Trusted Comnnection Issue
Dan (IDS 11.50.FC5 on AIX 5.3) could connect via JDBC with a password, but adding "host userid" to /etc/hosts.equiv for passwordless trusted connections failed with "Incorrect password or user ... is not known on the database server". Suggestions: use .rhosts/.netrc in the user's home directory, check the online.log for a -956 error and copy the exact host/user string shown into hosts.equiv, and note that Informix doesn't need r-services (ssh/rlogin is irrelevant); also check reverse DNS of the client IP and IPv6-over-IPv4 issues. Dan reported nothing appeared in online.log, suspecting the connection was blocked earlier; no resolution is recorded.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
Hello All, Informix 11.50.FC5 O/S AIX 5.3 I am struggling over what I thought would not even be an issue but... I have a user who connects from his PC workstation to one of my Informix servers. This works fine with both his userid and the daemon userid for the application and he can go about his merry way. However, I set him up in /etc/hosts.equiv so he can come in as a trusted user and not have to enter his password. Now when he tries to connect w/o the password, we get a message saying java.sql.SQLException: Incorrect password or user com.informix.asf.IfxASFRemoteException: talend@tw2987.msws.trnswrks.com is not known on the database server Connecting with the password still works fine. I have done this before and I am pretty sure I have the hosts.equiv entry correct (computer_name userid). What am I missing here? thanx in Advance, Dan
We've had to use the .rhost file on the remote server home directory, which includes the app server and userid. We've also utilized the .netrc in the home directory, which includes userid and password. Just some thoughts. Thanks, ******************************************************************* Ernie Knox IT Database Administrator Specialist Sears Holdings - BU: I & T Group 3333 Beverly Rd., B4-266A Hoffman Estates, IL. 60179 Office: (847) 286-5735 Email: Ernest.Knox@searshc.com Blackberry: 2244650553@messaging.sprintpcs.com Page via Skytel: 2244650553@sprint.skytel.com Informix or MySQL Primary: 9110210@skytel.com Informix or MySQL Secondary: 7276872@skytel.com " Yes we can make a Change! " " It's always a great day to watch Sports - GO LIONS, TIGERS, and BEARS! " " Lets not forget - GO Pistons and Red Wings! " GSU ******************************************************************* -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of DAN MUELLER Sent: Thursday, April 28, 2011 11:44 AM To: ids@iiug.org Subject: Trusted Comnnection Issue [23544] Hello All, Informix 11.50.FC5 O/S AIX 5.3 I am struggling over what I thought would not even be an issue but... I have a user who connects from his PC workstation to one of my Informix servers. This works fine with both his userid and the daemon userid for the application and he can go about his merry way. However, I set him up in /etc/hosts.equiv so he can come in as a trusted user and not have to enter his password. Now when he tries to connect w/o the password, we get a message saying java.sql.SQLException: Incorrect password or user com.informix.asf.IfxASFRemoteException: talend@tw2987.msws.trnswrks.com is not known on the database server Connecting with the password still works fine. I have done this before and I am pretty sure I have the hosts.equiv entry correct (computer_name userid). What am I missing here? thanx in Advance, Dan ************************************************************************ ******* Forum Note: Use "Reply" to post a response in the discussion forum.
Forgot to mention. These are secure servers. rlogin is not available. We have to use ssh to get from one to another. (if this makes a difference) thanx, dan
we use ssh on out site. To enable a user to log without password we had to set up ssh keys or whatever you call them. Once they are set up access without passord is fine
Hi Dan, have a look in the message log of the informix server (typical online.log). Do you see something like: listener-thread: err = -956: oserr = 0: errstr = username@clienthost[clienthost.xx.yy.zz.]: Client host or user username@clienthost[clienthost.xx.yy.zz.] is not trusted by the server? Put "clienthost username" in the hosts.equiv file, exactly as you find it in the online.log. That should work, even with a locked account without a home-directory: /etc/passwd: username:x:1234:123:User_comment::/bin/false /etc/shadow: username:*LK*:15091:::::: r-services are not needed, AFAIK. Informix makes use of .rhosts (in the home-dir of an user, i fit exists) or /etc/hosts.equiv. But not of the package that includes rsh, rlogin etc. I testet with Infomix 11.50.FC5W3 and Solaris 10, connected via Informix ODBC without specifying a passwort anywhere. R-services installed on the Solaris host, but see comment above. Make sure you connect directly with the Informix Server and not with an other server like Datadirect Sequelink. ODBC connection to the Sequelink Server Part on the Solaris host needs a connection with password. Kind regards Reinhard > -----Original Message----- > From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of DAN > MUELLER > Sent: Thursday, April 28, 2011 5:44 PM > To: ids@iiug.org > Subject: Trusted Comnnection Issue [23544] > > Hello All, > > Informix 11.50.FC5 > O/S AIX 5.3 > > I am struggling over what I thought would not even be an issue but... > > I have a user who connects from his PC workstation to one of my Informix > servers. This works fine with both his userid and the daemon userid for the > application and he can go about his merry way. However, I set him up in > /etc/hosts.equiv so he can come in as a trusted user and not have to enter his > password. Now when he tries to connect w/o the password, we get a message > saying > > java.sql.SQLException: Incorrect password or user > com.informix.asf.IfxASFRemoteException: talend@tw2987.msws.trnswrks.com is > not > known on the database server > > Connecting with the password still works fine. > > I have done this before and I am pretty sure I have the hosts.equiv entry > correct (computer_name userid). > > What am I missing here? > > thanx in Advance, > Dan > > > ************************************************************************ ******* > Forum Note: Use "Reply" to post a response in the discussion forum.
Hello. rlogin not available is *completely* irrelevant for your situation. That is a *very* common misconception. Informix *does* not depend on any of the "r* services". In your situation you should check the online message log for more information. You'll probably have a -956 error with a strange name or an IP. Make sure the Informix server can reverse DNS the client IP address to the correct name (and use that name in the trust configuration) of eventually use the IP address. Another typical scenario is that the customer interface is using IPV6 over IPV4. Finally, Informix 11.7.FC2 has some new ONCONFIG parameters that allow us to specify "private" hosts.equiv files. This is just a minor change, but I was cheering for this for a long time... Regards. On Thu, Apr 28, 2011 at 6:34 PM, DAN MUELLER <dan.mueller@trnswrks.com>wrote: > Forgot to mention. These are secure servers. rlogin is not available. We > have > to use ssh to get from one to another. (if this makes a difference) > > thanx, > dan > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --0015174beb949dd4b404a22b7156
Thanx for some necessary information. I will be looking into this again this morning. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Fernando Nunes Sent: Saturday, April 30, 2011 7:50 PM To: ids@iiug.org Subject: Re: Trusted Comnnection Issue [23564] Hello. rlogin not available is *completely* irrelevant for your situation. That is a *very* common misconception. Informix *does* not depend on any of the "r* services". In your situation you should check the online message log for more information. You'll probably have a -956 error with a strange name or an IP. Make sure the Informix server can reverse DNS the client IP address to the correct name (and use that name in the trust configuration) of eventually use the IP address. Another typical scenario is that the customer interface is using IPV6 over IPV4. Finally, Informix 11.7.FC2 has some new ONCONFIG parameters that allow us to specify "private" hosts.equiv files. This is just a minor change, but I was cheering for this for a long time... Regards. On Thu, Apr 28, 2011 at 6:34 PM, DAN MUELLER <dan.mueller@trnswrks.com>wrote: > Forgot to mention. These are secure servers. rlogin is not available. > We have to use ssh to get from one to another. (if this makes a > difference) > > thanx, > dan > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --0015174beb949dd4b404a22b7156 ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.
Nothing registered in the online.log file at all. I am assuming that this is being intercepted before I ever get to the database. dan