Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
Discretionary access control
Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
Security for external routines (UDRs)
External routines with shared libraries that are outside the database server can be security risks. External routines include user-defined routines (UDRs) and the routines in DataBlade® modules.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
      - User roles
        A role is a work-task classification, such as payroll or payroll manager. Each defined role has privileges on the local database object granted to the role. You use the CREATE ROLE statement to define a role.
      - Setting permission to create databases
        Use the DBCREATE_PERMISSION configuration parameter to give specified users permission to create databases and thus prevent other users from creating databases.
      - Security for external routines (UDRs)
        External routines with shared libraries that are outside the database server can be security risks. External routines include user-defined routines (UDRs) and the routines in DataBlade® modules.
      - Enabling non-DBSA users to view SQL statements in an active session
        You can enable non-database server administrator (DBSA) users to view SQL statements in an active session.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
  - Auditing data security

Security for external routines (UDRs)

External routines with shared libraries that are outside the database server can be security risks. External routines include user-defined routines (UDRs) and the routines in DataBlade® modules.

A database server administrator (DBSA), the user informix by default, can implement security measures that establish which users can register external routines. This prevents unauthorized users from registering the external routines.

Use the IFX_EXTEND_ROLE configuration parameter to restrict the ability of users to register external routines.

The default value of the IFX_EXTEND_ROLE configuration parameter is 1 (or On).

When the IFX_EXTEND_ROLE configuration parameter is set to On:

You can grant a user the privileges to create or drop a UDR that has the EXTERNAL clause.
The EXTEND role is operational and you can grant a user the privileges to create or drop an external routine that has the EXTERNAL clause.

When you grant the EXTEND role to a specific user, the sysroleauth system catalog table is updated to reflect the new built-in role.

After you set the IFX_EXTEND_ROLE configuration parameter to On, a DBSA can use the following syntax to grant and revoke privileges to and from specific users.

GRANT extend To username
REVOKE extend From username

If you do not want to restrict UDR access, set the IFX_EXTEND_ROLE configuration parameter to 0 (or Off). When the IFX_EXTEND_ROLE parameter is set to Off, the EXTEND role is not operational and any user can register external routines.

The dbimport utility, in particular, is affected when the IFX_EXTEND_ROLE configuration parameter is set to On because a user who uses dbimport to create a new database has not been given an extend role on that database.

For more information, see the Informix® Guide to SQL: Syntax.