Re: Is my brain dead or what....

David Williams <djw@smooth1.demon.co.uk> wrote: :In article <3277923A.4458@segel.com>, Mike Segel <mikey@segel.com> :writes ...snip... :> The problem occurs in that I now have to manage a database on all the :> pc's, their users, and what server applications that they can connect :>to. :> :> Since Informix gets its user authentication from the user_id, and :>passwd, :> I have two choices: :> 1) create a unique user id for all users : Each user should have a unique user id - basic UNIX security. Yes David, but do you remember the long threads about how one can (or rather can not) change the Unix password from an MS Windows client application. Do you suggest every user should have a terminal emulator installed for this purpose only? An additional problem here is whether you use I-Net alone, I-Net and ODBC on top of that, or some sensible ODBC solution without I-Net there is no way of knowing whether the Unix password is no longer valid or the user simply typed something wrong. So in your application you ask your user to retype the password. After 3 to 5 attempts that user will be locked out of Unix automatically, and he can't even try to change his password via a terminal emulator. The Unix administrator has to be brought into the picture. We haven't ever heard what Informix's solution to any of this is. Isn't Informix out there listening? :> 2) create a set of authentication routines and maintain a :> user_id / passwd table scheme within Informix. :> When using /etc/hosts.equiv, I can use the + sign to allow any user :> from that PC to connect, however, this too can be considered a security :> risk. :> :>Solutions: :> 1) If I am not braindead, then Informix needs to get their act together :> so that we can develop large scale client/server applications. : Talk to them - I belive they already have their act together. See above. Do they? :> 2) switch to web based technologies and use either Web objects or :> Netscape to handle security and front end processing. : You still have to secure things at the OS level. Eventually yes. I have not studied the problems this would entail enough yet. It seems to me it would still involve regular Unix users for access to the database (whether via Java/JDBC or some other means) so we probably have exactly the same problems. This is even worse, and makes it mandatory for Informix to document for us how to do it. :> 3) Drink until I have to look up to see the curb in front of the :> local pub. :> :>Now #3 does sound appealing. [Right Tom?], but alas, being an old man, I :>can't :>continue to abuse my body in that way. So, what I am doing wrong? :> :>-Uncle Mikey. :-- :David Williams I am looking forward to a new whitepaper from Informix on all aspects on database access and security as discussed here, as well as the previous discussion on security when using I-Net and/or ODBC and thereby opening up free access to the database for any user of a program that needs such access. Is there anybody at Informix who would take it upon themselves to either write one, or get someone to write such a whitepaper? Nils.Myklebust@idg.no NM Data AS, P.O.Box 9090 Gronland, N-0133 Oslo, Norway My opinions are those of my company The Informix FAQ is at http://www.iiug.org