Re: dba = user informix, group informix - always ?

On 6 Nov 1997, Marcus Winkler;PDT wrote: > Does the dba of OnLine7.2x or Universal Server always has to be user > informix and must belong to group informix? Or is this configurable? > > We want to run the Universal Server in addition to an existing OnLine7.2x > on the same machine but with different dba accounts. The reason for this > is that the dba of the universal server shall not have dba rights on the > OnLine and vice versa. Is there a solution ? This isn't a definitive answer -- more a set of ideas to explore. It depends on what you mean by DBA. You can install the products with the environment variable INF_ROLE_SEP set, and in that case, there are two extra accounts set up with privileges: the DBSSO (database security officer) and the DBAO (database audit officer). I'm not certain what operations the DBSSO can do (someone will have to research that), but if the DBSSO can do the backups and so on, there is no reason why the ODS DBSSO has to be the same login as the IUS DBSSO. You'd still need the informix login, but its use would be more restricted than usual; neither DBA should have access to it under normal circumstances. The group informix privileges are mandatory; simply don't put anybody except user informix in that group and that deals with it. You may end up needing to create a SUID front-end which allows the authorised users to do a few selected operations as informix. This will probably be a SUID-root program which does setuid(informix_uid) before executing the onXYZ command. Be careful with any and all SUID programs. Yours, Jonathan Leffler (johnl@informix.com) #include <witticism.h>