Is Informix dependant on password cypher algorithm?
Dennis Melnikov found that on IDS 11.70.FC5XE on AIX 7.1, users whose passwords were re-encrypted with ssha512 (pwd_algorithm in login.cfg) could no longer log in over the network. Andreas Legner suggested chmod o+x /etc/security and o+r on pwdalg.cfg, or using PAM; this worked. Paul Watson said one site rejected that after security review, allowed ACLs instead, and could not use PAM with CSDK 3.70.
Auto-generated by Claude from the posts below — may be imperfect; read the full thread.
Hi, IBM Informix Dynamic Server Version 11.70.FC5XE AIX 7.1.3.5 While using a default pwd_algorithm (crypt) in /etc/security/login.cfg we have no problem connecting to Informix via network. To strengthen security I set pwd_algorithm to ssha512. After that users that renewed their passwords, thus cyphering them with SSHA512, lost an ability to directly log in to Informix via network. How to make it tolerable to more robust cyphers? ------------------------------ Sincerely, Dennis ------------------------------
chmod o+x /etc/security chmod o+r /etc/security/pwdalg.cfg Decide for yourself if this creates any security problem - I haven't found anyone yet capable of explaining one to me. Alternatively you'd had to switch to using PAM. ------------------------------ Andreas Legner Informix Dev HCL Software ------------------------------
Andreas, Yes, it works! Thank you! ------------------------------ Sincerely, Dennis ------------------------------
This approach was rejected at one of my sites after a security review, however using ACL to control the access was allowed. PAM could not be used cos the client layer was still 3.70 CSDK and the customer didn't want to rebuild the entire app layer for PAM
Paul, So, they are still using crypt? And, who made the security review? ------------------------------ Sincerely, Dennis ------------------------------