Re: Informix and trusted host access

John Carter wrote Re: Informix-NET and trusted host access > > This involves using DES and a fair amount of C code on both client and > server to perform the handshaking between systems and ensure that > someone isn't trying to sneak in their own packet and break in. > It is necessary to turn off the trusted host mechanism and use > encrypted packets with special key generated access codes on each > transmission set. > > This should suffice to get the juices going and to let you know that > to my knowledge proprietary code _is_ required to enforce system security. > > I would be surprised to find that any database expert can find a way to > imbed trusted host security into a database engine, but I'm also just as > sure it can be done. While I agree with you about the work needed to guarentee network security access, I still do not like the fact that Informix have tied their access checking to that required by dangerous(*) system utilities like 'rlogin', 'rsh', ..etc. Thereby giving users access to machines that they really only need database communications with. What I have proposed to Informix (not yet had a reply) is that instead of relying on trusted host access (/etc/hosts and .rhosts) that by using RPC calls and their own list of trusted hosts ($INFORMIXDIR/etc/hosts) they would have the same level of network security but not reduce the general level of network security by opening up the system utilities access. BTW it seems the Informix-Star has the same limitation so I am widening this discussion to Informix and trusted host access regards, Lionel Waugh Systems Analyst AWA Defence Industries Phone: +61 8 256 0373 PO Box 161 Fax: +61 8 255 9117 Elizabeth SA 5112 Email: lwaugh@awadi.com.au Australia