user can still connect after CONNECT privilege get revoked

Posted in 2005

Summary

Lan revoked CONNECT from a user and from PUBLIC, but the user could still connect. Jonathan Leffler first asked whether PUBLIC had CONNECT and suggested checking informix.sysusers, which showed U1 with usertype R (resource). He explained the fix: REVOKE RESOURCE FROM U1 first, then REVOKE CONNECT FROM U1, leaving only PUBLIC privileges. Solved.

Auto-generated by Claude from the posts below — may be imperfect; read the full thread.

Topics: Security, Permissions & Auditing

lanegroups@go.com — 18 Jun 2005 12:42:22 -0700 — source: Usenet: comp.databases.informix

Hi, I have revoked the connect privilege from a user. The user is not admin. Still, the user can connect to the database. How to revoke the CONNECT privilege indeed from a user? How to check a user can't connect (e.g. catalog table or user setup) without letting the user try to connect? Thanks, Lan

↪ replying to lanegroups@go.com

Jonathan Leffler — Sat, 18 Jun 2005 22:09:30 GMT — source: Usenet: comp.databases.informix

lanegroups@go.com wrote: > I have revoked the connect privilege from a user. The user is not > admin. Still, the user can connect to the database. > > How to revoke the CONNECT privilege indeed from a user? > How to check a user can't connect (e.g. catalog table or user setup) > without letting the user try to connect? Can PUBLIC connect? If so, anyone can. SELECT * FROM informix.sysusers; -- Jonathan Leffler #include <disclaimer.h> Email: jleffler@earthlink.net, jleffler@us.ibm.com Guardian of DBD::Informix v2005.01 -- http://dbi.perl.org/

↪ replying to Jonathan Leffler

lanegroups@go.com — 18 Jun 2005 16:12:28 -0700 — source: Usenet: comp.databases.informix

CONNECT is revoked from PUBLIC as well: U2 issed the following: revoke CONNECT FROM U1; REVOKE CONNECT FROM PUBLIC ; U1 can still connect after that. SELECT * FROM informix.sysusers; username usertype priority password -------------------------------- -------- -------- ---------------- informix D 9 U1 R 5 U2 D 5 Does the usertype for U1 has problem or anything else missing? Thanks.

↪ replying to lanegroups@go.com

Jonathan Leffler — Sun, 19 Jun 2005 02:03:19 GMT — source: Usenet: comp.databases.informix

lanegroups@go.com wrote: > CONNECT is revoked from PUBLIC as well: > U2 issed the following: > revoke CONNECT FROM U1; > REVOKE CONNECT FROM PUBLIC ;> > U1 can still connect after that. > > SELECT * FROM informix.sysusers;> > username usertype priority password > -------------------------------- -------- -------- ---------------- > informix D 9 > U1 R 5 > U2 D 5 > > Does the usertype for U1 has problem or anything else missing? U1 has resource (R); you have to do: REVOKE RESOURCE FROM U1;-- U1 now only has CONNECT (C) REVOKE CONNECT FROM U1;-- Now U1 only has PUBLIC privileges -- And, since public doesn't have any, neither does U1. -- Jonathan Leffler #include <disclaimer.h> Email: jleffler@earthlink.net, jleffler@us.ibm.com Guardian of DBD::Informix v2005.01 -- http://dbi.perl.org/