Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
Network data encryption
Use network encryption to encrypt data transmitted between server and client, and between server and other server.
Communication support modules for data transmission encryption
You can use the communication support modules (CSMs) to encrypt data transmissions, including distributed queries, over the network.
CSM configuration file
To use a communication support module (CSM), you must have a concsm.cfg file.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
      - Communication support modules for data transmission encryption
        You can use the communication support modules (CSMs) to encrypt data transmissions, including distributed queries, over the network.
        Enabling encryption with communication support modules
        You must modify the concsm.cfg file to use encryption with communication support modules.
        CSM configuration file
        To use a communication support module (CSM), you must have a concsm.cfg file.
        Encryption ciphers and modes
        You must specify which ciphers and mode to use during encryption.
        MAC key files
        The MAC key files contain encryption keys that are used to encrypt messages.
        Generating a new MAC key file
        You can generate a new MAC key file to improve the reliability of message verification using encryption.
        MAC levels
        MAC levels determine the type of MAC key generation.
        Switch frequency
        The switch frequency defines when ciphers and or secret keys are renegotiated.
        Network data encryption syntax
        You must specify network encryption libraries and options in the concsm.cfg file.
      - Enterprise replication and high availability network data encryption
        You can configure network data encryption for Enterprise Replication and high availability clusters by using configuration parameters.
      - Background Knowledge on Keystores
        This topic offers some generic insights into keystores and how they are used for secure communications with the TLS (Transport Layer Security) protocol. While the first part provides the theoretical background, the second part shows examples for applying this in practice using OpenSSL.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
  - Auditing data security

CSM configuration file

To use a communication support module (CSM), you must have a concsm.cfg file.

An entry in the concsm.cfg file is a single line and is limited to 1024 bytes. After you describe the CSM in the concsm.cfg file, you can enable it in the options parameter of the sqlhosts file, as described in Informix® Administrator's Guide.

The concsm.cfg file is located in the etc directory of INFORMIXDIR by default. If you want to store the file somewhere else, you can override the default location by setting the INFORMIXCONCSMCFG environment variable to the full path name of the new location. For information about setting the environment variable INFORMIXCONCSMCFG, see the Informix® Guide to SQL: Reference.

Entries in the concsm.cfg file must conform to the following restrictions:

The following characters are not allowed to be part of library path names:
- = (equal sign)
- " (double quotation mark)
- , (comma)
White spaces cannot be used unless the white spaces are part of a path name.