Connectivity: authentication over ssh instead of rsh?

I've got several servers running apache, sshd and qmail. (period) I'd like to access a database on another server running _nothing_ but Informix (IDS 2000), sshd and apache. (That's no rsh and no rlogin) Is it possible? Thomas

Thomas Parsli wrote: > I've got several servers running apache, sshd and qmail. (period) > > I'd like to access a database on another server running _nothing_ > but Informix (IDS 2000), sshd and apache. > > (That's no rsh and no rlogin) > > Is it possible? I don't know, and judging from the stunning silence from the rest of the crowd, neither do they. It is going to depend on whether the user authentication processes really depend on rlogin and/or rsh running or not. My expectation would be that the connection stuff does not rely on those services, so you should be OK. I have no proof that this is the case, nor the inclination to set up a machine with such a restricted set of services to try it out. One little gem that I've discovered the hard way: if your ~me/.rhosts file is automounted, then your connections will only work when the ~me directory is still mounted; if the automounter has timed you out, then you cannot connect. This is loosely relevant; the way I fix this problem is "rsh remote ls". Obviously, this uses rshd and triggers the automount and reads the .rhost file. Since the Informix connection does not trigger the automount, it is at least different from the rshd behaviour. I think this may support my expectation or hypothesis that it will work -- but anything is possible. -- Jonathan Leffler (jleffler@informix.com, jleffler@earthlink.net) Guardian of DBD::Informix v0.95 -- see http://www.perl.com/CPAN #include <disclaimer.h>

Jonathan Leffler <jleffler@earthlink.net> writes: > Thomas Parsli wrote: > > > I've got several servers running apache, sshd and qmail. (period) > > > > I'd like to access a database on another server running _nothing_ > > but Informix (IDS 2000), sshd and apache. > > > > (That's no rsh and no rlogin) > > > > Is it possible? > > I don't know, and judging from the stunning silence from the rest > of the crowd, neither do they. > > It is going to depend on whether the user authentication processes > really depend on rlogin and/or rsh running or not. My expectation > would be that the connection stuff does not rely on those services, > so you should be OK. I have no proof that this is the case, nor > the inclination to set up a machine with such a restricted set of > services to try it out. Looks like normal authentication works fine as long as I use username/ password. I'll just pop in PSWDCSM in my tcp-listeners and it should be (relativly) safe. It would be nice to create a secure tunnel between server and client, probably something SSL can help me with. Do you know if there's a way to limit the listeners to certain hosts? (Like: "deny from all", "allow from 192.168.1.111") Maybe I'll just use ip-chains (I'm running on Linux)... Thomas

In article <38ACDF21.4F7AB9CF@earthlink.net>, Jonathan Leffler <jleffler@earthlink.net> writes > > >One little gem that I've discovered the hard way: if your ~me/.rhosts >file is automounted, then your connections will only work when >the ~me directory is still mounted; if the automounter has timed >you out, then you cannot connect. This is loosely relevant; the way ??? The automounter should make it appear as if the directory is always mounted. >I fix this problem is "rsh remote ls". Obviously, this uses rshd and >triggers the automount and reads the .rhost file. Since the Informix >connection does not trigger the automount, it is at least different Why does it not trigger the automount. open()/access() or reading the directory should always trigger the automounter. >from the rshd behaviour. I think this may support my expectation or >hypothesis that it will work -- but anything is possible. > > >-- >Jonathan Leffler (jleffler@informix.com, jleffler@earthlink.net) >Guardian of DBD::Informix v0.95 -- see http://www.perl.com/CPAN >#include <disclaimer.h> > > -- David Williams

> >One little gem that I've discovered the hard way: if your ~me/.rhosts > >file is automounted, then your connections will only work when > >the ~me directory is still mounted; if the automounter has timed > >you out, then you cannot connect. This is loosely relevant; the way > > ??? The automounter should make it appear as if the directory > is always mounted. > I always thought the automounter only mounts as required, and normally unmounts after 15 minutes. [cutting] > -- > David Williams -- Paul Watson # WF Software Ltd # You are only young once Tel: +44 1436 674728 # but you can be immature Fax: +44 1436 678693 # for ever www.wfsoftware.com #