking on the LA Logon icon on the desktop.

In order to use the Automatic Logon, the device driver LADOS.SYS must be loaded in CONFIG.SYS. See the section Manual Fine Tuning for more information.

Protect Files

The system administrator may enable or disable the protection of Windows start-up files. If protection is enabled, all of these files are marked read-only if a user with restricted access logs on. All other users (like system administrators) still have full access to the start-up files.

The following files are influenced by this option:

CONFIG.SYS

AUTOEXEC.BAT

SYSTEM.INI

LALOGON.INI

PROGMAN.INI

WIN.INI.


Screen Saver
Local Access Utilities

Screen Saver

The screen saver from Local Access is installed automatically by the Setup program. This screen saver asks for the password of the active user if this password is not empty, and if a user is logged onto Windows.

Screen Saver Setup

The setup can be changed by double clicking on the Desktop icon in Control Panel. The following settings are optional:

Delay time: the number of idle minutes the saver should wait before it becomes active.

Show Bouncing Ball: This setting can be on or off. If Off, the bouncing ball is not displayed.

Time Interval: This setting is highly dependend on the speed of the display driver. This time interval is used for drawing the bouncing ball.

The Setup settings are saved in the section [ScreenSaver.Local Access] from CONTROL.INI.


Who Am I?
Local Access Utilities

Who Am I?

This utility displays information on:

The Local Access version

The LA File Access version (if present)

The active user's logon name and access rights.

Every user has access to this program (if the Local Access program group is accessible of course).


Password Security
Appendix: Password Security

DES encrypted Passwords

All passwords entered in Local Access Logon or User Manager are encrypted with the Data Encryption Standard algorithm. This is done to ensure that nobody is able to read or decrypt any user password. These passwords could be used on other computers or networks too. The module LAHOOKS.DLL contains the procedure CheckPassword which is used by all Local Access applications. (If you are a programmer, you may use this procedure too, for instance in your own screen saver). This procedure compares only encrypted passwords with each other in order to check whether the entered password is the same as the active user's password.

This means that there is no code present in Local Acccess to decrypt passwords, and that the computers memory contains only DES encrypted passwords.. Passwords are never decrypted!

The biggest risc in the use of passwords is the human user him/herself. It depends highly on their motivation and discipline whether or not passwords are treated with enough security.

The DES algorithm was written according to the American National Standard X3.92-1981/R1987 (FIPS PUB 46-1).

Hints for secure passwords

LA passwords may be as long as 32 characters. Of course, nobody is able to remember difficult passwords of that length.

There is however a very simple rule for obtaining long and difficult passwords that can easily be remembered. Choose a random English (or French, Spanish or German) word, and associate it illogically with another word. Finally concatenate the two words with a random separator character, like "%", "/" or "*".

Examples of such passwords are:

calmly!glass

speed*Paris

yesterday$Lennon

motorbike^108f

(The last one is very personal: when I lived as a child in a street at number 108f, my older brother had a motorbike. A true BMW 500 CC! How jealous I was!)

The main thing is: your personal associations are a rich source for pleasant passwords you can easily remember. As long as they are NOT logical, practically nobody will be able to guess them.


Common Problems and Solutions
Appendix: Common Problems and Solutions

A user forgot the password

Nobody is able to view a users password, not even the System Administrator. For this reason there is only one solution to this problem: give the user a new password, and force the user to change it at the next logon.

In User Manager, select the user, and choose the command "Change Password" in the Edit menu. Enter a new password, and force the user to change it at the next logon.

The System Administrator forgot the password

This should never happen of course! The best way to prevent this is the definition of two user accounts with system administrator access. The other administrator will always be able to change the password from the other administrator.

Should this happen anyway, and there is no other administrator, then there is only one solution: define all users again! This can be achieved with the following steps:

Start from a system diskette. (If you installed Boot Protection: remove the boot protection first).

Go to the Windows subdirectory, and edit LALOGON.INI with a DOS editor (like EDIT). Remove the line "LAUFile=..." completely.

Copy, with the same editor, the section "[Groups]" and all the lines therein completely to the file PROGMAN.INI. This section contains the filenames of all program groups in Program Manager. If you do not copy this section to the Program Manager INI file, all group definitions may be lost.

Go to the directory where LA was installed, and remove the file LALOGON.LAU (or any other file that is being used as the LA user file by LALOGON).

After these actions, LA Logon has been reset. At the next start-up of Windows, Logon will ask for your system administrator name and password, and will create a new user file, just as if it had been installed from scratch.

You don't want to use Program Manager

If you want to use another shell instead of Program Manager, like Dashboard for Windows, add the following line to the section [Logon] of LALOGON.INI:

shell=c:\mypath\myshell.exe

From now on, Local Access will use "myshell.exe" instead of Program Manager.

The alternative shell does not start or exit correctly

If the alternative shell behaves erraticly, or the "Exit Windows Session" dialog does not show up if this shell is about to be terminated, try to change the following keys in the section [Logon] in LALOGON.INI:

ShellNotifyExit=1

and/or:

SystemWideHooks=1

Both these keys are "0" by default. If the key "SystemWideHooks" is set to 1, this may affect the performance of Windows.

See also:

 Appendix: Password Security

 If You have Questions or Remarks


Keys in LALOGON.INI
Appendix: Keys in LALOGON.INI

The initialization file LALOGON.INI contains several sections and keys. Most of these sections are handled automatically by LALOGON.EXE and User Manager. In case you want to change keys manually, this appendix describes the meaning of all keys.

Section [Install]

This section is used by Setup and Uninstall.

OldShell: the shell in SYSTEM.INI before installation of Local Access.

OldSaver: the screen saver in SYSTEM.INI before installation of Local Access.

Section [LicensedTo]

This section contains information about the registration of Local Access.

Name: the registered user name.

LicenseNr: the registration number.

Section [Logon]

This section contains keys that are used at logon time.

LAUFile: the LA User File that is marked as the default User File.

MRUName: Most Recently Used Name. The name of the user that most recently logged on.

Shell: the shell that is to be used by Local Access after logging on. Default: progman.exe. N.B.: If you define another shell, be sure that it is 100% compatible with Program Manager.

PMFileMenu: if 0, the File Menu in Program Manager is not available for users with restricted access to Program Manager groups. If 1, a restricted File Menu is available. Users may only use File Exit in Program Manager . Program Groups cannot be modified.

AllPMGroups: LALOGON.EXE does not update the [Groups] section in PROGMAN.INI if this key is unequal to 0. Used internally by LALOGON.EXE.

ShellNotifyExit: Normally, the default shell (Progman.exe) exits according to Windows standards. If you use an alternative shell, and the "Exit Windows Session" dialog is not shown upon termination, set this key to 1. Default is 0.

SystemWideHooks: If you use another shell instead of Progman.exe (like Norton Desktop for Windows), and this shell behaves erroneously, set this key to 1. (Default is 0). This may affect the system performance.

AutoArrange: Normally, the Program Manager option "Auto Arrange" is set by Local Access if a user may not install applications. For all other users, Local Acess disables "Auto Arrange" after logging on. Set AutoArrange to 0 if you want to preserve this Program Manager option. (Default is 1).

CustomPMGroups: If this key equals 1, you arrange program groups in Program Manager yourself. If 0 (default), you are allowed to define which program group will be opened after logon. All other available groups will be iconized by Local Access.

Section [Groups]

This section contains all filenames of the Program Manager groups that are available on this PC. This section is used to update PROGMAN.INI after a user logged on.


Version History
Appendix: Version History

Version 2.20

Completed October, 18 1994.

Setup automatically adds the Program Manager Startup group to user group definitions. Setup allows the user to install the screen saver separately.

Bug in DDEML interface removed. This bug could under conditions cause a General Protection fault in the Windows library DDEML.DLL when updating Program Manager groups.

Version 2.12

Completed October, 6 1994.

Some technical program modifications have been applied. No functional changes.

Version 2.11

Completed May, 6 1994.

The administrator may define a program group that will be opened after a user logs on. All other program groups will be iconized. See the Program Manager Groups dialog in User Manager.

Key CustomPMGroups added to LALOGON.INI.

Version 2.10

Completed April, 5 1994.

Key AutoArrange added to LALOGON.INI.

Screen saver LASAVE internally enhanced.

Version 2.01

Completed March, 25 1994.

Bug in LAHOOKS.DLL removed. This bug caused General Protection Faults in Microsoft Access' Cue Cards and in Norton Desktop for Windows.

Version 2.00

Completed March, 22 1994.

Windows for Workgroups aware (see Automatic Logon)

Startup groups added to user group definition. A Program Manager group may be defined as the startup group per user group. The "load=" and "run=" statements in WIN.INI are also executed by LA.

Version 1.21

Completed March 1994. All projects were recompiled with Microsoft Foundation Classes 2.5.

Minor bug in UnInstall removed (deleted all files in LA directory).

User Manager displays System Administrators with an exlamation.

Version 1.20

Completed february 1994. Additionally tested with Windows for Workgroups 3.11 and a Dutch and a Greek version of Windows 3.1.

Protect Files function added.

Auto Save Files function added.

New Setup program added.

New keys added to LALOGON.INI: shell, PMFileMenu, AllPMGroups (See: Keys in LALOGON.INI).

Version 1.10

Completed january 1994. First shareware version.

UnInstall program added.

Auto Logon function added.

Version 1.00

Completed december 1993. Tested with Microsoft Windows 3.1 and Windows for Workgroups 3.1.


Development Tools
Appendix: Acknowledgements

Software is useless without you: the user. First of all special thanks to all users of Local Access (and Shelter, the DOS ancestor of LA). They make all efforts worth the hours of developing.

I also wish to express my thanks to:

Filitsa Dardaganidis, who supported me with several good ideas and a lot of testing in every day practice.

Addo Stuur, who was so kind to adopt a Dutch version for one of his books.

Also thanks to many (partly anonymous) Microsoft developers: the developers Microsoft Visual C++ Optimizing Compiler,  of the Foundation Classes, and of the Developer Network CD.

And also special thanks to Thomas, my bobtail, who warmed my feet during many hours of development.


List of Installed Files
Appendix: List of Installed Files

The following files are installed by Setup:

Filename	Purpose

_la_del.exe	De-installs Local Access

_la_down.exe	Flushes the disk buffers and locks the PC after "Exit Windows".

ctl3d.dll	Library with routines for 3-D effects in dialogs.

lados.sys	The DOS device driver for advanced security.

lahooks.dll	Library with common routines for all LA applications.

lalogon.exe	The logon application, defined as the shell in SYSTEM.INI.

lalogon.lau	The default LA User file, created with the first logon after Setup.

lasave.exe	The screen saver.

lastatus.exe	Displays the LA status in a dialog.

logsetup.txt	The text file with a detailed log of all Setup actions.

manual.hlp	This manual.

readme.wri	Read Me file.

userman.exe	User Manager, for the definition of users, groups and options.

userman.hlp	User Manager help file.

The Windows version library VER.DLL is used to install correct versions of all executables and libraries. This means that no newer versions, especially of common libraries in the Windows system directory, will ever be overwritten.