RE: hosts.equiv and rlogin
Solaris 10 IDS 11.50.FC7 We are running HDR from a primary server to a secondary server. We have an entry in the hosts.equiv for that server. Is there any reason that we cannot remove/disable the "r" commands such as rlogin, rexec, etc. for security reasons? Any explanation on this subject would be appreciated. For security reasons, but to keep the functionality, can we just replace all of the "r" commands with the OpenSSH commands, and use slogin, etc.? Thank you.
In general for UNIX/Linux I would hope the "r" commands are gone already! If you need to functionality for Informix the better option is to move to 11.70 and use the new REMOTE_SERVER_CFG parameter to have a seperate hosts.equiv file for Informix. http://www-01.ibm.com/support/knowledgecenter/SSGU8G_11.70.0/com.ibm.adref.doc/i ds_adr_1123.htm Regards, David. > On 14 April 2015 at 17:42 LARRY SORENSEN <lsorensen25@msn.com> wrote: > > > Solaris 10 > IDS 11.50.FC7 > > We are running HDR from a primary server to a secondary server. We have an > entry in the hosts.equiv for that server. Is there any reason that we cannot > remove/disable the "r" commands such as rlogin, rexec, etc. for security > reasons? Any explanation on this subject would be appreciated. > > For security reasons, but to keep the functionality, can we just replace all > of the "r" commands with the OpenSSH commands, and use slogin, etc.? > > Thank you. > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. >
Hi, setting hosts.equiv for Informix has nothing to do with enabling/disabling rsh/rcmd. You do not need to have the services installed. Informix will search hosts.equiv for its own authentication and trust users from the named machines. In case you do not want to have Informix allow connections if you have rsh running, take a look at http://informix-technology.blogspot.de/2009/04/informix-authentication-and-conne ctions.html There is explained how Informix can be instructed to ignore the entries. In case you have these services running and you want to have separate authentication for informix, you should set the parameter REMOTE_SERVER_CFG in onconfig to a different path (I think this was present in 11.50). See the IBM documentation for this parameter for details. Marcus Haarmann ----- Ursprüngliche Mail ----- Von: "LARRY SORENSEN" <lsorensen25@msn.com> An: ids@iiug.org Gesendet: Dienstag, 14. April 2015 18:42:54 Betreff: RE: hosts.equiv and rlogin [34969] Solaris 10 IDS 11.50.FC7 We are running HDR from a primary server to a secondary server. We have an entry in the hosts.equiv for that server. Is there any reason that we cannot remove/disable the "r" commands such as rlogin, rexec, etc. for security reasons? Any explanation on this subject would be appreciated. For security reasons, but to keep the functionality, can we just replace all of the "r" commands with the OpenSSH commands, and use slogin, etc.? Thank you. ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.
Informix doesn't actually use the 'r' commands, just the library calls that implement 'R' style security. So, yes, you can remove executable bits from all of the 'r' commands or even delete them, even the rcmd daemon. Art Art S. Kagel, President and Principal Consultant ASK Database Management www.askdbmgt.com Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Tue, Apr 14, 2015 at 12:42 PM, LARRY SORENSEN <lsorensen25@msn.com> wrote: > Solaris 10 > IDS 11.50.FC7 > > We are running HDR from a primary server to a secondary server. We have an > entry in the hosts.equiv for that server. Is there any reason that we > cannot > remove/disable the "r" commands such as rlogin, rexec, etc. for security > reasons? Any explanation on this subject would be appreciated. > > For security reasons, but to keep the functionality, can we just replace > all > of the "r" commands with the OpenSSH commands, and use slogin, etc.? > > Thank you. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --001a1140375c020dca0513b31fec
Thank you all for the responses. Larry Sorensen > To: ids@iiug.org > From: art.kagel@gmail.com > Subject: Re: hosts.equiv and rlogin [34972] > Date: Tue, 14 Apr 2015 14:08:47 -0400 > > Informix doesn't actually use the 'r' commands, just the library calls that > implement 'R' style security. So, yes, you can remove executable bits from > all of the 'r' commands or even delete them, even the rcmd daemon. > > Art > > Art S. Kagel, President and Principal Consultant > ASK Database Management > www.askdbmgt.com > > Blog: http://informix-myview.blogspot.com/ > > Disclaimer: Please keep in mind that my own opinions are my own opinions > and do not reflect on the IIUG, nor any other organization with which I am > associated either explicitly, implicitly, or by inference. Neither do > those opinions reflect those of other individuals affiliated with any > entity with which I am affiliated nor those of the entities themselves. > > On Tue, Apr 14, 2015 at 12:42 PM, LARRY SORENSEN <lsorensen25@msn.com> > wrote: > > > Solaris 10 > > IDS 11.50.FC7 > > > > We are running HDR from a primary server to a secondary server. We have an > > entry in the hosts.equiv for that server. Is there any reason that we > > cannot > > remove/disable the "r" commands such as rlogin, rexec, etc. for security > > reasons? Any explanation on this subject would be appreciated. > > > > For security reasons, but to keep the functionality, can we just replace > > all > > of the "r" commands with the OpenSSH commands, and use slogin, etc.? > > > > Thank you. > > > > > > > > > ******************************************************************************* > > Forum Note: Use "Reply" to post a response in the discussion forum. > > > > > > --001a1140375c020dca0513b31fec > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. >