Re: Gaping security hole? (network db connections)

Michael Segel <"MailerDaemon"@[127.0.0.1]> wrote: > Nathan Neulinger wrote: > > > > Is it just me misreading things, or is there no security whatsoever in the > > network sqlexec connections to an informix DB server? > > > I'll give you the short answer. > Yes and No. > Don't use .rhosts . > Using hosts.equiv works, and you do have authentication, > however, at what price. How so? /etc/hosts.equiv and ~/.rhosts both use the same mechanism for authenticating the connecting user. Basically it boils down to this: In any case, I am using hosts.equiv. The only difference to my knowledge is that hosts.equiv is not functional for root. The sqlexec process on the client is running as 'joeuser'. Anything that a process running as 'joeuser' can do, so can a process running as 'freduser'. The only way .rhosts/hosts.equiv works is that remsh/rlogin/rcp are all setuid root, and open a connection with the source port being a secure port. The reason for that is, only root can open a connection on a secure port, hence, if a connection comes from a secure port, it has to have been made by root, or a root authorized process. Since the remote host is trusted, that means we can trust root on that host to tell us who the user really is. As near as I can tell, there is nothing that would prevent me from replaying a sqlexec connection, and just changing the userid. I'm sure that there are other fields that would need to be matched up (i.e. length, etc.), but that can be done with a little work. -- Nathan ------------------------------------------------------------ Nathan Neulinger Univ. of Missouri - Rolla EMail: nneul@umr.edu Computer Center WWW: http://www.umr.edu/~nneul SysAdmin: rollanet.org