IDS DB Access & Administration without root

Posted in 2011

KHURRAM SHAHZAD — Mon, 12 Sep 2011 19:30:53 — source: IIUG Forums & Mailing Lists

I have an inquiry related to the database access and administration of Informix. My question is that is it possible for us to restrict "root" user from accessing and administrating the databases? If possible then how? and if not possible then why? And if we restrict the "root" to access and administer the database then what could be the possible impact of this change? i.e. what explicit functions with respect to the administration that we would not be able to do without the access of "root"? I need a quick answer to these questions with solid proof/documents.

↪ replying to KHURRAM SHAHZAD

Fernando Nunes — Mon, 12 Sep 2011 21:09:39 — source: IIUG Forums & Mailing Lists

root has no special connect rights on the databases. root has special privileges at the instance level non-root installations may change part of this, but the real questions you should ask are: - How do you plan to restrict root from doing "su - informix" (or any user for non-root installations)? - How do you plan to avoid that root has direct access to the chunks? Or in any words, what are your concerns? What are you trying to avoid? I believe that the answers to this questions are far from Informix... root is a problem in Unix. Unix in general. If you can't control root everything else is impossible to control. root can stop the machines. Can destroy data. Can inpersonate other users and as such access their privileges... Latest Unix versions may have some security measures that may avoid some of these things... Regards On Mon, Sep 12, 2011 at 8:30 PM, KHURRAM SHAHZAD <kshahzad02@i2cinc.com>wrote: > I have an inquiry related to the database access and administration of > Informix. > > My question is that is it possible for us to restrict "root" user from > accessing and administrating the databases? > If possible then how? and if not possible then why? > And if we restrict the "root" to access and administer the database then > what > could be the possible impact of this change? i.e. what explicit functions > with > respect to the administration that we would not be able to do without the > access of "root"? > > I need a quick answer to these questions with solid proof/documents. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --00151758a5449eaffe04acc4f11d