Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
HCL Informix® directory security
utilities and product directories are secure by default.
Security warnings and error messages at server startup (UNIX™)
If a security check that a server utility performs at startup detects a problem, the security check returns an error message or warning.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
      - Utilities for checking directory security (UNIX™)
        The database server utilities make security checks before the database server starts.
      - Security warnings and error messages at server startup (UNIX™)
        If a security check that a server utility performs at startup detects a problem, the security check returns an error message or warning.
      - Users and group membership for running utilities
        Most utilities run as secure users and belong to a secure group.
      - Security of the chunk files
        For Informix® security, store data in chunk files that are owned by user informix, belong to group informix, and have 660 permissions.
      - Security for loading external modules
        Use the DB_LIBRARY_PATH configuration parameter to control the location from which shared objects, such as external modules, can be loaded.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
  - Auditing data security

Security warnings and error messages at server startup (UNIX™)

If a security check that a server utility performs at startup detects a problem, the security check returns an error message or warning.

These messages are returned when the message file and internationalization support are unavailable. Therefore, the error messages do not have error numbers and are not translated.

The following list shows security-related messages that can open when startup of the database server is attempted. In most environments, the server utility automatically exits when it detects one of these problems.

INFORMIXDIR or ONCONFIG is too long. Maximum length for $INFORMIXDIR/etc/$ONCONFIG is 255 characters.
INFORMIXSQLHOSTS is too long. Maximum length is 255 characters.
TBCONFIG is not supported and will not be used.
User informix not found.
Group informix not found.
Could not access logical-file file name.
Logical-file file name is not owned by user with id UID.
Logical-file file name not owned by group with id GID.
Logical-file file name has insecure mode mode.

The following table defines the variables used in the preceding messages.


Variable	Explanation
`file name`	A name of the file or directory
`logical-file`	onconfig, INFORMIXSQLHOSTS, INFORMIXDIR, or INFORMIXDIR/`xxx` (where `xxx` is one of a number of subdirectories under $INFORMIXDIR). For example, if the INFORMIXDIR environment variable is set to /usr/informix, the message might read: `INFORMIXSQLHOSTS /usr/informix/etc/sqlhosts is not owned by the user with id 1234.`
`mode`	An octal permissions value
`UID`	A user ID
`GID`	A group ID