Subject | Re: [firebird-support] 2nd try: Security on Linux |
---|---|
Author | Schwartz Avi |
Post date | 2004-02-18T03:33:25Z |
I obviously was not very clear in my question.
hosts.equiv, from the man page, states that:
The hosts.equiv file allows or denies hosts and users to use the r-com-
mands (e.g. rlogin, rsh or rcp) without supplying a password.
The hostname is the name of a host which is logically equivalent
to the
local host. Users logged into that host are allowed to access
like-
named user accounts on the local host without supplying a
password.
I think there may be a security issues here allowing anyone on a given
machine access without a password to their like named accounts on the
server, but I may be wrong.
When using tcpwrappers and inetd there is a way to specify which hosts
(and optionally users) are allowed access to which services. So I can
say for example that user avi on machine pbook is allowed to access
service ssh but no other . Can I do something similar for firebird?
Avi
hosts.equiv, from the man page, states that:
The hosts.equiv file allows or denies hosts and users to use the r-com-
mands (e.g. rlogin, rsh or rcp) without supplying a password.
The hostname is the name of a host which is logically equivalent
to the
local host. Users logged into that host are allowed to access
like-
named user accounts on the local host without supplying a
password.
I think there may be a security issues here allowing anyone on a given
machine access without a password to their like named accounts on the
server, but I may be wrong.
When using tcpwrappers and inetd there is a way to specify which hosts
(and optionally users) are allowed access to which services. So I can
say for example that user avi on machine pbook is allowed to access
service ssh but no other . Can I do something similar for firebird?
Avi
On Feb 17, 2004, at 20:26, Helen Borrie wrote:
> At 07:32 PM 17/02/2004 -0600, you wrote:
>> Hi,
>>
>> I was wondering about how to secure access to the Linux server on
>> which
>> the firebird server is running on.
>>
>> According to the documentation I need to add the list of hosts I allow
>> to access the database server to /etc/hosts.equiv but doesn't it then
>> allow anyone from that remote host to connect to the Linux server? If
>> I want to allow only certain users to connect only to the database
>> service but not to any other service, how would I handle this? Can I
>> use /etc/hosts.allow and hosts.deny? If I can, what is the service
>> name I should use? Any other security recommendations? A pointer to
>> a
>> document would be fine.
>
> Here are a few paragraphs from my Linux Administrator's Guide: