network security

We have a system set up with two RS/6000s, one as our database server and one as a "software server". Our users rexec a command from their PCs to run our application on the latter machine. We run I-Net and I-Star for the communications between the machines. The users have to have IDs on both machines to allow them to perform transactions in the INFORMIX database, and the "software server" has an entry in the database server's hosts.equiv file for the same reason. This setup currently allows the users, if they know the correct commands, to log directly into the software server and then rlogin into the database server without a password. Does anyone have any suggestions on how to tighten up security within AIX to prevent the users from doing this kind of thing, but still allow the INFORMIX functions to work? Ideally we would like them to only be able to run the applications we give them access to and to not be able to get to the database server at all (except with the database queries in the applications). Thanks. Cathy J. Senft Internet: cjsenft@lexmark.com Lexmark International, Inc. Phone: (606) 232-7194 740 New Circle Rd. NW Fax: (606) 232-2177 Lexington, KY 40511-1876