Re: Informix-NET and trusted host access

Jonathan Leffler replied :- > The problem is: if you don't have trusted status, how are you going to > provide the user ID and password for network access? What about if a query > in the application suddenly refers to a remote database, possibly via a > synonym and you weren't even aware that the table was in another database? > If the sqlexec program was using RPC calls then there is no requirement for user id and password to access the network. However you do lose one benefit (that needs to be replaced), and that is a verification of the Host initiating the request. As for a query referring to a remote database - then your current structure would still hold as I am only suggesting that you change the network communication protocol. > If you want a secure system, you don't have network access. You can, of > course, require indiviuals (including informix) to have .rhosts entries > instead of using hosts.equiv. Unfortunately, the concept of '.rhosts' is one of the most frightning to a security concience administator. The fact that a user can govern their own access to the network is horrific. But this is neither your fault nor your problem, however I would suggest that you stear well away from this facility. We spend a great deal of time disabling it. > > Or, put another way, how would you make the system secure without > compromising the ease of use? Give me a counter-proposal. The use of RPC calls would remove your dependancy from rshd protocol checks, and allow you to use your own Host and user id checking. It would also give you the opportunity to add communications cookie's and protocol checks - If you wanted to go to a fully secured system. I guess the main idea here is to divorce the database server access requirements away from the system utilities (rsh, rcp, etc) access requirements. Please get back to me if you need any clarification, and thanks for the interested response. regards, Lionel Waugh Systems Analyst AWA Defence Industries Phone: +61 8 256 0373 PO Box 161 Fax: +61 8 255 9117 Elizabeth SA 5112 Email: lwaugh@awadi.com.au Australia