IDS Forum

PAM Authentication with certificates

Posted By: Marcus Haarmann
Date: Wednesday, 20 August 2014, at 6:08 p.m.

Hi experts,

We need to set up an JAVA environment which accesses an IDS instance via JDBC/Datasource Pools. (sounds simple, have done that a 100 times ...)

Now comes the challenge:
The requirement is that the client does not have a clear text password stored in a config file nor hard coded in source code.
I was thinking of a PAM based solution, which would be working based on a challenge-response
message, which is based on a certificate check (I saw something like this in a project named X509pam on sourceforge,
which could be modified to be challenge-response instead of referring to a USB mount).

The user should be setup on the IDS server with an unmatchable password in OS, without a shell / home dir (unable to login or get access
via the standard connector with password, no .rhosts / hosts.equiv allowed).
The PAM module would be registered and given the location of the servers certificate/key (which are stored at a secure location).
The client code would respond to the challenge with the public part of the certificate (or some built-in constant encrypted with the certificate)
and the server PAM code would verify the response against the local certificates and authenticate the user without password.
(similar to a ssh login with public key authentication).
There is no need to encrypt the data, only authentication should be done without a password.
The goal is to disallow any user (without programming skills) to get access as this user e.g. using dbaccess.

Sounds like some programming work, which could be done, but I was wondering if anybody has a better idea,
which works out-of-the box.

Informix Version would be IDS11.70FC8, Linux 64 bit (probably 12.10FCx when project gets released).
Programming environment Java 7/JBoss Application server/latest JDBC driver

Any hints are welcome.
Thanks to all in advance.

Marcus Haarmann

Messages In This Thread

• PAM Authentication with certificates
  Marcus Haarmann -- Wednesday, 20 August 2014, at 6:08 p.m.
  • Re: PAM Authentication with certificates
    Fernando Nunes -- Wednesday, 20 August 2014, at 8:41 p.m.
    • Re: PAM Authentication with certificates
      Marcus Haarmann -- Thursday, 21 August 2014, at 2:41 a.m.
      • Re: PAM Authentication with certificates
        Fernando Nunes -- Thursday, 21 August 2014, at 5:25 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.