Re: user & group permission

I think it depends on what kind of execution permissions you have for the "Informix utilities" Mr Cheuk Kong Lo wrote: > > As part of the tightening security plan, I'm somewhat tempted to remove > most of our users from the informix group. Since we mostly use > r4gl, isql, 4gl debugger, it seems backend programs (fglgo blah) are run > ok, even user is not in the informix group. 'coz the execute permission for "others" might be enabled for these program(s) (fglgo, ...) > > So who is really _need_ or _should_ be in the informix group? Development > people sound like the ones, but what if I also remove them from the group? > you can remove them provided all the "informix utilities" they are using have the "others" execute permission enabled. It is better to keep only the user "informix" and other authorized users (who can start the informix server) in the "informix" group (that's what I do) and enable the group execute permission for the utilities they can access (oninit, ...). This might be a better idea (to remove developers from the "informix" group), as any user belonging to the "informix" group can start the server (provided oninit/tbinit has the group execution permission) > Thanks. > > Chris Hope this helps you. Vijay R. Anisetti