Re: Gaping security hole? (network db connections)

On Tue, Nov 04, 1997 at 09:17:24AM -0500, Jack Parker wrote: > At 12:24 AM 11/4/97 GMT, you wrote: > >Actually, .rhosts is still a problem, > > > >It jsut narrows the hole from: > > > > ANY user on client can log into ANY user on server > >to > > ANY user on client can log into this particular user on server > > You can specify user@host to narrow it down to a specific user from a > specific host. The whole point of this thread (of the security hole I'm pointing out) is that informix sqlexecd does not appear to be honoring that check. Since sqlexec (client) does not have to be setuid (it works even if it isn't) - the remote sqlexecd (server) does not have ANY way of verifying that the userid you claim to be is actually the userid that you are. With BSD ruserok() checking, the remote connection has to come from a secure port - that's what rlogin/remsh/rsh/ssh/rcp/etc. all have to be setuid root. BTW, Is the above address (informix-list) a gateway to the newsgroup, or is it an independent mailing list? -- Nathan ------------------------------------------------------------ Nathan Neulinger Univ. of Missouri - Rolla EMail: nneul@umr.edu Computer Center WWW: http://www.umr.edu/~nneul SysAdmin: rollanet.org