informix DB account without OS account

Posted in 2013

Justin Killen — Fri, 07 Jun 2013 00:01:02 — source: IIUG Forums & Mailing Lists

Does Informix have a concept of DB login vs attaching to an OS login? What is the current best practice for keeping the login database in sync? Servers are running Linux. And no, I don't want to setup NIS - that's just another dependency/single point of failure that I don't want. Thanks -Justin

↪ replying to Justin Killen

Art Kagel — Fri, 07 Jun 2013 00:21:27 — source: IIUG Forums & Mailing Lists

No. Informix authenticates users be querying the OS's authentication (or optionally PAM, CSM, etc.). In 11.50+ there is a concept of "mapped user" which registers user ids that are not OS users and maps them to a known OS user so that database users don't have to be known to the OS. Art Art S. Kagel Advanced DataTools (www.advancedatatools.com) Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on my employer, Advanced DataTools, the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Thu, Jun 6, 2013 at 8:01 PM, Justin Killen < jkillen@allamericanasphalt.com> wrote: > Does Informix have a concept of DB login vs attaching to an OS login? What > is > the current best practice for keeping the login database in sync? > > Servers are running Linux. And no, I don't want to setup NIS - that's just > another dependency/single point of failure that I don't want. > > Thanks > -Justin > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --001a11c3b9a2a0850b04de8568b7

↪ replying to Justin Killen

Fernando Nunes — Fri, 07 Jun 2013 00:28:01 — source: IIUG Forums & Mailing Lists

11.70 allows you to create internal database users. But you'll have to implement your own password strength and expiration rules. You can also use PAM to use external users, but apparently you'd consider that a single point of failure (as it's somehow like NIS)... So, why do you want to avoid OS users? On Fri, Jun 7, 2013 at 1:01 AM, Justin Killen < jkillen@allamericanasphalt.com> wrote: > Does Informix have a concept of DB login vs attaching to an OS login? What > is > the current best practice for keeping the login database in sync? > > Servers are running Linux. And no, I don't want to setup NIS - that's just > another dependency/single point of failure that I don't want. > > Thanks > -Justin > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --bcaec51b9a4b2c40e904de8580d7

↪ replying to Fernando Nunes

Justin Killen — Fri, 07 Jun 2013 15:57:52 — source: IIUG Forums & Mailing Lists

We have a policy in place that requires that passwords be changed regularly, including database account passwords. Currently, we have a script that rotates passwords on 7 named OS accounts and distributes the encrypted password list via a custom service. This works well for a single database server, but there some obvious sync issues when attempting this across multiple servers. If I was to use Informix users, the hope is that I could just change the password on one host and have Informix handle the replication for me. Regarding NIS, I might have been a bit harsh; what I meant was that we don't have an existing NIS setup, and the overhead of setting one up with proper redundancy is something we'd like to avoid if possible. -Justin -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Fernando Nunes Sent: Thursday, June 06, 2013 5:28 PM To: ids@iiug.org Subject: Re: informix DB account without OS account [30453] 11.70 allows you to create internal database users. But you'll have to implement your own password strength and expiration rules. You can also use PAM to use external users, but apparently you'd consider that a single point of failure (as it's somehow like NIS)... So, why do you want to avoid OS users? On Fri, Jun 7, 2013 at 1:01 AM, Justin Killen < jkillen@allamericanasphalt.com> wrote: > Does Informix have a concept of DB login vs attaching to an OS login? What > is > the current best practice for keeping the login database in sync? > > Servers are running Linux. And no, I don't want to setup NIS - that's just > another dependency/single point of failure that I don't want. > > Thanks > -Justin > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --bcaec51b9a4b2c40e904de8580d7 ******************************************************************************* Forum Note: Use "Reply" to post a response in the discussion forum.