Re: Gaping security hole? (network db connections)

Anders Hackin' Karlsson <anders.karlsson@karlsson.pp.se> wrote: > I'm not getting in to this discussion if .rhosts/hosts.equiv is bad > or not. I'll just comment on a factoid. As you state that anyone can > play with the PC hostaddresses, connecting from a DOS/WIN/NT PC to > Informix is different than connecting from a UNIX box. Last time I check > the code this was very clear (which was a long time ago, 3 years or so) > it was there, and if you test it, you'll see I'm right. This was > introduced in OnLine 5 something I think. > When connecting from a PC, the password is always validated using > getpwent() or whatever the system call is, I forgot it and I'm too lazy > to look it up. > Now, if your end users are on PC's running SCO or UnixWare of > whatever, then things are different. > Rgds > Karlsson > BTW. I didn't read all your communication (it was a lot) so this point > might have already been made. In that case, I apologize... > Michael Segel wrote: > [snip snip] The point above wasn't raised, but this problem only has to do with unix<->unix connections that don't involve a password. As far as I can tell, the same problem is present in Informix 7.10 as well. -- Nathan ------------------------------------------------------------ Nathan Neulinger Univ. of Missouri - Rolla EMail: nneul@umr.edu Computer Center WWW: http://www.umr.edu/~nneul SysAdmin: rollanet.org