How to restrict access for a user to Informix by IP?
Dennis Melnikov asked how to allow a user to connect to Informix 11.70.FC5XE only from application server IPs, with LDAP authentication. Clive Eisen suggested a firewall. Arnulfo Martinez Ruiz described a sysdbopen() procedure that checks the session IP and rejects the connection. Art Kagel explained sysdbopen() is an SPL routine in the database run at connect, and a non-zero return disconnects the user.
Auto-generated by Claude from the posts below — may be imperfect; read the full thread.
Hi, IBM Informix Dynamic Server Version 11.70.FC5XE AIX 7.1 We have several application servers and LDAP based authentication. How to prevent a user's connections from any but the application servers' IPs? ------------------------------ Sincerely, Dennis ------------------------------
Firewall? — Clive Eisen
Hi Dennis At some point I had a request from a client about this issue. A code was implemented in the sysdbopen() procedure in which the IP of the syssession table is validated with the addresses that are not allowed. If a match was found, an error of connection not allowed was generated and the user was disconnected. --- Arnulfo Martinez ------------------------------ Arnulfo Martinez Ruiz ------------------------------
Arnulfo, Looks like sysdbopen() is a routine that executes on an application server. We need to allow user's connections from application servers while denying such from utilities like ServerStudio. ------------------------------ Sincerely, Dennis ------------------------------
Dennis: No, the sysdbopen() and sysdbclose() functions are installed in a database and are usually just SPL routines. If there is a sysdbopen() function owned by user "a" then when user "a" connects to that database their sysdbopen() function is automatically fired, if it returns non-zero then user "a" is disconnected. If there is now sysdbopen() function owned by user "a" then the engine checks to see if there is a sysdbopen() function owned by user "informix". If so then that sysdbopen() function is fired with the same result, a zero return permits the user to continue, a non-zero return returns that error code to the user and kicks them out. Similarly, when a user disconnects from the server or closes the database to which they are connected, a sysdbclose() function is fired if there is one owned by that user or by "informix". I have clients that use sysdbopen() to record (in a table) when users connect to the database and sysdbclose() to record when they close the database. Others do use sysdbopen() to deny services to specific users, set the user's role, or deny service to certain users at certain times of the day. ------------------------------ Art S. Kagel, President and Principal Consultant ASK Database Management Corp. www.askdbmgt.com ------------------------------