Re: Gaping security hole? (network db connections)

> > and look at what a connection looks like, and then send that same data to > > our central server. > > > > The problem here isn't the usual security problems with BSD .rhosts / > > hosts.equiv mechanism. We've accepted those. And if it were only that, > > this wouldn't be a problem. > > > No, you may know the protocol, however you have to also send the > passwd too! This passwd has to reside in the UNIX server. > Now, you can make a client machine trusted for one user. > However, the problem is that you can't trust that PC. > (Some like to store their passwd on the PC so that it is automatically > sent.) That's the whole point... The purpose of using hosts.equiv is so that a matching user on the remote host doesn't HAVE to send a password. -- Nathan ------------------------------------------------------------ Nathan Neulinger Univ. of Missouri - Rolla EMail: nneul@umr.edu Computer Center WWW: http://www.umr.edu/~nneul SysAdmin: rollanet.org