Re: Change UNIX password from Windows

Derrek Poulson wrote: > Theoretically, you are of course correct. Passwords shouldn't be stored > anywhere where they're readable by anyone other than system administrators, > even if encrypted. > > Realistically, I see only 3 ways to manage UNIX/Informix passwords in a > client/server environment, none of which is entirely satisfactory: > > 1. Make up a UNIX password when a new account is created, then code the > PowerBuilder (or whatever) app to automatically supply the correct password > each time the app is run. Disadvantages: 1) how to securely supply the > password automatically, 2) keeping a password perpetually unchanged is asking > for trouble. > > 2. Have the user supply the password each time the app is run. From a > security standpoint, this is ideal, but from the user's standpoint, having to > authenticate every time you open a new app is unacceptable. This is > understandable to a degree since one authentication per session (i.e. the > Netware login) should be sufficient. When users have modest hardware and apps > are written in PowerBuilder (which is a resource hog), a fair amount of > opening and closing apps is unavoidable. > > 3. Use setnet and informix.ini. If access to informix.ini is governed by > a network login, this provides reasonable security. The drawback is that when > the UNIX password needs to be changed, you have to change it in Setnet also. > Hence my original question. > It is not necessary to change password in Setnet when unix password is changed. Password in Setnet is only for testing connection purpose. You can set asking password at runtime. Once connection is Ok, you can connect with different user ID and password if they are valid in the server side. There is no security at all if you don't ask user for password at runtime. You can't count on the encrypted password in Informix.ini. In client/server environment, we want to give user the ability to change their passwords. I think this is the original question and is a challenge, and we want this process to be transparent(like changing password on unix box), without modifying any application code or INI files. Fortunately Informix_Net gives us this capability. In your 2nd method, if several applications logon to the same server, why don't you combine them into one application instead of logging off and logging on the same server again and again. One server one ID and password, is this reasonable? Of course you can do it differently based on your applications and environment. Weimin Yang Aerotek Inc.