a way to get error 952 when wrong password IDS FC9
After upgrading from IDS 10.00.FC4 to FC9 on AIX 5.3, a user found that a wrong password no longer returned error 952 ('incorrect password'), only the generic 951 ('user not known'). This was confirmed as a deliberate security change introduced around 10.00.xC7 to stop attackers identifying valid logins. Swapping in the older msg directory didn't help, since the error is generated by the server, not the client. The advice was to contact IBM Informix support for a patch to restore the old behaviour or make it tunable; the poster said he would do so, so no fix is shown in the thread.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
Hi everyone, im having a problems with the code error 952 when the users inputs password wrong because informix shows me error 951. Im using informix 10.00.00.FC9 on aix 5.3. When we had IDS 10.00.FC4, when the user inputs wrong password he got error 952 which wrong password, now we are using 10.00.FC9 when users inputs wrong password he gets 951 error. Researching, we found this is a expected behaviour to prevents attackers to know when they get a valid login. But our application needs to knows when the users input wrong password. Is there any way to keep getting the error 952 when wrong password?? Or any idea to let application when the password is wrong with this fixpack? Thanks in advanced.
Hi Lynkz Please contact IBM informix tech support if you have a business need to show 952 from client side for server after 10.00.xC7. Support should be able to provide you a patch to revert back to the previous behavior or even make it tunable from server side. Regards, -Ping --- On Fri, 3/13/09, LYNKZ MIKE <yellr@telecom.com.co> wrote: > From: LYNKZ MIKE <yellr@telecom.com.co> > Subject: a way to get error 952 when wrong password IDS FC9 [15130] > To: ids@iiug.org > Date: Friday, March 13, 2009, 9:28 AM > Hi everyone, im having a problems > with the code error 952 when the users > inputs password wrong because informix shows me error 951. > Im using informix > 10.00.00.FC9 on aix 5.3. > > When we had IDS 10.00.FC4, when the user inputs wrong > password he got error > 952 which wrong password, now we are using 10.00.FC9 when > users inputs wrong > password he gets 951 error. > > Researching, we found this is a expected behaviour to > prevents attackers to > know when they get a valid login. But our application needs > to knows when the > users input wrong password. Is there any way to keep > getting the error 952 > when wrong password?? Or any idea to let application when > the password is > wrong with this fixpack? > > Thanks in advanced. > > > ******************************************************************************* > > Forum Note: Use "Reply" to post a response in the > discussion forum. > >
Hi ping tang, thanks for your answer, just im wondering, there be would a way to get a different error code than 951 when user types wrong password? i tried to change the msg directory of ids 10.00.FC9 for ids 10.00.FC4 but it didnt work, is there somehting to do with csdk?? thanks a lot
If you are able to meddle with the messages, report it as a bug. Only client side meddling may be doable but not sure. Thanks and Regards, Gaurav "LYNKZ MIKE" <yellr@telecom.co m.co> To Sent by: ids@iiug.org ids-bounces@iiug. cc org Subject Re: a way to get error 952 when 13/03/2009 21:52 wrong password IDS [15132] Please respond to ids@iiug.org Hi ping tang, thanks for your answer, just im wondering, there be would a way to get a different error code than 951 when user types wrong password? i tried to change the msg directory of ids 10.00.FC9 for ids 10.00.FC4 but it didnt work, is there somehting to do with csdk?? thanks a lot ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.
Hi Lynkz This 951/952 error message was returned by Server so swapping msg directory wouldn't help. Requesting a patch from IBM informix support is the right way to go. Regards, --- On Fri, 3/13/09, LYNKZ MIKE <yellr@telecom.com.co> wrote: > From: LYNKZ MIKE <yellr@telecom.com.co> > Subject: Re: a way to get error 952 when wrong password IDS [15132] > To: ids@iiug.org > Date: Friday, March 13, 2009, 11:22 AM > Hi ping tang, thanks for your answer, > just im wondering, there be would a way > to get a different error code than 951 when user types > wrong password? i tried > to change the msg directory of ids 10.00.FC9 for ids > 10.00.FC4 but it didnt > work, is there somehting to do with csdk?? thanks a lot > > > ******************************************************************************* > > Forum Note: Use "Reply" to post a response in the > discussion forum. > >
Hi guys, we are going to ask ibm for a patch for this. Thanks a lot guys for help.