quote: Scott Norwood

---

people to cause serious harm to the equipment

---

Let along lawsuits that can come out of this.. to Film-Tech since it allowed confidental info to be published.
 

---

Posted by Brad Miller (Member # 2) on 07-04-2012, 01:33 AM:
 
Monte, you sure are wrong about a lot of stuff lately.

There is no set policy against posting passwords. It's just common sense not to. Anyone who has legitimate training to work on a piece of equipment already knows the passwords or can easily request them from the manufacturer.

I don't know Cristian's level of experience or what his need for the root password is, but he should be able to email Doremi, identify himself, explain why he needs it and receive the root password from them if there is a reason for him to have it.

The whole DCI security thing is quite the ridiculous waste of time though. Just look at marriage.

Scenario #1 Some idiot wants to poke around inside a projector, either for the "cool factor" to try and see how it works, or he is an evildoer and is trying to figure out how to copy the movie. Without him knowing the marriage password, he simply breaks the machine from being able to play back. At the end of the day, this idiot wouldn't have the technical knowledge on how to tap into the system anyway!

Scenario #2 A highly experienced technician who just can't wait for the latest Madea movie to hit bluray cracks the system open to tie in for a copy. Ummmm, duh...anyone with this level of knowledge knows the damn marriage password anyway!

Scenario #3 Whoever (idiot or technician) just points a friggin' camera at the screen. Since there is no mechanical shutter in a DLP projector, flicker isn't even a concern.

Now how did DCI security actually make ANY difference in the above?
 

---

Posted by John Thomas (Member # 6509) on 07-04-2012, 02:32 AM:
 
Cristian, the root password is most likely the same root password that Doremi uses for many other (if not all) of their products, which is available in publicly downloadable field installer manuals.
 

---

Posted by Dave Macaulay (Member # 813) on 07-04-2012, 06:05 AM:
 
I believe searching for the server root password in downloaded manuals will be fruitless, but I'm not about to waste my day looking. The server password different from the other Linux based Doremi device I'm familiar with, the TMS.
The only worthwhile proposal is to call Doremi tech support and ask them. Presumably you have a good reason to want it: there are some basic settings that require it. Doremi isn't hyper secretive about this, but they do not publicize it. If you have a valid reason to need it, they'll provide it.
 

---

Posted by Rick Raskin (Member # 1561) on 07-04-2012, 04:35 PM:
 
I believe the manufacturer would want to be involved in any fix that requires a root password. After all, allowing someone to poke around unsupervised could ultimately cause them bigger headaches.
 

---

Posted by Dave Macaulay (Member # 813) on 07-05-2012, 10:30 AM:
 
You can't "steal" a movie even with root access so the security isn't super tight and there are documents floating around that list the su password. There are several server settings like network setup that require it, and copying anything to a USB stick requires SU access to remount it as read/write.
Doremi gives you an open terminal shell, and you can easily destroy the system with a few characters mistyped as root. Dolby lets you have a restricted terminal for routine tasks as "technician" and as far as getting the Dolby root password... not easy. GDC, I can't find a terminal shell. Haven't really tried hard though.
 

---

Posted by Frank Cox (Member # 6258) on 07-05-2012, 12:49 PM:
 
I have a GDC server and its obvious that it runs on Fedora Core 5. Depending on exactly how they set it up to boot, Fedora usually provides a number of virtual terminals. Ctrl-alt-F(something) gets you to each one. Ctrl-alt-f1, ctrl-alt-f2, and so on.

I don't know if GDC actually does it this way, but since a lot of the boot sequence of the server appears to a stock Fedora Core 5 setup, I wouldn't be surprised.
 

---

Posted by Olivier Lemaire (Member # 5579) on 07-05-2012, 02:46 PM:
 
Dave, Rick:
On a DCI machine, having the "root" password (or "Administrator" if running MS Windows), should not lead to the capability of deciphering encrypted assets -> the Security Manager is FIPSed and the machine must prevents this kind of trick. Even physical access to the machine should not lead to such a security breakage.
If you can demonstrate that with the root password, you can decipher an encrypted essence, you should report it to the manufacturer and/or the company that did certified this machine as DCI... they will probably recruit you pretty quickly (and have this kind of security flaw fixed urgently...).

Dave:
Getting the root password (or "Administrator") of a given machine you've got physical access in is pretty piece of cake for any geek out there - no matter the brand. At maximum, it will require time for a password cracker... not that much considering GPU power of a 300 USD video card nowadays. This is anyway not the point of DCI security: the point is to protect the asset, not the machine.


All that said, having the "root" (or "Administrator") access, anyone can wreak the machine pretty easily - that could be posing an issue for maintenance contracts with integrators. But, it is needed for some specific operations (mostly maintenance). If you are in charge of such operations, you should ask for it at support@doremicinema.com

Surely it's not a good idea, regarding general susceptibility, to publish the default password on a public forum, but one must admit that it is already done on some other countries... And some others will add that there is no security thru obscurity anyway

On some manufacturer documentations, the default root password still exist: just forage docs publicly available at manufacturer website and in less than 30mn. On these docs, you'll see too that they recommend to change this password if you want to be the only guy to be able to take care of the unit maintenance.
 

---

Posted by William F Green (Member # 3192) on 08-14-2012, 09:31 AM:
 

quote: Brad Miller

---

I don't know Cristian's level of experience or what his need for the root password is, but he should be able to email Doremi, identify himself, explain why he needs it and receive the root password from them if there is a reason for him to have it.

---