Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
Connection security
You can administer the security of the connections to the database server by using authentication and authorization processes.
Pluggable authentication modules (UNIX™ or Linux™)
A Pluggable Authentication Module (PAM) is a well-defined framework for supporting different authentication modules that were originally developed by Sun Microsystems. PAM is supported in both 32- and 64-bit modes on Solaris, Linux™, HP-UX and AIX®.
Configuring a connection to use PAM
You configure a connection to use a pluggable authentication module (PAM) by adding the PAM options to the connection information in the sqlhosts file.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
      - Authentication mechanisms
        You can configure the Informix® server authentication mechanisms to meet varying requirements, such as different security methods required for local and remote connections, database access by users without operating system accounts on the servers host computer, and non-root installation.
      - Internal users (UNIX™, Linux™)
        The DBSA can grant database access to users that do not authenticate on the OS of the host computer by mapping PAM-authenticated users to OS-level entities or by configuring the server to perform internal authentication.
      - Guest account (Windows™)
        Disable the Windows™ Guest account to prevent anonymous logins.
      - Trusted-context objects and trusted connections
        You can use trusted-context objects and trusted connections to increase system performance and security within a three-tier application model.
      - Pluggable authentication modules (UNIX™ or Linux™)
        A Pluggable Authentication Module (PAM) is a well-defined framework for supporting different authentication modules that were originally developed by Sun Microsystems. PAM is supported in both 32- and 64-bit modes on Solaris, Linux™, HP-UX and AIX®.
        The name of the PAM service
        The PAM service name identifies the PAM module.
        Authentication modes with PAM
        The pluggable authentication mode (PAM) determines whether a user can authenticate by providing a password, responding correctly to a challenge, or a combination of both.
        PAM required stack size
        You can customize the stack size available for PAM modules.
        Configuring a connection to use PAM
        You configure a connection to use a pluggable authentication module (PAM) by adding the PAM options to the connection information in the sqlhosts file.
        Define a PAM service
        If you define your own PAM service for the Informix® server instead of using one of the services that are already defined in the pam.conf file, you must include the auth and account functions.
      - LDAP authentication support on Windows™
      - Authentication module deployment
      - Simple password encryption
        The simple password communication support module (SPWDCSM) provides password encryption.
      - Single sign-on
        Single sign-on is an authentication feature that bypasses the requirement to provide user name and password after a user logs into the client computer's operating system.
      - Securing local connections to a host
        The database server administrator (DBSA) can use the SECURITY_LOCALCONNECTION configuration parameter to set up security checking for local connections with the same host.
      - Limiting denial-of-service flood attacks
        Informix® has multiple listener threads (listen_authenticate) to limit denial-of-service (DOS) attacks.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
  - Auditing data security

Configuring a connection to use PAM

You configure a connection to use a pluggable authentication module (PAM) by adding the PAM options to the connection information in the sqlhosts file.

About this task

To configure a connection to use PAM, you must know:

The name of the PAM module.
Whether the PAM module raises a challenge in addition to accepting a simple user name and password combination.

Procedure

To configure PAM authentication for a connection:

Edit the sqlhosts file for the connection. Include the s=4 option and the PAM options pam_serv, to specify the PAM service, and pamauth, to specify the authentication mode.

Example

The following sqlhosts file entry shows a connection that is configured to use PAM challenge authentication:

ifxserver2 onsoctcp servermc portnum1 s=4,pam_serv=(pam_chal),pamauth=(challenge)

The following sqlhosts file entry shows a connection that is configured to use PAM password authentication:

ifxserver2 onsoctcp servermc portnum2 s=4,pam_serv=(pam_pass),pamauth=(password)

The following sqlhosts file entry shows a Distributed Relational Database Architecture™ (DRDA®) connection that is configured to use PAM password authentication:

ifxserver3 drsoctcp serverdrda portnum3 s=4,pam_serv=(pam_pass),pamauth=(password)