RE: -952 Authentication Error on Solaris 10
Nate hit a -952 authentication error connecting to IDS 9.40 on a Solaris 10 test box, while an identically configured production server worked. Suggestions included checking that oninit is owned by root with the suid bit set (permissions were fine) and adding .rhosts/hosts.equiv — which Nate tried without effect, and which Fernando Nunes noted only apply to implicit (passwordless) connections, not password-based ones. The thread then drifted into a security debate about .rhosts/hosts.equiv and the Morris worm; no resolution to the -952 error is recorded.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
Hallo Nate,
You have .rhosts or hosts.equiv set up? AFAIK they are needed with ssh to.
Regards
Reinhard
> -----Original Message-----
> From: informix-list-bounces@iiug.org
> [mailto:informix-list-bounces@iiug.org]On Behalf Of nateman@kc.rr.com
> Sent: Friday, March 27, 2009 1:39 PM
> To: informix-list@iiug.org
> Subject: Re: -952 Authentication Error on Solaris 10
>
>
> On Mar 27, 5:44 am, superbo...@t-online.de wrote:
> > Hello Nate,
> >
> > maybe oninit does not have suid bits set or is not owned by root??
> > eq
> >
> > -rwsr-sr-- 1 root informix
> >
> > Superboer.
> >
> > On 27 mrt, 00:53, wcottishpoet <drybur...@yahoo.com> wrote:
> >
> > > No idea what the problem is but IDS 9.40 will not be
> supported by IBM
> > > after next month
> >
> > > Do you have plans to upgrade to IDS 11?
>
> Permissions on oninit are correct.
> I know IDS9 is on the way out, and we're certifying IDS 11.5 right
> now, but that's still going to be several months out.
> Thanks,
> Nate
> _______________________________________________
> Informix-list mailing list
> Informix-list@iiug.org
> http://www.iiug.org/mailman/listinfo/informix-list
>
On Mar 27, 7:59 am, "Habichtsberg, Reinhard" <RHabichtsb...@arz-
emmendingen.de> wrote:
> Hallo Nate,
>
> You have .rhosts or hosts.equiv set up? AFAIK they are needed with ssh to.
>
> Regards
> Reinhard
>
> > -----Original Message-----
> > From: informix-list-boun...@iiug.org
> > [mailto:informix-list-boun...@iiug.org]On Behalf Of nate...@kc.rr.com
> > Sent: Friday, March 27, 2009 1:39 PM
> > To: informix-l...@iiug.org
> > Subject: Re: -952 Authentication Error on Solaris 10
>
> > On Mar 27, 5:44 am, superbo...@t-online.de wrote:
> > > Hello Nate,
>
> > > maybe oninit does not have suid bits set or is not owned by root??
> > > eq
>
> > > -rwsr-sr-- 1 root informix
>
> > > Superboer.
>
> > > On 27 mrt, 00:53, wcottishpoet <drybur...@yahoo.com> wrote:
>
> > > > No idea what the problem is but IDS 9.40 will not be
> > supported by IBM
> > > > after next month
>
> > > > Do you have plans to upgrade to IDS 11?
>
> > Permissions on oninit are correct.
> > I know IDS9 is on the way out, and we're certifying IDS 11.5 right
> > now, but that's still going to be several months out.
> > Thanks,
> > Nate
> > _______________________________________________
> > Informix-list mailing list
> > Informix-l...@iiug.org
> >http://www.iiug.org/mailman/listinfo/informix-list
Reinhard
These files are not set up on the functioning production server. I
tried adding a hosts.equiv on the test server, but it didn't get rid
of the error.
Thanks,
Nate
> From: nateman@kc.rr.com > Subject: Re: -952 Authentication Error on Solaris 10 > Date: Fri, 27 Mar 2009 06:20:48 -0700 > To: informix-list@iiug.org > > On Mar 27, 7:59 am, "Habichtsberg, Reinhard" <RHabichtsb...@arz- > emmendingen.de> wrote: > > Hallo Nate, > > > > You have .rhosts or hosts.equiv set up? AFAIK they are needed with ssh to. > > > > Regards > > Reinhard No they are not! (unless you don't want to supply password.) DO NOT USE .rhosts! LIMIT USE OF hosts.equiv ONLY TO MACHINES THAT YOU CAN *TRUST* AND ARE PART OF YOUR BACK END SOLUTION. Most of you kiddies are too young to remember the Morris worm back in the late 80's. ('88 I think) One of the attack vectors was via .rhosts so that the worm spread very quickly once the local network was breached. He used two other vectors of attack that worked on DEC and Sun. I believe both were buffer over flow attacks. (Which existed in Sun, SCO, and others long after the attack was known.) Sorry for the rant, but its a major security faux pas and when you use host.equiv, you really need to know that the other host is a host and one that you can trust. -G _________________________________________________________________ Windows Live™ SkyDrive: Get 25 GB of free online storage. http://windowslive.com/online/skydrive?ocid=TXT_TAGLM_WL_skydrive_032009
nateman@kc.rr.com wrote:
> On Mar 27, 7:59 am, "Habichtsberg, Reinhard" <RHabichtsb...@arz-
> emmendingen.de> wrote:
>> Hallo Nate,
>>
>> You have .rhosts or hosts.equiv set up? AFAIK they are needed with ssh to.
>>
>> Regards
>> Reinhard
>>
>>> -----Original Message-----
>>> From: informix-list-boun...@iiug.org
>>> [mailto:informix-list-boun...@iiug.org]On Behalf Of nate...@kc.rr.com
>>> Sent: Friday, March 27, 2009 1:39 PM
>>> To: informix-l...@iiug.org
>>> Subject: Re: -952 Authentication Error on Solaris 10
>>> On Mar 27, 5:44 am, superbo...@t-online.de wrote:
>>>> Hello Nate,
>>>> maybe oninit does not have suid bits set or is not owned by root??
>>>> eq
>>>> -rwsr-sr-- 1 root informix
>>>> Superboer.
>>>> On 27 mrt, 00:53, wcottishpoet <drybur...@yahoo.com> wrote:
>>>>> No idea what the problem is but IDS 9.40 will not be
>>> supported by IBM
>>>>> after next month
>>>>> Do you have plans to upgrade to IDS 11?
>>> Permissions on oninit are correct.
>>> I know IDS9 is on the way out, and we're certifying IDS 11.5 right
>>> now, but that's still going to be several months out.
>>> Thanks,
>>> Nate
>>> _______________________________________________
>>> Informix-list mailing list
>>> Informix-l...@iiug.org
>>> http://www.iiug.org/mailman/listinfo/informix-list
>
> Reinhard
> These files are not set up on the functioning production server. I
> tried adding a hosts.equiv on the test server, but it didn't get rid
> of the error.
> Thanks,
> Nate
Those files are used for "implicit" connections. Not for explicit (using
password) connections.
Regards.
--
Fernando Nunes
Portugal
http://informix-technology.blogspot.com
My email works... but I don't check it frequently...
On Mar 27, 8:17 pm, Fernando Nunes <domusonl...@gmail.com> wrote:
> nate...@kc.rr.com wrote:
> > On Mar 27, 7:59 am, "Habichtsberg, Reinhard" <RHabichtsb...@arz-
> > emmendingen.de> wrote:
> >> Hallo Nate,
>
> >> You have .rhosts or hosts.equiv set up? AFAIK they are needed with ssh to.
>
> >> Regards
> >> Reinhard
>
> >>> -----Original Message-----
> >>> From: informix-list-boun...@iiug.org
> >>> [mailto:informix-list-boun...@iiug.org]On Behalf Of nate...@kc.rr.com
> >>> Sent: Friday, March 27, 2009 1:39 PM
> >>> To: informix-l...@iiug.org
> >>> Subject: Re: -952 Authentication Error on Solaris 10
> >>> On Mar 27, 5:44 am, superbo...@t-online.de wrote:
> >>>> Hello Nate,
> >>>> maybe oninit does not have suid bits set or is not owned by root??
> >>>> eq
> >>>> -rwsr-sr-- 1 root informix
> >>>> Superboer.
> >>>> On 27 mrt, 00:53, wcottishpoet <drybur...@yahoo.com> wrote:
> >>>>> No idea what the problem is but IDS 9.40 will not be
> >>> supported by IBM
> >>>>> after next month
> >>>>> Do you have plans to upgrade to IDS 11?
> >>> Permissions on oninit are correct.
> >>> I know IDS9 is on the way out, and we're certifying IDS 11.5 right
> >>> now, but that's still going to be several months out.
> >>> Thanks,
> >>> Nate
> >>> _______________________________________________
> >>> Informix-list mailing list
> >>> Informix-l...@iiug.org
> >>>http://www.iiug.org/mailman/listinfo/informix-list
>
> > Reinhard
> > These files are not set up on the functioning production server. I
> > tried adding a hosts.equiv on the test server, but it didn't get rid
> > of the error.
> > Thanks,
> > Nate
>
> Those files are used for "implicit" connections. Not for explicit (using
> password) connections.
>
> Regards.
>
> --
> Fernando Nunes
> Portugal
And you should never, ever use them except in a very controlled
environment. Hosts.equiv that is. NEVER EVER USE .rhosts, or
ALLOW .rhosts ON YOUR SYSTEMS. But then again, you're probably too
young to know who Morris was or who his father was.... ;-)
(Sort of like never pointing a gun at someone unless its loaded and
you intend to pull the trigger if necessary.)
Ian Michael Gumby wrote:
> On Mar 27, 8:17 pm, Fernando Nunes <domusonl...@gmail.com> wrote:
>> nate...@kc.rr.com wrote:
>>> On Mar 27, 7:59 am, "Habichtsberg, Reinhard" <RHabichtsb...@arz-
>>> emmendingen.de> wrote:
>>>> Hallo Nate,
>>>> You have .rhosts or hosts.equiv set up? AFAIK they are needed with ssh to.
>>>> Regards
>>>> Reinhard
>>>>> -----Original Message-----
>>>>> From: informix-list-boun...@iiug.org
>>>>> [mailto:informix-list-boun...@iiug.org]On Behalf Of nate...@kc.rr.com
>>>>> Sent: Friday, March 27, 2009 1:39 PM
>>>>> To: informix-l...@iiug.org
>>>>> Subject: Re: -952 Authentication Error on Solaris 10
>>>>> On Mar 27, 5:44 am, superbo...@t-online.de wrote:
>>>>>> Hello Nate,
>>>>>> maybe oninit does not have suid bits set or is not owned by root??
>>>>>> eq
>>>>>> -rwsr-sr-- 1 root informix
>>>>>> Superboer.
>>>>>> On 27 mrt, 00:53, wcottishpoet <drybur...@yahoo.com> wrote:
>>>>>>> No idea what the problem is but IDS 9.40 will not be
>>>>> supported by IBM
>>>>>>> after next month
>>>>>>> Do you have plans to upgrade to IDS 11?
>>>>> Permissions on oninit are correct.
>>>>> I know IDS9 is on the way out, and we're certifying IDS 11.5 right
>>>>> now, but that's still going to be several months out.
>>>>> Thanks,
>>>>> Nate
>>>>> _______________________________________________
>>>>> Informix-list mailing list
>>>>> Informix-l...@iiug.org
>>>>> http://www.iiug.org/mailman/listinfo/informix-list
>>> Reinhard
>>> These files are not set up on the functioning production server. I
>>> tried adding a hosts.equiv on the test server, but it didn't get rid
>>> of the error.
>>> Thanks,
>>> Nate
>> Those files are used for "implicit" connections. Not for explicit (using
>> password) connections.
>>
>> Regards.
>>
>> --
>> Fernando Nunes
>> Portugal
>
> And you should never, ever use them except in a very controlled
> environment. Hosts.equiv that is. NEVER EVER USE .rhosts, or
> ALLOW .rhosts ON YOUR SYSTEMS. But then again, you're probably too
> young to know who Morris was or who his father was.... ;-)
>
> (Sort of like never pointing a gun at someone unless its loaded and
> you intend to pull the trigger if necessary.)
>
As usual, we're getting completely off-topic... but...
You don't need to be hanging on a tree to know who/what the "missing link"
was... As such, people younger than you surely have heard about or have read
about the internet worm... and precisely because of that, I went digging...
As it happens very often, you're confusing .rhosts/hosts.equiv with the
services that use them. If you care about a safe environment than turn off the
services... the files per si are just that... files.
The worm used the r* commands to spread inside the networks, and
sendmail/finger to spread across networks. It actually took advantage of a
buffer overflow issue in sendmail/finger... it become so well know, probably
because it was the first one to spread in such a large scale... not because it
does anything special (at the time it might have been, but today it's just a
trivial attack).
In short: you can use the files for Informix, if your r* services are not
running. Also, Informix does allow configuration options in order to look for
only one of the files or both.
Regards.
--
Fernando Nunes
Portugal
http://informix-technology.blogspot.com
My email works... but I don't check it frequently...