Re: Gaping security hole? (network db connections)

> Informix's security is flawed in that /etc/hosts.equiv was really meant > to authtenticate a user on a particular machine. It was meant for a > UNIX to UNIX authentication, rather than a PC to UNIX. (peer to peer, > rather than client server.) This IS!!! for a UNIX to UNIX authentication... The client stations are OTHER unix stations that I administer. > IMHO, .rhosts and hosts.equiv were really quick and dirty cheats to > get around security. They were written in a time when security was not > as critical. [This is to say that UNIX could trust the other > UNIX to have some form of security. In a client/server paradigm, > there is no security on the client side.] This is exactly the case. The DB server UNIX can trust that the client UNIX is secure. However, by not verifying the source port, sqlexecd is throwing away ALL of the security that exists on the client UNIX station. Because - it is letting ANYONE connect and claim to be anyone else. It ISN'T checking that the remote user really is who they say they are. The problem is that sqlexecd is not performing the only security check that .rhosts/hosts.equiv has available to it. -- Nathan ------------------------------------------------------------ Nathan Neulinger Univ. of Missouri - Rolla EMail: nneul@umr.edu Computer Center WWW: http://www.umr.edu/~nneul SysAdmin: rollanet.org