Insecure DB !
James F. Van Valkenburg <jfv@cbnewsk.att.com> writes -
> I have a unix script I use that can and does lock root out of a database. Its
> the shell version of an ESQL/C script I used before.
> It involved using database level permissions.
I was curious to know how this worked, so I cobbled one together
and it's stuck on the bottom of this note in case anyone else
wants one. It's okay for keeping the plebs out, but I'm afraid
it won't keep root out. NB. this behaviour is NOT a bug.
$ id
uid=106(theskett) gid=1(other)
$
$ isql foobar
387: No connect permission.
111: ISAM error: no record found.
--- isql screen appears here, exit it ---
$ suPassword: geriatrix
# isql foobar
387: No connect permission.
111: ISAM error: no record found.
--- isql screen appears here, exit it ---
# su - informix
$ isql foobar
--- isql screen appears here, can access any tables ---
PS. Should I have left user "informix" in sysusers ?
--
Cheers - Tony.
____________________________________________________________________________
Tony Heskett: theskett@lhr-sys.ssf-sys.dhl.com | Vox: (+44) 81 747 8330
DHL Systems : Kings House, Great West Road, TW8 9HS | Fax: (+44) 81 747 0875
----8<-------8<-------8<-------8<-------8<-------8<-------8<-------8<---
:
# Tighten up DB permissions.
# Gotta be logged in as informix.
#set -x
progname=`basename $0`
if [ $# -lt 1 ]
then
cat 1>&2 <<-EOF
usage to revoke all permissions: $progname database-name(s)
EOF
exit 1
fi
while [ $# -gt 0 ]
do
echo "delete from sysusers" | isql "$1" 2>/dev/null >/dev/null
if [ $? -ne 0 ]
then
cat 1>&2 <<-EOF
$progname: cannot delete from $1:sysusers
EOF
else
isql "$1" 2>/dev/null <<-EOF
output to pipe "isql $1" without headings
select "revoke all on ", tabname, " from public; "
from systables where tabid > 99
EOF
fi
shift
done