Re: Informix/Oracle security hole?

Phil Perucci (philp@netcom.com) wrote: : Use of Informix-Star & Informix-NET requires installation of a : gaping /etc/hosts.equiv security hole for EACH client station! : Questions: : 1) On Informix, is there any way around this? : 2) Does Oracle have the same problem? Phil, I do not know about Oracle, however Informix-NET on our platform (Sun) and at our release (5 & 4.1) does have an undocumented feature which we use to tighten the hole. It seems that the equivalent access checking used by I-NET allows later entries to override earlier ones, whereas the documented 'standard' for system services is that the first matching entry is used. What this means is that our /etc/hosts.equiv first has negative entries (denying access) and then positive entries (allowing access) e.g. -first_host -second_host +first_host +second_host This allows I-NET to run but inhibits all the other processes e.g. rlogin, rsh, ...etc. Of course, this may not last and may not even be true for your platform - hopefully Informix will do away with equivalent access requirements before they correct the above 'feature'. _ (_)__________________________________ | | /| | | Lionel Waugh (_|_____________________________ | | Systems Analyst | / | | AWA Defence Industries | / | | PO Box 161 | Phone: +61 8 256 0373 / | | Elizabeth SA 5112 | Fax: +61 8 255 9117 < | | Australia | Email: lwaugh@awadi.com.au \\ |_|________________________________| \\ | | (______________________________\\ | |