Informix SE Server and user Authentification
Hallo,
i´ve some strange problem with access to a remote database. Situation:
databases server is running on machineB. machineB only has the standard
unix accounts, all other people are authentificated via NIS (and NIS
host is machineA).
User "js" logs into machineC and starts dbaccess. He want to access a
database running on machineB. He enters the connections dialogue and
chooses the connection to the database server on machineB. He gives
username and password.
What happenes on machineB (the database server). I traces sqlexecd on
machineB while "js" is trying to connect.
20911 recv(7, "sqAXsBPAAAsqlexec js -pXXXXXXXX 7.24.UC5 ACN#A287337 -p
-fIEEEI DBPATH=//infse/home/js://infse/databases/db
CLIENT_LOCALE=en_US.8859-1 SINGLELEVEL=no LKNOTIFY=yes LOCKDOWN=noNODEFDAC=no
:AG0AAAA8c2UAAAAAAAAAAAA8c29jdGNwAAAAAAABAAAAAAAAAAAAAAAAc3FsZXhlYwAAAAAAAAVzcWxpAAALAAAAAwANaW5mc2VfbGJpczAxAABrAAAAAAAAIqsAAAAAAAdkYW9saW4AAAsvZGV2L3R0eXAxAAAJL2hvbWUvanMAAHQACAAAAfUAAABkAH8\\0",
4096, 0) = 383
20911 uname({sysname="Linux", nodename="lb-is01", release="2.2.10",
version="#9 Thu Aug 26 18:26:39 CEST 1999", machine="i686"}) = 0
20911 open("/etc/passwd", O_RDONLY) = 8
20911 fcntl(8, F_GETFD) = 0
20911 fcntl(8, F_SETFD, FD_CLOEXEC) = 0
20911 fstat(8, {st_dev=makedev(8, 17), st_ino=8186,
st_mode=S_IFREG|0644, st_nlink=1, st_uid=0, st_gid=0, st_blksize=4096,
st_blocks=6, st_size=2054, st_atime=99/09/13-20:42:48,
st_mtime=99/09/11-09:50:46, st_ctime=99/09/11-09:50:46}) = 0
20911 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS,
-1, 0) = 0x40020000
20911 _llseek(8, 0, [0], SEEK_CUR) = 0
20911 read(8,
"root:x:0:0:root:/root:/bin/bash\\nbin:x:1:1:bin:/bin:/bin/bash\\ndaemon:x:2:2:daemon:/sbin:/bin/bash\\nlp:x:4:7:lp
daemon:/var/spool/lpd:/bin/bash\\nnews:x:9:13:News
system:/etc/news:/bin/bash\\nuucp:x:10:14::/var/lib/uucp/taylor_config:/bin/bash\\ngames:x:12:100::/tmp:/bin/bash\\nman:x:13:2::/var/catman:/bin/bash\\nat:x:25:25::/var/spool/atjobs:/bin/bash\\npostgres:x:26:2:Postgres
Database Admin:/var/lib/pgsql:/bin/bash\\nlnx:x:27:27:LNX Database
Admin:/usr/lib/lnx:/bin/bash\\nmdom:x:28:28:Mailing list
agent:/usr/lib/majordomo:/bin/bash\\nyard:x:29:29:YARD Database
Admin:/usr/lib/YARD:/bin/bash\\nwwwrun:x:30:65534:Daemon user for
apache:/tmp:/bin/bash\\nsquid:x:31:65534:WWW proxy
squid:/var/squid:/bin/bash\\nfax:x:33:14:Facsimile
Agent:/var/spool/fax:/bin/bash\\ngnats:x:34:65534:Gnats Gnu Backtracking
System:/usr/lib/gnats:/bin/bash\\nempress:x:35:100:Empress Database
Adm20911 open("/var/yp/binding/jetsys.2", O_RDONLY) = 9
20911 readv(9, [{"\\377\\377", 2}, {"\\1\\0\\0\\0\\300\\250\\t\\1\\3]\\0\\0", 12}],
2) = 14
20911 close(9) = 0
20911 socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP) = 9
20911 bind(9, {sin_family=AF_INET, sin_port=htons(736),
sin_addr=inet_addr("0.0.0.0")}, 16) = 0
20911 ioctl(9, FIONBIO, [1]) = 0
20911 fcntl(9, F_SETFD, FD_CLOEXEC) = 0
ok, here machineB is asking for the password for user "js" and the
question is directed to the NIS server.
20911 sendto(9,
"v\\301\\334\\374\\0\\0\\0\\0\\0\\0\\0\\2\\0\\1\\206\\244\\0\\0\\0\\2\\0\\0\\0\\3\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\6jetsys\\0\\0\\0\\0\\0\\rpasswd.byname\\0\\0\\0\\0\\0\\0\\2js\\0\\0",
80, 0, {sin_family=AF_INET, sin_port=htons(861),
sin_addr=inet_addr("192.168.9.1")}, 16) = 80
20911 poll([{fd=9, events=POLLIN, revents=POLLIN}], 1, 5000) = 1
20911 recvfrom(9,
"v\\301\\334\\374\\0\\0\\0\\1\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\1\\0\\0\\0008js:PoukXpLv2auUc:501:100:J\\366rg
Spilker:/home/js:/bin/bash", 8800, 0, {sin_family=AF_INET,
sin_port=htons(861), sin_addr=inet_addr("192.168.9.1")}, [16]) = 88
and now the NIS server replies with the encyrpted password. It´s exactly
the password entry from /etc/shadow on machineA for user "js":
I thought the usual way to check if the supplied password of "js" is
correct should be to invoke crypt now to encrypt the plaintext password
supplied by "js" and compare.
But i see nothing like this.
20911 close(9) = 0
20911 close(8) = 0
20911 munmap(0x40020000, 4096) = 0
20911 open("/etc/shadow", O_RDONLY) = 8
20911 fstat(8, {st_dev=makedev(8, 17), st_ino=8184,
st_mode=S_IFREG|0640, st_nlink=1, st_uid=0, st_gid=15, st_blksize=4096,
st_blocks=2, st_size=1012, st_atime=99/09/13-20:42:40,
st_mtime=99/09/11-16:55:43, st_ctime=99/09/11-16:55:43}) = 0
20911 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS,
-1, 0) = 0x40020000
20911 read(8,
"root:RUf0bF4TbpG5Q:10831:0:10000::::\\nbin:*:8902:0:10000::::\\ndaemon:*:8902:0:10000::::\\nlp:*:9473:0:10000::::\\nnews:vNX3GeJQN/dLY:10845:0:10000::::\\nuucp:*:0:0:10000::::\\ngames:*:0:0:10000::::\\nman:*:8902:0:10000::::\\nat:*:8902:0:10000::::\\nlnx:*:8902:0:10000::::\\nmdom:*:8902:0:10000::::\\nyard:*:8902:0:10000::::\\nwwwrun:*:8902:0:10000::::\\nsquid:*:8902:0:10000::::\\npostgres:*:8902:0:10000::::\\nfax:*:8902:0:10000::::\\ngnats:*:8902:0:10000::::\\nempress:*:8902:0:10000::::\\nadabas:*:8902:0:10000::::\\namanda:*:8902:0:10000::::\\nixess:*:8902:0:10000::::\\nirc:*:8902:0:10000::::\\nftp:*:8902:0:10000::::\\nfirewall:*:8902:0:10000::::\\ninformix:.ALDuxphvjE/Y:10845:0:10000::::\\nnamed:*:8902:0:10000::::\\nvirtuoso:*:8902:0:10000::::\\ndb2fenc1:*:8902:0:10000::::\\ndb2inst1:*:8902:0:10000::::\\ndb2as:*:8902:0:10000::::\\nfnet:*:8902:0:10000::::\\npostfix:*:8902:0:10000::::\\ncyrus:C3Bo3di4I98G6:10831:0:10000::::\\nnps:*:8902:0:10000::::\\nskyrix:*:8902:0:10000::::\\ndbmaker:*:8902:0:10000::::\\nnobody:*:0:0:10000::::\\ntestinf:GnLVlfKvsBUUg:10845:0:10000::::\\n",
4096) = 1012
in:/usr/empress:/bin/bash\\nadabas:x:36:100:Adabas-D Database
Admin:/usr/lib/adabas:/bin/bash\\namanda:x:37:6:Amanda 20911 read(8, "",
4096) = 0
20911 close(8) = 0
20911 munmap(0x40020000, 4096) = 0
20911 send(7,
"\\0\\245\\3<\\20\\0\\0d\\0e\\0\\0\\0<\\0\\6IEEEI\\0\\0lsrvinfx\\0\\0\\0\\0\\0\\0\\5V1.0\\0\\0\\4SER\\0\\0\\10asfecho\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0\\0se\\0\\0\\0\\10\\0\\0\\0\\0\\0<soctcp\\0\\10\\0\\0\\0\\1\\0f\\0\\0\\0\\0\\0\\0\\374H\\0\\0\\0\\0\\0\\1\\0\\0\\0\\0\\0k\\0\\0\\0\\0\\0\\0Q\\257\\0\\0\\0\\0\\0\\10lb-is01\\0\\0\\0\\0\\2/\\0\\0t\\0\\10\\0\\0\\0\\0\\0\\0\\0\\0\\0\\177",
165, 0) = 165
20911 time([937248351]) = 937248351
20911 select(1024, [7], NULL, [7], {1, 0}) = 1 (in [7], left {1, 0})
20911 recv(7, "", 4096, 0) = 0
20911 shutdown(7, 2 /* send and receive */) = 0
20911 close(7) = 0
20911 gettimeofday({937248351, 637289}, NULL) = 0
20911 _llseek(6, 45056, [45056], SEEK_SET) = 0
20911 write(2, "1999-09-13 20:45:51.637289 daemon err = -952: User\\'s
password is not correct for the database server.\\n\\n", 103) = 103
and at last the message is -952; password wrong? But why. Are there any
other things i must do to allow user "js" access to the databaser server
on B?
All machine have different linux versions (machineA running 2.0.30,
machineB and C 2.2.10). Informix is 7.24 UC5.
Any ideas whats going wrong ??
Greetings, Joerg