IDS Forum

Re: HDR setup issues pertaining to hosts.equiv

Posted By: Fernando Nunes
Date: Friday, 8 April 2016, at 7:19 a.m.

In Response To: Re: HDR setup issues pertaining to hosts.equiv (Nagaraju Inturi)

Current versions of Informix most probably validate two entries agains the
trust file configurations:

1- The reverse DNS (or /etc/hosts file) name of the client IP address (this
is what the server "sees"
2- The name sent by the client as the client sees itself

These two entries are shown in the -956 error. And both have to be trusted.
In a perfect workd they should be the same.... In many cases they aren't
due to misconfiguration.

The reason for this lies in an obscure security issue when connections
without passwords are passing a connection manager. My understanding is
that the "workaround" doesn't make them safe in any case...

So,yes, if your systems are not perfectly configured you need to add both.
The order is the already mentioned. I advise strongly to avoid using the
systemfiles (/etc/hosts.equiv). It took us 25 or 30 years to solve this.
Before customers would complain about it (in most cases without a practical
reason), now that we solved it, customers ignore the fix ;)

Regards.

On Fri, Apr 8, 2016 at 1:12 AM, Nagaraju Inturi <nagaraju@us.ibm.com> wrote:

> Whether short name or fully qualified host name depends on DNS and=20
> /etc/hosts configuration, and look up order. I would always add both short
> =
>
> name and fully qualified name to the trusted host file.
> Also trusted host file lookup order is REMOTE=5FSERVER=5FCFG,
> /etc/hosts.eq=
> uiv=20
> and $INFORMIXDIR/etc/hosts.equiv(if sqlhost file record is configured with
> =
>
> s=3D6 option).
>
> So as a best practice I would configure REMOTE=5FSERVER=5FCFG and add both
> =
>
> short and fully qualified host name to the file.
>
> Thanks & Regards,
> Nagaraju
>
> From: "MURALI PAZHAYANNUR" <pmurali@ftportfolios.com>
> To: ids@iiug.org
> Date: 04/07/2016 02:39 PM
> Subject: HDR setup issues pertaining to hosts.equiv [36928]
> Sent by: ids-bounces@iiug.org
>
> Before testing Informix HDR to a new box (uxtest-drunix) I had setup HDR=20
> between two other boxes (uxdev-uxtest). I encountered a few issues setting
> =
>
> up=20
> this (the uxtest-drunix HDR). One of the most persistent error I noted
> in=20
> the=20
> log was:=20
>
> 12:01:11 listener-thread: err =3D -956: oserr =3D 0: errstr =3D=20
> informix@uxtest.nikeseclp.com[uxtest]: Client host or user=20
> informix@uxtest.nikeseclp.com[uxtest] is not trusted by the server.=20
>
> I tracked it down to include the fully qualified hostname in the=20
> hosts.equiv=20
> file. So here are my questions:=20
>
> 1. Why was this not required with the uxdev-uxtest setup? What could be=20
> different with drunix?=20
> 2. Is it necessary to have hosts.equiv in $INFORMIXDIR/etc. I already have
> =
>
> it=20
> in /etc. So is this new with version 12.10?=20
> 3. If I did not set REMOTE=5FSERVER=5FCFG hosts.equiv, would the
> complete=20
> hostename have to be in /etc/hosts.equiv?=20
> 4. Also, is this a new standard to have the full hostname=20
> (uxtest.nikeseclp.com) instead of 'uxtest'.=20
> 5. Would it not be a good idea for this to be indicated as a'Warning' in=20
> the=20
> log and then display the error message and fail the HDR?=20
>
> System Information for uxdev, uxtest, drunix:=20
>
> HP-UX B.11.31 U ia64=20
> IBM Informix Dynamic Server Version 12.10.FC6=20
>
> Thanks=20
>
>
> ***************************************************************************=
> ****=20
>
> Forum Note: Use "Reply" to post a response in the discussion forum.=20
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

--047d7bdca44ca22032052ff75eb4

Messages In This Thread

• HDR setup issues pertaining to hosts.equiv
  MURALI PAZHAYANNUR -- Thursday, 7 April 2016, at 3:38 p.m.
  • Re: HDR setup issues pertaining to hosts.equiv
    Nagaraju Inturi -- Thursday, 7 April 2016, at 8:12 p.m.
    • Re: HDR setup issues pertaining to hosts.equiv
      Fernando Nunes -- Friday, 8 April 2016, at 7:19 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.