Re: No secrete to a root account holder under Informix

<snip> As master leffler indicated, since root is the merciless god of your users pitifull universe, an admin with a clue (or even knowledge of the man command) would have no problem getting dba privs. We could for instance, change your dba's password and login as them, think you'd see that. No, we'd copy the shadow file away and copy it back afterwards. AIX supports a login -f username (very usefull) instant shell. Trojans, no problem there. The long and the short of it is that the UNIX security model (all or whatever you get offered) is what you get, regardless of the database implemented security model. Don't even get me started on NT where I've seen 'access denied' attempting to open a file as an administrator... Not that NT is any more secure.... ech, the thought just makes my skin crawl. brett > > In this sense, at least, does Oracle appear more secure than Informix? > > Only superficially. > > The root user can trawl through the Oracle files and find the password > information, and either change it or decrypt it. Or they can infiltrate > their own software to intercept the user names and passwords. Or any of > a number of other things to find out how to log in as a privileged > database user. You can't stop a sufficiently educated root user -- > that's why you have to trust them. > > Unless you want to explain (in considerable detail) how Oracle prevents > root from breaking into the database under all possible circumstances. -- ----------------------------------------------------------------- Brett's 10th law of UNIX administration... rm is forever ----------------------------------------------------------------- Brett Geer - UNIX Admin/Analyst/Programmer - Intratex Holdings. Tel. +27 31 717 4000 Direct. +27 31 717 4146 Fax. +27 31 717 4001 ----------------------------------------------------------------- The little voices are talking to me again, telling me to reach for a keyboard and type rm -rf /* last week they had me rm -rf `echo $MANPATH | sed 's/:/ /g'` now I fear I have no answers -----------------------------------------------------------------