-951 trap
Mark Jalkiewicz asked how to trap error -951 (bad password or unknown user) to alert security admins on IDS 11.70 AIX. Sergio Peres suggested onmode -I 951; Luis Marques suggested ALRM_ALL_EVENTS 1 and parsing for -951 in the alarmprogram, at some performance cost. Benjamin Thompson advised log ingestion or rsyslog imfile and warned against onmode -I. Mark thanked them.
Auto-generated by Claude from the posts below — may be imperfect; read the full thread.
Folks,
IDS 11.70 AIX 7.4
Is there any way/method etc. to trap for the following authentication error
and send out an alert to security admins ? (other than greping the msg log )
951: Incorrect password or user is not known on the database server.
Preferably would like to have the alarmprogram fire when this occurs but have
not found an alarm event id associated with the -951.
Thanks in advance,
Mark
Hi Mark,
I think you can do it with onmode -I 951.
https://www-01.ibm.com/support/docview.wss?uid=swg21155532
Regards,
SP
You can try setting ALRM_ALL_EVENTS to 1 in ONCONFIG (requires a restart of the Informix instance). Then there will be an event triggered for a failure to authenticate: CLASS_ID=42 EVENT_ID=42001 CLASS_MSG=Event occured SPECIFIC_MSG=listener-thread: err = -951: oserr = 0: errstr = XXXX@YYYY: Incorrect password or user XXXX@YYYY is not known on the database server. Unfortunately, CLASS_ID 42 seems to be a catch all for a lot of events. You will need to edit the alarmprogram script to parse the SPECIFIC_MSG for the -951 error. And with ALRM_ALL_EVENTS=1 the Informix server will be calling the alarprogram.sh much more times, so performance may suffer. Best regards, Luis Marques
Hi,
One option is to use a product which can ingest and parse logs, and generate
reports based on that. Elasticstack is an open-source example of this with a
commercially supported version available. Other similar tools exist.
Alternatively and more straightforwardly you could use the imfile module of
rsyslog to write the Informix log entries to a file in /var/log, assuming
you're using Linux. This may fit with an existing solution where all [r]syslog
files in /var/log are monitored by security, especially /var/log/secure, which
I'd imagine they are interested in.
I wouldn't recommend using "onmode -I" as someone else has suggested which can
be a nightmare in general with which to capture frequently occurring events.
It will generate a stack track each time and potentially a shared memory dump
which will block the server while it takes place as well as consume a lot of
disk space.
Ben.
Sergio, Luis and Benjamin, Thanks for all of your responses. Regards, Mark