Re: Is my brain dead or what....

David Williams <djw@smooth1.demon.co.uk> wrote: :In article <55n753$937@nntp.idgonline.no>, Nils Myklebust :<Nils.Myklebust@idg.no> writes :>David Williams <djw@smooth1.demon.co.uk> wrote: :> :>:In article <3277923A.4458@segel.com>, Mike Segel <mikey@segel.com> :>:writes :> :>...snip... :> :>:> The problem occurs in that I now have to manage a database on all the :>:> pc's, their users, and what server applications that they can connect :>:>to. :>:> :>:> Since Informix gets its user authentication from the user_id, and :>:>passwd, :>:> I have two choices: :>:> 1) create a unique user id for all users :> :>: Each user should have a unique user id - basic UNIX security. :> :>Yes David, but do you remember the long threads about how one can (or :>rather can not) change the Unix password from an MS Windows client :>application. :>Do you suggest every user should have a terminal emulator installed :>for this purpose only? : Yes - UNIX requires this and it makes sense. The quality of your other posts are one of my reasons for reading c.d.i. This answer however didn't make any sense to me at all. : How otherwise you need :another username/password system. Therefore you have two possible :methods of system penetration. Via the UNIX user/password method and :via the other method. Other methods of authenticaton are not likely to :be as widely used as the client/server combination used would decide :the authnetication method used. OS level authenication MUST be used by :everyone since UNIX requires users to be configured. This will be :theautnetication method which is most likely to be secure since it will :be the one which gets the most analysis from security experts. This may be so (or it may not). The point however is the terminal emulator. You can't seriously mean that you will continue to accept that users of MS Windows programs must all have a terminal emulator program installed for the sole purpose of changing their password on the Unix server. In my opinion, and I think in most others opinion that make client server programs on MS Windows using Unix based database servers, there simply *must* be a simple way to change the password from inside the application. May be a kind of pseudo terminal emulator can be written that can be controled from the application. Whatever the solution is a regular terminal emulator is *not* the answer. Even though we are using this solution today we will soon be in a position where this will no longer work. We will soon install new programs for new users where there is no way this cludge will be accepted. No way. Also with the current situation as to error messages on bad passwords, even the terminal emulator solution doesn't help much. See below. :>An additional problem here is whether you use I-Net alone, I-Net and :>ODBC on top of that, or some sensible ODBC solution without I-Net :>there is no way of knowing whether the Unix password is no longer :>valid or the user simply typed something wrong. : Since the server portion of inet gets the error code from the Online : server (they are separate processes) it must be possible to get the : information from the Online server :- : Part on an Online log I received from someone: :14:39:34 listener-thread: err = -951: User hbad720 is not known on the :database server. :14:41:57 listener-thread: err = -952: User's password is not correct :for the database server. : It is even possible to distingush between whether on not the user is : valid (-951) or whether the password is wrong (-952). Therefore it is : a limitaiton of the ODBC solution. Well, that is true. But you forget the third alternative that is the real problem. The user *is* known. It's only a problem with the password. You get error -952 in at least the following situations: a. The user simply keyed the wrong password (a mistype). b. The password got disabled due to age. c. The Unix administrator disabled the password for some reason. (The user still exists.) If you try to log into Unix via a terminal emulator you get a message stating what is wrong. In the case of an aged password you get warnings before it is to late that you have to change the password. Usually you will set up Unix in such a way that the password command is automatically executed in this case so the user can change the password immediately. Had Informix given different error messages in these cases we could at least have told the user what he had to do. If we accepted that a terminal emulator had to be used to change the password we could have at least started that up. We could even control it from our application so the user would only see it's icon while the password was changed via a more sensible dialog box. We still need to get rid of the terminal emulator. We don't want to install it (even if we could use a free one). Also remember: Informix have to implement a warning message also that the password is about to be aged. This is necessary so the password can be changed before it is actually aged. :>So in your application you ask your user to retype the password. After :>3 to 5 attempts that user will be locked out of Unix automatically, :>and he can't even try to change his password via a terminal emulator. :>The Unix administrator has to be brought into the picture. :> : Correct otherwise someone who knows a username could write a program : to scan all common passwords. Yes of course, but dear David. The problem still was that the user should be told before all these attempts that what he is expected to do is to change his password. The part with the administrator is obviously necessary if the user do attempt several logins with the wrong password. *No* disagreament on that part. :>I am looking forward to a new whitepaper from Informix on all aspects :>on database access and security as discussed here, as well as the :>previous discussion on security when using I-Net and/or ODBC and :>thereby opening up free access to the database for any user of a :>program that needs such access. :>Is there anybody at Informix who would take it upon themselves to :>either write one, or get someone to write such a whitepaper? :> : I'd like to see one as well. We should all request this from them. It's more than overdue that they come out with something. If no new solutions, they must at least describe their current technology. (If they do they may see their own problems :-) In my opinion the above problems are grave onse. I don't know any current solution, and noone here have been able to give any solutions at all. I will send these posts directly to Informix as well, and ask them what we should do. They claim to have large installations of MS Windows based client server solutions. Do they all live with these problems, and solve them as best as they can or is there something I haven't seen or understood? I am actually starting to doubt myself. There simply *must* be some solution - or am I to demanding - or ??? Nils.Myklebust@idg.no NM Data AS, P.O.Box 9090 Gronland, N-0133 Oslo, Norway My opinions are those of my company