Alexandre Benson Smith wrote:

>Jim Starkey wrote:
>A short term easy to implement fix is to anchor accounts to what I call
>coteries -- sets of IP addresses from which a given account is valid.
>This won't stop your roommate, co-worker, or kid from attacking your
>account, but it will stop other remaining 99.9999% of the hackers.
>
>
>
>But I was stuccked in Sao Paulo's crazy traffic and remembered it (don't know why I was thinking about it)...
>
>This wouldn't be the same that could be achieved using firewall rules ? (defining an IP range authorized to some port).
>
>As said by Alex, it could be easy to implement, but what the benefit of it if we already have it at the firewall level ?
>
>see you !
>
>
>
>

It's a question of control. With coteries you can let less privileged
users come in from anywhere but restrict SYSDBA (or whatever) to
specific hosts or hosts strictly behind the firewall.

--

Jim Starkey
Netfrastructure, Inc.
978 526-1376