Re: Security

> (cheryl@redriverad-emhl) writes . . . > > Since security has been brought up.... > > In regard to security in informix perform screens. > > [stuff deleted] > > I was able at one time to prevent users from getting to the shell with ! > but have forgotten and lost my notes. The way to prevent your users from being able to do shell escapes is by re-defining the value of the environment variable SHELL, in your shell program, before you call the Informix Perform program. Using a Bourne Shell program as an example you might do something like the following: ORG_SHELL=$SHELL SHELL=/dev/null export SHELL sperform scrn_prog SHELL=$ORG_SHELL export SHELL Someone correct me if I'm wrong on this, but the reason this works is that in order for the ! to work, it must fork a sub-shell, child process. In order for this to happen, the variable SHELL must point to a valid program. When it points to /dev/null instead, the sub-shell cannot be created. Note: This will not "disable" the "!" character from being recognized, and acted upon by Perform. It will only prevent it from having any meaningful effect. Thus, users can still issue the "!" command, but it will no longer allow them out or to execute programs. Another thing you might want to try, but which I've never done myself, is substitute /dev/null with a simple C program that might print out a message saying something to the effect, "Shell escape not allowed." and then exits. -- +--------------------+-------------------------------------------------------+ | Michael Faurot | Domain: mfaurot@bogart.UUCP | | ------- ------ | UUCP: ...uunet!media!ka3ovk!irscscm!bogart!mfaurot | +--------------------+-------------------------------------------------------+ | Fax: 202-927-3999 | The real problem is not whether machines think | | Tel: 202-927-2896 | but whether men do. --B.F. Skinner | +--------------------+-------------------------------------------------------+