Re: How to prevent user connect with ids

Eric Rowell 寫道： > Other option... Man I cannot belive I forgot it... Then again I > don't know if it is an option in AIX 5.2 (it is in AIX 5.3). > > Start Filters and the highest level for getting to configurations; > smitty ipsec4 > smitty ipsec6 > > More Options to allow for configurations; > smitty ips4_advanced > smitty ips6_advanced > > Configure Rules for Filter this is where you can get to set what is > really needed; > smitty ips4_conf_filter > smitty ips6_conf_filter > > High Level Notes about it for AIX 5.3; > http://www-03.ibm.com/systems/p/security/feature/enhancements.html > > Some more Details; > http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.security/doc/security/ipsec_migrate_filters.htm > > > Note I have not completed testing of this option. The nice thing is I > can allow for some host to reach the server when others are not > allowed. Remember like with most firewalls once a rule is reached > that fits the packet processing stops. So make sure allows are before > deny. > > Eric B. Rowell > > > http://www-03.ibm.com/servers/aix/os/52desc.html > > On 12/18/06, Ian Michael Gumby <im_gumby@hotmail.com> wrote: > > > > Uhm yeah that would work. > > > > If you don't have any TCP/IP connection defined in your > > $INFORMIXDIR/etc/sqlhosts > > that would be the safest if you don't want *ANY* outside connection. The > > major drawback would be if you had a 4gl app that was on another machine.... > > > > Another solution would be to write you own PAM module ... > > But thats another story and a bit harder to do, provided that Informix is > > fully supporting PAM in both 32 and 64 bit configs. > > > > > > > >The shared memory option is preferred but my second favorite... Use > > >the localback as your host address. This will prevent any network > > >outside of the local system (without a route being configured) to > > >attach to the serverl. Again preferred is shared memory... Don't > > >configure any TCPIP at all. > > > > > >Eric B. Rowell > > > > > > > > >On 18 Dec 2006 09:15:26 -0800, scottishpoet <dryburghj@yahoo.com> wrote: > > > > set up shared memory connections and use that connection protocol for > > > > your 4gl prgrams > > > > > > > > don't set up any tcpip connections > > > > > > > > > > > > roger@star2000.com.tw wrote: > > > > > Hi, > > > > > MY box is ids 9.40 on AIX 5.2. > > > > > How can I make a user that he can telnet to the AIX and run 4gl > > > > > program, > > > > > But prevent him from connecting to the informix server from Delphi & > > > > > client -sdk ? > > > > > > > > _______________________________________________ > > > > Informix-list mailing list > > > > Informix-list@iiug.org > > > > http://www.iiug.org/mailman/listinfo/informix-list > > > > > > >_______________________________________________ > > >Informix-list mailing list > > >Informix-list@iiug.org > > >http://www.iiug.org/mailman/listinfo/informix-list > > > > _________________________________________________________________ > > Your Hotmail address already works to sign into Windows Live Messenger! Get > > it now > > http://clk.atdmt.com/MSN/go/msnnkwme0020000001msn/direct/01/?href=http://get.live.com/messenger/overview > > > > I meand that some users will alowed to telnet to the AIX box, But not allowed to connect to the server from delphi at windows.

If you want to allow users to telnet but not run Delphi, You can either not set up any TCP/IP ports, or if you do, then use your firewall to restrict access to the TCP/IP port that you have set up for Informix. This way you can still allow telnet. (shared memory or TCP/IP access) and disallow any outside TCP/IP connections. Or use the loopback (127.0.0.1) address. Which is kind of an ugly kludge. >From: roger@star2000.com.tw >To: informix-list@iiug.org >Subject: Re: How to prevent user connect with ids >Date: 19 Dec 2006 20:00:19 -0800 >MIME-Version: 1.0 >Received: from perform.iiug.org ([216.177.38.211]) by >bay0-mc1-f9.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444); Tue, 19 >Dec 2006 20:04:43 -0800 >Received: by perform.iiug.org (Postfix, from userid 60001)id B57479FA8; >Tue, 19 Dec 2006 22:55:22 -0500 (EST) >Received: from perform.iiug.org (localhost [127.0.0.1])by perform.iiug.org >(Postfix) with ESMTP id 93CD89FB4;Tue, 19 Dec 2006 22:55:16 -0500 (EST) >X-Message-Info: LsUYwwHHNt2Rk9+JqdtVWgWzWTy29KcURJhdIzBmvPs= >X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on perform.iiug.org >X-Spam-Level: X-Spam-Status: No, score=-2.3 required=5.0 >tests=ALL_TRUSTED,AWL,BAYES_00,MIME_BASE64_NO_NAME,MIME_BASE64_TEXT,NO_REAL_NAME >autolearn=no version=3.1.0 >Path: >nnrp.xmission!xmission!newsfeed.telusplanet.net!newsfeed.telus.net!newsswing.news.prodigy.com.MISMATCH!newscon04.news.prodigy.net!prodigy.net!newshub.sdsu.edu!postnews.google.com!48g2000cwx.googlegroups.com!not-for-mail >Newsgroups: comp.databases.informix >Organization: http://groups.google.com >Lines: 103 >References: ><1c8a9b210612181357t546b7c10se151396cc327b78e@mail.gmail.com><BAY102-F1D1A518D10055ABBA1C04F0C80@phx.gbl><mailman.642.1166535417.29126.informix-list@iiug.org> >NNTP-Posting-Host: 221.169.171.113 >X-Trace: posting.google.com 1166587225 19629 127.0.0.1 (20 Dec 2006 >04:00:25GMT) >X-Complaints-To: groups-abuse@google.com >NNTP-Posting-Date: Wed, 20 Dec 2006 04:00:25 +0000 (UTC) >User-Agent: G2/1.0 >X-HTTP-UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.0; zh-TW;rv:1.7.2) >Gecko/20040804 Netscape/7.2(ax),gzip(gfe),gzip(gfe) >Complaints-To: groups-abuse@google.com >Injection-Info: 48g2000cwx.googlegroups.com; >posting-host=221.169.171.113;posting-account=gpy-jgwAAAC4Hy3IG_Oj4eAMn1he8WAm >Xref: nnrp.xmission comp.databases.informix:194930 >X-BeenThere: informix-list@iiug.org >X-Mailman-Version: 2.1.6 >Precedence: list >List-Id: "comp.databases.informix" <informix-list.iiug.org> >List-Unsubscribe: ><http://www.iiug.org/mailman/listinfo/informix-list>,<mailto:informix-list-request@iiug.org?subject=unsubscribe>; >List-Archive: <http://www.iiug.org/pipermail/informix-list>; >List-Post: <mailto:informix-list@iiug.org> >List-Help: <mailto:informix-list-request@iiug.org?subject=help> >List-Subscribe: ><http://www.iiug.org/mailman/listinfo/informix-list>,<mailto:informix-list-request@iiug.org?subject=subscribe>; >Errors-To: informix-list-bounces@iiug.org >Return-Path: informix-list-bounces@iiug.org >X-OriginalArrivalTime: 20 Dec 2006 04:04:43.0531 (UTC) >FILETIME=[FACC05B0:01C723EB] > > >Eric Rowell 'g'D'G > > > Other option... Man I cannot belive I forgot it... Then again I > > don't know if it is an option in AIX 5.2 (it is in AIX 5.3). > > > > Start Filters and the highest level for getting to configurations; > > smitty ipsec4 > > smitty ipsec6 > > > > More Options to allow for configurations; > > smitty ips4_advanced > > smitty ips6_advanced > > > > Configure Rules for Filter this is where you can get to set what is > > really needed; > > smitty ips4_conf_filter > > smitty ips6_conf_filter > > > > High Level Notes about it for AIX 5.3; > > http://www-03.ibm.com/systems/p/security/feature/enhancements.html > > > > Some more Details; > > >http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.security/doc/security/ipsec_migrate_filters.htm > > > > > > Note I have not completed testing of this option. The nice thing is I > > can allow for some host to reach the server when others are not > > allowed. Remember like with most firewalls once a rule is reached > > that fits the packet processing stops. So make sure allows are before > > deny. > > > > Eric B. Rowell > > > > > > http://www-03.ibm.com/servers/aix/os/52desc.html > > > > On 12/18/06, Ian Michael Gumby <im_gumby@hotmail.com> wrote: > > > > > > Uhm yeah that would work. > > > > > > If you don't have any TCP/IP connection defined in your > > > $INFORMIXDIR/etc/sqlhosts > > > that would be the safest if you don't want *ANY* outside connection. >The > > > major drawback would be if you had a 4gl app that was on another >machine.... > > > > > > Another solution would be to write you own PAM module ... > > > But thats another story and a bit harder to do, provided that Informix >is > > > fully supporting PAM in both 32 and 64 bit configs. > > > > > > > > > > >The shared memory option is preferred but my second favorite... Use > > > >the localback as your host address. This will prevent any network > > > >outside of the local system (without a route being configured) to > > > >attach to the serverl. Again preferred is shared memory... Don't > > > >configure any TCPIP at all. > > > > > > > >Eric B. Rowell > > > > > > > > > > > >On 18 Dec 2006 09:15:26 -0800, scottishpoet <dryburghj@yahoo.com> >wrote: > > > > > set up shared memory connections and use that connection protocol >for > > > > > your 4gl prgrams > > > > > > > > > > don't set up any tcpip connections > > > > > > > > > > > > > > > roger@star2000.com.tw wrote: > > > > > > Hi, > > > > > > MY box is ids 9.40 on AIX 5.2. > > > > > > How can I make a user that he can telnet to the AIX and run 4gl > > > > > > program, > > > > > > But prevent him from connecting to the informix server from >Delphi & > > > > > > client -sdk ? > > > > > > > > > > _______________________________________________ > > > > > Informix-list mailing list > > > > > Informix-list@iiug.org > > > > > http://www.iiug.org/mailman/listinfo/informix-list > > > > > > > > >_______________________________________________ > > > >Informix-list mailing list > > > >Informix-list@iiug.org > > > >http://www.iiug.org/mailman/listinfo/informix-list > > > > > > _________________________________________________________________ > > > Your Hotmail address already works to sign into Windows Live >Messenger! Get > > > it now > > > >http://clk.atdmt.com/MSN/go/msnnkwme0020000001msn/direct/01/?href=http://get.live.com/messenger/overview > > > > > > > >I meand that some users will alowed to telnet to the AIX box, >But not allowed to connect to the server from delphi at windows. > >_______________________________________________ >Informix-list mailing list >Informix-list@iiug.org >http://www.iiug.org/mailman/listinfo/informix-list _________________________________________________________________ Visit MSN Holiday Challenge for your chance to win up to $50,000 in Holiday cash from MSN today! http://www.msnholidaychallenge.com/in