Re: creating users for informix

Art S. Kagel wrote: > > jamie kupka wrote: > > > > how do i create users for informix, such that the only access they have > > to my (solaris 2.5.1) box is to the database? > > Create the user on the server with a login but no passwd. Make sure no > other hosts are priveledged in /etc/hosts.equiv and that the users' > home directory (they can all share a single home directory since they > will not actually be logging in) has no .rhosts file. In the database > you can grant permissions to the database/tables/columns/procedures by > username or for public as needed. > If you mean by "no passwd" an empty field, how does this prevent the user from logging in? If you mean a "*" in the passwd field, I'm not sure what that does. What we do is give the user a login and password, but no shell. An example passwd entry would be: jablow:aGtw2hDxdTRQA:12345:123:Joseph A Blow:/:/bin/false This user cannot login, has no shell or home, but he does have a password for security reasons. > Another alternative is to have only one permitted login id on the > server. If access to the database is restricted to a well defined set > of applications these can all be owned by the enabled userid, which > does not have to be login-able even on the client machines, and run > with the suid bit set. > Of course with MS/ODBC-enabled tools, this means that anyone with the shared login and password has full access to all the tables owned by the dummy user. With MS-Query, you can go through the back door and insert, update, delete freely without the restrictions imposed by the frontend application. > Of course, all of this assumes that the clients are all UNIX clients. > For PC/Win95/WinNT clients since SETNET32 requires a valid login and > passwd on the server. Yet another reason to avoid the MS world! > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ I'm with you there. > Art S. Kagel -- Matt Reprogle IS Engineer, Delphi Delco Electronics Systems phone:(765)451-9651 FAX: (765)451-8230 mcreprog@ictest.delcoelect.com