We're looking for a way to work with an Informix 11.50 server which
resides on a Linux Server in our DMZ. We have to update master data
regularly. The programs and source data are in the LAN. Is possible to
access the Informix Server in the DMZ via ssh-tunnel and how can we make
it work. The ssh tunnel could be opened from an internal server through
the firewalls to the Informix Server Host.

Your help is much appreciated.

Reinhard.

On 25/08/2010 14:43, Habichtsberg, Reinhard wrote:

man ssh
and/or
man stunnel

Or to put it another way - what is it about tunneling (this is not an
IDS question) that you need to know?

--
Clive

--
This message has been scanned for viruses and
dangerous content by OpenProtect(http://www.openprotect.com), and is
believed to be clean.

Yes, it's possible. Set up the tunnel:

client_machine:client_port <--------------------> IDS_machine:IDS_port

Setup your client INFORMIXSQLHOSTS to use something like:

INFORMIXSERVER onsoctcp client_machine client_port


Be careful with the following:

turn off secure_localconnections

Regards.



On Wed, Aug 25, 2010 at 2:43 PM, Habichtsberg, Reinhard <
RHabichtsberg (AT) arz-emmendingen (DOT) de> wrote:


--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

Yes, it's possible. Set up the tunnel:

client_machine:client_port <--------------------> IDS_machine:IDS_port

Setup your client INFORMIXSQLHOSTS to use something like:

INFORMIXSERVER onsoctcp client_machine client_port


Be careful with the following:

turn off secure_localconnections

Regards.



On Wed, Aug 25, 2010 at 2:43 PM, Habichtsberg, Reinhard <
RHabichtsberg (AT) arz-emmendingen (DOT) de> wrote:


--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

Ok, I have to use the client port to access the remote IDS. Think I got
that.



Thank you, Fernandez.



Reinhard



From: informix-list-bounces (AT) iiug (DOT) org
[mailto:informix-list-bounces (AT) iiug (DOT) org] On Behalf Of Fernando Nunes
Sent: Wednesday, August 25, 2010 4:48 PM
To: informix-list (AT) iiug (DOT) org
Subject: Re: Queries via ssh-tunnel



Yes, it's possible. Set up the tunnel:

client_machine:client_port <--------------------> IDS_machine:IDS_port

Setup your client INFORMIXSQLHOSTS to use something like:

INFORMIXSERVER onsoctcp client_machine client_port


Be careful with the following:

to turn off secure_localconnections

Regards.



On Wed, Aug 25, 2010 at 2:43 PM, Habichtsberg, Reinhard
<RHabichtsberg (AT) arz-emmendingen (DOT) de> wrote:

We're looking for a way to work with an Informix 11.50 server which
resides on a Linux Server in our DMZ. We have to update master data
regularly. The programs and source data are in the LAN. Is possible to
access the Informix Server in the DMZ via ssh-tunnel and how can we make
it work. The ssh tunnel could be opened from an internal server through
the firewalls to the Informix Server Host.

Your help is much appreciated.

Reinhard.


_______________________________________________
Informix-list mailing list
Informix-list (AT) iiug (DOT) org
http://www.iiug.org/mailman/listinfo/informix-list




--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

I'm not very experienced with tunneling. The IDS question is: At the end
of tunnel I want an IDS port answering and accepting connections. Is
that possible? What about authentication? How does the connection string
look like? I assume the user who connects has to be a user on the host
where the IDS runs. Is it possible to use the .rhosts method and what
has to be entered in the .rhosts of the user?

TIA, Reinhard

On 25/08/2010 15:59, Habichtsberg, Reinhard wrote:

A process (be it ssh or stunnel ) listens on a network interface
(usually localhost) on a given port on machine A
and transports the data (over ssh) to a destination port on machine B

so if A is your client
B is your server
and 9088 is the port your sqlexec is on

you could on machine A do

ssh -L9088:192.168.0.1:9088 someuser@B

where 192.168.0.1 is the IP address on B that IDS is listening on

then on the client you connect to 127.0.0.1:9088 with your application

As far as IDS is concerned the user IS ON B - it knows nothing about A
You cannot use .rhosts - for ssh you could use ssh keys for someuser
Note that someuse is used for setting up the ssh - it need not be the
user that you are going to connect to IDS with.

If you need to set up the ssh from B to A use -R instead of -L

Or use stunnel

HTH

--
Clive

--
This message has been scanned for viruses and
dangerous content by OpenProtect(http://www.openprotect.com), and is
believed to be clean.