Re: Security for Informix

> > I remember that not too long ago, there was some discussion concerning > security for Informix. I would like to know whether there is any > comprehensive solution that can plug the holes due to the use of hosts.equiv > as required by Informix. Or is it an 'incurable' problem? > > As it stands at the moment, I have made some suggestions for improvements (not had any reply), and I have found a bug (feature ?) that helps reduce the problem. Informix's validation of the hosts.equiv file allows the last corresponding entry to override earlier entries, but system software checks take the first entry as overriding all others. Therefore if you setup your hosts.equiv with :- -{host name} +{host name} the system services (rlogin, rsh, ..etc) will fail the trusted host access, but the Informix products still pass the trusted host check and allow database comms. N.B. This fudge may not last, because it may well be fixed (!!) in later versions. regards, Lionel Waugh Systems Analyst AWA Defence Industries Phone: +61 8 256 0373 PO Box 161 Fax: +61 8 255 9117 Elizabeth SA 5112 Email: lwaugh@awadi.com.au Australia