Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
HCL Informix® directory security
utilities and product directories are secure by default.
Utilities for checking directory security (UNIX™)
The database server utilities make security checks before the database server starts.
Securing $INFORMIXDIR and its subdirectories
When the $INFORMIXDIR directory is not secure, run a security script to reset directory permissions.
Disabling the security check of INFORMIXDIR and subdirectories
You must never disable security checking on INFORMIXDIR, but you can partially disable the automatic security check of a specific installation directory.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
      - Utilities for checking directory security (UNIX™)
        The database server utilities make security checks before the database server starts.
        Installation path security requirements (UNIX™)
        The owner, group, and write access settings of the directories in the installation path and key subdirectories must be secure to prevent attacks on Informix® programs.
        The onsecurity utility (UNIX™)
        The onsecurity utility checks the security of a file, directory, or path. It also troubleshoots the security problems if any are detected.
        Securing $INFORMIXDIR and its subdirectories
        When the $INFORMIXDIR directory is not secure, run a security script to reset directory permissions.
        Disabling the security check of INFORMIXDIR and subdirectories
        You must never disable security checking on INFORMIXDIR, but you can partially disable the automatic security check of a specific installation directory.
      - Security warnings and error messages at server startup (UNIX™)
        If a security check that a server utility performs at startup detects a problem, the security check returns an error message or warning.
      - Users and group membership for running utilities
        Most utilities run as secure users and belong to a secure group.
      - Security of the chunk files
        For Informix® security, store data in chunk files that are owned by user informix, belong to group informix, and have 660 permissions.
      - Security for loading external modules
        Use the DB_LIBRARY_PATH configuration parameter to control the location from which shared objects, such as external modules, can be loaded.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
  - Auditing data security

Disabling the security check of INFORMIXDIR and subdirectories

You must never disable security checking on INFORMIXDIR, but you can partially disable the automatic security check of a specific installation directory.

About this task

This task is intended only if you have no other recourse in order to do essential work on the database server and can accept the consequences of disabling security on INFORMIXDIR. If you disable the security checking, you must use the ibmifmx_security.sh script to limit the number of SUID and SGID programs on your system.

Important: The following script causes Informix® to run with an INFORMIXDIR that has public write access, which can open up your system to security breaches.

To disable security checking:

Procedure

As the user root, run the INFORMIXDIR/etc/informixdir-is-insecure script.

After this script runs successfully, the warning messages still open when the utilities are run, but the programs continue. You can specify the value of INFORMIXDIR on the command line as an argument to the script. Thus, you are not required to set INFORMIXDIR in the root user environment.

Results

The informixdir-is-insecure script creates a /etc/informix directory (if necessary) that is owned by root and has 555 permissions. In this directory, the script creates a file named server-xx.xx.yyy that has 444 permissions. The xx.xx portion of the file name is the major version number and yyy portion is the fix pack number: for example, server-14.10. This file lists the $INFORMIXDIR values for which security checking is disabled.

If you later upgrade Informix®, you will be prompted to verify that you want to continue using an INFORMIXDIR that is not secure in the newer version.