How do I prevent users from clicking START button

[rayt]

I am trying to write a short VB program to require the user to enter a valid password before they can get to their desktop. I am hoping the program will prevent unsophisticated hackers from trying to get to somebody else's PC in an office, cubical, environment.

Any tips will be greatly appreciated.

Ray T.

 

[jmarler]

What OS are you using? This functionality is already built into Win NT 4.0 and 2000 and I think that even Win 9X has screen saves with passwords that keep unauthorized people away from the desktop. - Jeff Marler

http://www.JeffMarler.com

(please note, that the page is under construction)

 

[MiggyD]

This is simple to do. I've already created a similar "simple" login for where I work (except I've left KEYS 13, 14, and 15 untouched incase I need to get into the system right away). However, most of my co-workers aren't aware of this little secrete of mine. All they know is that they don't have access to their desktop until this "simple" login screen validates them.

Here's how I did it...

maximize the form.
remove controls (_ [] X)
Window style is not sizeable
and trap all keys (the keypresses)

hope this sparks an idea
--MiggyD
"The world shrinks more and more with every new user online."

 

[jmarler]

MiggyD . . . 2 key presses will get past your screen . . .


ALT-TAB


or


CTRL-SHIFT-INSERT

and end the process in the task list

or


CTRL-ALT-DEl

and once again find and end the process in the task list.

Also, when I tried your idea on my PC, my taskbar (which I have configured to always be on top and not to autohide) AND the start button were right there for me to use . . . I just couldn't get to my desktop icons.
If you want to create your own login process (a real one) you would need to look at writing your own GINA (Graphical Identification and Authentication ) . . . this is ot a small task by any means, but here is the MSDN link that will tell you how to do it (note that you will need the platform SDK) . . .

http://msdn.microsoft.com/library/default.asp?URL=/library/psdk/logauth/gina_structures_196b.htm

As I mentioned before, if you want security, simply install Windows NT or 2000. The ability to lock the PC (if that is really all you want to do) is built into the system. - Jeff Marler

http://www.JeffMarler.com

(please note, that the page is under construction)

 

[Alt255]

Dang, Jeff!?! Do you mean I wasted all this time writing thousands of lines of code when all I had to do was tell the user to upgrade to NT?

Hmmm... sorta makes you wonder... I think I'll try that.

Alt255@Vorpalcom.Intranets.com
Klatu barada nikto, y'all.
​

 

[jmarler]

Alt255,
Well, you can write code to do this if you want, but in all honesty if what they want is to make sure the user can't access the PC until they enter a password then let the OS do this . . . why reinvent the wheel? - Jeff Marler

http://www.JeffMarler.com

(please note, that the page is under construction)

 

[jmarler]

rayt,
I should mention, that is all you want is to keep the users away from the desktop, and if they really don't know how PCs work (i.e. your "unsophisticated hackers&quot then MiggyD's would probably work fine.

alt255,
I forgot to ask . . . how would you do this? - Jeff Marler B-)

 

[MiggyD]

To jmarler:

The following is an old code of mine. Note that I do have the ALT and CTRL keys trapped in my main form. This is the suggestion I'm making to rayt.


VERSION 4.00
Begin VB.Form frmLogOn
[red] BorderStyle = 0 'None[/red]
Caption = "PC Secuirty System"
ClientHeight = 6120
ClientLeft = 45
ClientTop = 375
ClientWidth = 7455
[red] ControlBox = 0 'False[/red]
FillStyle = 0 'Solid
Height = 6525
Icon = "FRMLOGON.frx":0000
Left = -15
LinkTopic = "Form1"
[red] MaxButton = 0 'False
MinButton = 0 'False[/red]
ScaleHeight = 6120
ScaleWidth = 7455
[red] ShowInTaskbar = 0 'False[/red]
Top = 30
Width = 7575
[red] WindowState = 2 'Maximized[/red]
Begin VB.CommandButton cmdCancel
Caption = "Cancel"
Height = 375
Left = 4440
TabIndex = 4
Top = 5880
Width = 1215
End
Begin VB.CommandButton cmdAccept
Caption = "Accept"
Enabled = 0 'False
Height = 375
Left = 4440
TabIndex = 3
Top = 5040
Width = 1215
End
Begin VB.TextBox txtUserId
Height = 285
Left = 960
MaxLength = 30
PasswordChar = "*"
TabIndex = 2
Top = 6000
Width = 2775
End
Begin VB.TextBox txtUserName
Height = 285
Left = 960
MaxLength = 30
TabIndex = 0
Top = 5040
Width = 2775
End
Begin VB.Frame fraLogOnOptions
Caption = "Options:"
Enabled = 0 'False
Height = 1575
Left = 6240
TabIndex = 9
Top = 4800
Width = 2655
Begin VB.OptionButton optLogUsers
Caption = "Modify access to system "
Enabled = 0 'False
Height = 375
Left = 240
TabIndex = 7
Top = 1080
Width = 2175
End
Begin VB.OptionButton optLogReport
Caption = "Report activities"
Enabled = 0 'False
Height = 255
Left = 240
TabIndex = 6
Top = 720
Width = 2175
End
Begin VB.OptionButton optLogNone
Caption = "None"
Enabled = 0 'False
Height = 375
Left = 240
TabIndex = 5
Top = 240
Value = -1 'True
Width = 2055
End
End
Begin VB.Label LogOnLabel3
BorderStyle = 1 'Fixed Single
Caption = $"FRMLOGON.frx":0442
BeginProperty Font
name = "MS Sans Serif"
charset = 1
weight = 700
size = 8.25
underline = 0 'False
italic = -1 'True
strikethrough = 0 'False
EndProperty
Height = 255
Left = 1320
TabIndex = 12
Top = 6840
Width = 6855
End
Begin VB.Label LogOnLabel2
BeginProperty Font
name = "MS Sans Serif"
charset = 1
weight = 400
size = 13.5
underline = 0 'False
italic = 0 'False
strikethrough = 0 'False
EndProperty
Height = 2895
Left = 240
TabIndex = 11
Top = 1680
Width = 9135
End
Begin VB.Label LogOnLabel1
BeginProperty Font
name = "MS Sans Serif"
charset = 1
weight = 400
size = 9.75
underline = 0 'False
italic = 0 'False
strikethrough = 0 'False
EndProperty
Height = 975
Left = 1680
TabIndex = 10
Top = 480
Width = 7455
End
Begin VB.Image Image1
Height = 975
Left = 360
Picture = "FRMLOGON.frx":0493
Stretch = -1 'True
Top = 480
Width = 975
End
Begin VB.Label lblUserId
Caption = "Password"
Height = 255
Left = 960
TabIndex = 8
Top = 5760
Width = 2775
End
Begin VB.Label lblUserName
Caption = "Name"
Height = 255
Left = 960
TabIndex = 1
Top = 4800
Width = 2775
End
End
Attribute VB_Name = "frmLogOn"
Attribute VB_Creatable = False
Attribute VB_Exposed = False
Public IdMatchPub As Boolean

Const FatSect$ = "FatSect."
Const DietEct$ = "DietEct."
[red]Const vbCtrlMask = 2
Const vbAltMask = 4

Dim CtrlDown, AltDown[/red]


Private Sub CheckId(IdMatchPub As Boolean)
{Cyphering is omitted due to security reasons.}
{However, the sub is indicated for rayt's benefit.}
End Sub


Private Sub ChkLogOptions(IdMatchPub As Boolean)
If IdMatchPub = False Then Exit Sub
txtUserName.Enabled = False
txtUserId.Visible = False
cmdAccept.Visible = False
If optLogReport.Value Then
frmReport.RptLabel2.Caption = frmLogOn.LogOnLabel3.Caption
frmReport.Show 1
End
End If
If optLogUsers.Value Then
LogOnLabel2.Caption = ""
frmNewId.Show 1
End
End If
If optLogNone.Value Then
End
End If
End Sub


Private Sub MainTitleDisplay()

For I = 1 To 3
Print
Next
TrashWord$ = " PC-SECURITY SYSTEM IS LICENSED TO The Planning Department OF " + Chr$(10)
TrashWord$ = TrashWord$ + " The Town of North Smithfield. NO PART OF THIS PROGRAM MAY BE COPIED" + Chr$(10)
TrashWord$ = TrashWord$ + " OR MOVED FROM ITS REGISTERED DRIVE. SEVERE FILE DAMAGE MAY" + Chr$(10)
TrashWord$ = TrashWord$ + " OCCUR . "
LogOnLabel1.Caption = TrashWord$
TrashWord$ = "In order to use this PC, you will need to enter the information "
TrashWord$ = TrashWord$ + "that is being requested below. After all fields are filled, select any options"
TrashWord$ = TrashWord$ + " listed in the box at the right prior to continuing. If you do not have a mouse,"
TrashWord$ = TrashWord$ + " use the tab and arrow keys to move around." + Chr$(10) + Chr$(10)
TrashWord$ = TrashWord$ + "Select: ACCEPT to continue." + Chr$(10)
TrashWord$ = TrashWord$ + " CANCEL to redo over."
LogOnLabel2.Caption = TrashWord$

End Sub

Private Sub StoreLog(IdMatchPub As Boolean)

'NOTE-- Storage/Access (for REPORTING) log is: FatSect.Ovl
Q$ = Chr$(34): C$ = Chr$(44)
Open FatSect$ + "$$$" For Output As 10
Print #10, "PC Security Sys, In-Genious Programs, Copyright 1997, All Rights Reserved"
Print #10, "Personal Computer Security System Version 1.0.3"
Print #10, "This program requires WINDOWS to work properly."
Print #10, Chr$(26);
Write #10, "Date", "Time", "User's Name", "Access Results"
Print #10, Q$ + Date$ + Q$ + C$ + Q$ + Time$ + Q$ + C$;
Print #10, Q$ + frmLogOn.txtUserName.Text + Q$ + C$;
If IdMatchPub = True Then
Print #10, Q$ + "Granted" + Q$
Else
Print #10, Q$ + "** DENIED **" + Q$
End If
FileIsThere$ = Dir(FatSect$ + "OVL", 0)
If FileIsThere$ <> &quot;&quot; Then
Open FatSect$ + &quot;OVL&quot; For Input As 11
Seek #11, 175
For I = 1 To 4
Input #11, TrashWord$
Next I
I = 0
Do While I < 29 And Not EOF(11)
Line Input #11, TrashWord$
Print #10, TrashWord$
If EOF(11) Then Exit Do
I = I + 1
Loop
Close #11
Kill FatSect$ + &quot;OVL&quot;
End If
Close
Name FatSect$ + &quot;$$$&quot; As FatSect$ + &quot;OVL&quot;

End Sub


Private Sub cmdAccept_Click()
txtUserName.Text = LCase$(Trim$(txtUserName.Text))
txtUserId.Text = LCase$(Trim$(txtUserId.Text))
If InStr(txtUserName.Text, &quot;(badkey)&quot = 0 And _
InStr(txtUserId.Text, &quot;(badkey)&quot = 0 Then
CheckId IdMatchPub
Else
IdMatchPub = False
End If
StoreLog IdMatchPub
If IdMatchPub = False Then
'this will not allow normal exiting
cmdCancel_Click
Exit Sub
End If
ChkLogOptions IdMatchPub
End Sub


Private Sub cmdCancel_Click()
If InStr(txtUserName.Text, &quot;(badkey)&quot > 0 Or _
InStr(txtUserId.Text, &quot;(badkey)&quot > 0 Then
frmLogOn.txtUserId.Text = &quot;&quot;
C$ = &quot;A blank field has been encountered.&quot; + Chr$(10)
C$ = C$ + &quot;Fill in all fields to continue.&quot;
C$ = MsgBox(C$, 4096, &quot;Warning&quot
End If
frmLogOn.txtUserName.Text = &quot;&quot;
frmLogOn.txtUserId.Text = &quot;&quot;
frmLogOn.txtUserName.SetFocus
End Sub


Private Sub Form_Activate()
MainTitleDisplay

'The following lines are to test where APP.PATH will show the correct startup dir
'of the EXE in WIN95
PathToDir = App.Path
Print &quot;pcsecure2 (PathToDir = App.Path) = &quot;; PathToDir

'Forced pathway to Directory --- else, it's either WINDOWS (3.X) OR DESKTOP (WIN95)
' If InStr(LCase$(Command), &quot;/path:&quot > 0 Then
' PathToDir = Mid(Command, (InStr(LCase$(Command), &quot;/path:&quot + 6), Len(Command))
' ChDir PathToDir
' End If

'First time installation
If InStr(LCase$(Command), &quot;1st&quot > 0 Or _
InStr(LCase$(Command), &quot;miggyd&quot > 0 Then
LogOnLabel2.Caption = &quot;&quot;
frmNewId.Show 0
frmNewId.Caption = Chr$(104) + Chr$(105) + Chr$(32) + Chr$(109) + _
Chr$(105) + Chr$(103) + Chr$(103) + Chr$(121)
frmMasterOptions.Show 1
End If
End Sub


Private Sub Form_Load()
Show
End Sub


Private Sub txtUserId_Change()
If Len(txtUserId.Text) < 1 Then
cmdAccept.Enabled = False
fraLogOnOptions.Enabled = False
optLogUsers.Enabled = False
optLogNone.Enabled = False
optLogReport.Enabled = False
Else
cmdAccept.Enabled = True
fraLogOnOptions.Enabled = True
optLogUsers.Enabled = True
optLogNone.Enabled = True
optLogReport.Enabled = True
End If
End Sub


[red]Private Sub txtUserId_KeyDown(KeyCode As Integer, Shift As Integer)
CtrlDown = (Shift And vbCtrlMask) > 0
AltDown = (Shift And vbAltMask) > 0
If CtrlDown Or AltDown Then
frmLogOn.txtUserName.Text = frmLogOn.txtUserName.Text + &quot;(badkey)&quot;
cmdAccept_Click
End If
End Sub


Private Sub txtUserName_KeyDown(KeyCode As Integer, Shift As Integer)
CtrlDown = (Shift And vbCtrlMask) > 0
AltDown = (Shift And vbAltMask) > 0
If CtrlDown Or AltDown Then
frmLogOn.txtUserName.Text = frmLogOn.txtUserName.Text + &quot;(badkey)&quot;
cmdAccept_Click
End If
End Sub[/red]

May be Rayt could use some of this in his own &quot;simple&quot; login screen(s).

--MiggyD &quot;The world shrinks more and more with every new user online.&quot;

 

[jmarler]

MiggyD,
As I said in my last post, what you suggested would probably work fine for a simple login screen . . . but if the goal was to secure the system and keep people out, there are better ways of doing it . . . most of which are already built into the OS just waiting to be used. But once again, for the record, your method would work fine for a simple login screen. I just don't think that it would be secure. Sorry . . . nothing personal! - Jeff Marler B-)

 

[MiggyD]

jmarler:

Well, I'm not taking this personally. As a matter of fact, I wholeheartedly agree with you. Indeed, &quot;why reinvent the wheel&quot;.

The reason I posted this was to help Rayt out. This way he could see that it's possible to deter or as he put it &quot;prevent unsophisticated hackers from trying&quot;.

By reading your earlier remarks, I concluded that you were trying to disway him from even trying. Maybe I read it wrong.? If that's the case, I'm sorry I read it wrong.

--MiggyD

&quot;The world shrinks more and more with every new user online.&quot;