> From: Doug Chamberlin [mailto:dchamberlin@...]

Hi,

> >Isn't it a security hole ?
> >On my interbase client I can create a database on the NT server with :
> >severname:c:\test.dll
>
> Yes, it is a known security hole.
>
> You don't even need to be an Interbase administrator or an NT
> administrator. Anyone who can use Interbase can create a database on the
> server.

If you use Interbase on *UNIX, you can use OS usernames/passwords, instead
of InterBase ones, by configuring the server to treat the client as a
trusted host. AFAIK this allows your 'users' to have the same file/directory
access privileges as if they had logged just onto the server, making it
easier to make certain directories/files 'out of bands'. Unfortunately
Windows 'security' is rather lacking to say the least and has no concept of
'trusted hosts' (not sure about W2K though).

There is talk of implementing 'aliases' on the server as opposed to 'real'
files/directories, these would obviously help this situation on all
platforms

Cheers

Phil Shrimpton
------------------------------
Project JEDI DCOM Team Captain
Project JEDI Library Team
<www.delphi-jedi.org>
Registered Linux User #155621