Re: network security

Cathy J. Senft wrote : > We have a system set up with two RS/6000s, one as our database > server and one as a "software server". Our users rexec a command from > their PCs to run our application on the latter machine. We run I-Net > and I-Star for the communications between the machines. The users > have to have IDs on both machines to allow them to perform transactions > in the INFORMIX database, and the "software server" has an entry in the > database server's hosts.equiv file for the same reason. This > setup currently allows the users, if they know the correct commands, > to log directly into the software server and then rlogin into the > database server without a password. Does anyone have any suggestions on > how to tighten up security within AIX to prevent the users from doing > this kind of thing, but still allow the INFORMIX functions to work? > > Ideally we would like them to only be able to run the applications > we give them access to and to not be able to get to the database server > at all (except with the database queries in the applications). > This has been a thorn-in-my-side for some time now, and the only response I can get from Informix is that it is a limitation of I-Net and I-Star... I have found (on my platform) that there is a bug in the way the trusted host access for Informix works and this can help tighten security. When doing its trusted host validation it takes the last entry as overriding earlier ones. Our system software takes the first entry as overriding later ones, so I have tried the following /etc/hosts.equiv file :- -{host name} +{host name} which allows Informix to talk (as the trusted host check passes), but does not allow other system utilities (rsh, rlogin, ..etc) to pass their trusted host checks. Give this a whirl, but be aware that even if it works now it may be 'fixed' later. regards, _ (_)__________________________________ | | /| | | Lionel Waugh (_|_____________________________ | | Systems Analyst | / | | AWA Defence Industries | / | | PO Box 161 | Phone: +61 8 256 0373 / | | Elizabeth SA 5112 | Fax: +61 8 255 9117 < | | Australia | Email: lwaugh@awadi.com.au \\ |_|________________________________| \\ | | (______________________________\\ | |