Because ISA users who log into the ISA server with the informix username have the privileges of the user informix account, follow these recommended practices to help ensure that only authorized users can access your database servers through ISA.
Authenticated ISA users who log in as user informix have all the capabilities of the user informix on the machine they are logged in to. On Windows NT, such users have the capabilities a member of the Informix-Admin group instead of the user informix.
The authentication mechanism of the ISA HTTP server is the primary means of preventing unauthorized access to these capabilities. This mechanism uses a conventional username and password combination to identify authorized users and provides adequate security for many installations as long as traffic between the browser and database server is confined to a trusted intranet. Basic HTTP authentication, however, is vulnerable to password sniffing attacks and does not provide sufficient protection against attacks from the public Internet.
Users who are monitoring server performance but are not expected to change parameters or perform administrative tasks can examine all of the database server statistics safely in read-only mode. Read-only users cannot use the Command menu option, change the database server mode, add or remove log files, perform backups and restores, and so on.
To set up login accounts for users who do not perform these tasks, follow the instructions in the Passwords section of the ISA Administrator's Guide. You might even set up such an account for yourself if you want to monitor the server as a read-only user and log in as user informix only when you perform administrative tasks.
NOTE: | Users with read-only access to ISA cannot use the Query page in the SQL menu option to enter SQL queries against any database. They can, however, use the Schema page to view all column names in all tables. |
Some installations do not regard their intranets as secure enough to use only basic HTTP authentication. In these cases, a secure HTTP server that offers better authentication schemes and end-to-end encryption might be justified. For more information, contact IBM.
If you access ISA as user informix from someone else's computer, and do not completely exit from the browser when you are finished, the user of that computer might continue to have full access to the ISA server. Most browsers store the username and password that you have supplied until you exit from all browser windows. Make sure that you close every browser window. If you are using Netscape Communicator, make sure that the Messenger email window is closed.
The easiest way to verify that the browser has terminated is to re-launch it. When the browser window appears, you should see the splash screen of the browser. If you attempt to access ISA, you should be asked for a username and password. Click Cancel in the authentication dialog box if you do not want to reconnect to ISA.
In addition to the usual password-selection guidelines, which recommend using mixed-case, non-alphanumeric characters and a minimum password length of 6 characters, follow these guidelines for ISA password selection:
This password does not need to be the same as the operating-system password for the informix account. In fact, it might reduce overall risk if they are different.
These logs contain information about who accessed ISA and what activities they performed.
IBM posts any relevant information here. In addition, you can monitor the home page of the Apache Group if you use Apache, or the Microsoft Internet Information Server page if you use IIS.