Re: Network Security

Jack Parker wrote : > > First Cathy and now Lionel - maybe there's something wrong with our solution? > We discovered excatly what Cathy ran into. So perusing the I-Net/I-Star > manual (that weighty tome of knowledge!) we noticed that you could use .rhost > instead. Now each of our users has a .rhost file which lists themselves > from the current machine. So if I (jparker) were on hpbs9999@boi.hp.com > (A non-existing machine). My .rhost file would read: > > /users/jparker/.rhosts > > hpbs9999@boi.hp.com jparker > > > We implemented this over the past couple of days (we noticed the problem > last week) and have not run into any problems yet (except that you have to > fully specify the nodename as above). Are we living in a fool's paradise? > Or have we stumbled onto something better and finer.... The .rhosts entry is no more flexible than the hosts.equiv (which can have a user restriction on host), and there are two points that should be noted about the above method. Firstly you have not improved the original problem in stopping the user from having trusted host access to the database server. You are simply using a user controlled file to give access as opposed to SA controlled file. Secondly, as a general policy we find it very in-secure to allow users to be able to control which machines they can log onto. We run system audit procedures to disable anyone attempting to create such files. regards, _ (_)__________________________________ | | /| | | Lionel Waugh (_|_____________________________ | | Systems Analyst | / | | AWA Defence Industries | / | | PO Box 161 | Phone: +61 8 256 0373 / | | Elizabeth SA 5112 | Fax: +61 8 255 9117 < | | Australia | Email: lwaugh@awadi.com.au \\ |_|________________________________| \\ | | (______________________________\\ | |