Re: Change UNIX password from Windows

Mike Segel <mikey@segel.com> writes: >Derrek Poulson wrote: >> the UNIX password is changed, it'd sure be nice to be able to update the >> encrypted password Setnet puts in informix.ini. Any suggestions on this one? >Boy, >Being a UNIX security freak,[ can we say paranoid?] , I would have >to be really hesitant to store the password on a client machine. >Why don't you send me the encrypted passwd? I bet I can break it ;-) >(OK, so I am assuming DOS/Windoz uses the same algorithm as crypt) >Yet I digress. >A rule of thumb is that you don't want to store any passwords on the PC. >Just a tip from your uncle mike! Theoretically, you are of course correct. Passwords shouldn't be stored anywhere where they're readable by anyone other than system administrators, even if encrypted. Realistically, I see only 3 ways to manage UNIX/Informix passwords in a client/server environment, none of which is entirely satisfactory: 1. Make up a UNIX password when a new account is created, then code the PowerBuilder (or whatever) app to automatically supply the correct password each time the app is run. Disadvantages: 1) how to securely supply the password automatically, 2) keeping a password perpetually unchanged is asking for trouble. 2. Have the user supply the password each time the app is run. From a security standpoint, this is ideal, but from the user's standpoint, having to authenticate every time you open a new app is unacceptable. This is understandable to a degree since one authentication per session (i.e. the Netware login) should be sufficient. When users have modest hardware and apps are written in PowerBuilder (which is a resource hog), a fair amount of opening and closing apps is unavoidable. 3. Use setnet and informix.ini. If access to informix.ini is governed by a network login, this provides reasonable security. The drawback is that when the UNIX password needs to be changed, you have to change it in Setnet also. Hence my original question. I'm a UNIX administrator, so I have the same concerns you do. There's always a tradeoff between security and convenience for legit users; in this case, I think #3 is a reasonable compromise. And no, Informix's encryption isn't crypt. To the best of my knowledge, Informix hasn't made their encryption algorithm public, so to crack a password, you'd probably have to resort to a homegrown app that would feed keystrokes to setnet and parse informix.ini. -- --- - Derrek (dirk@xmission.com)