JayJay, Reading between the lines I think you're saying a firewall could be a good idea....
I'm not sure that the other methods will work though. As I understand the problem, it is that you can have a secure VB App using UniObjects on a secure PC but if I have access to Excel on that PC, together with a valid server login id and password (with update rights) and basic knowledge of the directory structure on the server then techniques 2, 5, 6 & 7 won't trouble me at all. Ok, I need to understand UniObjects and U2. I'm not even sure that a firewall would help because the PC I'm trying to hack the database from has a valid IP address to run the VB App As somebody looking to implement UniObjects alongside traditional server-based applications that's a big hole. I can plug it by taking David Jordan's advice and using AUTHORIZE, but that's a lot of work for me at this stage. It sounds like UOLOGIN is a step in the right direction, but it is only available on UniData and if Ian's experience is any guide may have some "implementation issues". I've been impressed with how easy it is to use UniObjects, I'm less impressed now. The functionality is great but in too many cases it's just a hugely inviting route to hack the database, it needs better server-side authentication Piers -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Jenkins Sent: 30 May 2005 01:56 To: [email protected] Subject: RE: [U2] Uniobjects hack Other techniques posted on the group will work as well - but to list a few: 1. firewall with nominated IP address interconnectivity ONLY 2. Restricted accounts with purged VOCs 3. O.S level permissions (or Tivoli Access Manager) 4. Triggers 5. Account level controls (remote verbs etc) 6. UO application-level authentication (suggest public key and one-time-pad for the serious - stops network sniffing) 7. Restrict access to Windows client PCs - stop anyone from doing anything untoward as they don't have permission to load or use that sort of software. 8. firewall 9. firewall ------- u2-users mailing list [email protected] To unsubscribe please visit http://listserver.u2ug.org/
