Hi All.

I'm trying to trace a user who keeps stufffing up their username and password.
Sadly this isn't as easy as it seems....

The errlog is filled with messages like:
E_GC000E_RMT_LOGIN_FAIL_INFO A remote login attempt failed. The remote machine was 'brat.ctsu.ox.ac.uk', and the userid was 'ingres'.

The trouble is that the 'remote machine' mentioned here is actually the local host, whch given that the username is a generic account, is making this a tad tricky to track down.

I've enable security_audit User, database. But the user details are not being captured...presumbly as the user never manages to authenticate the system is not writing an entry into iiaudit. I only seem to catch details in iiaudit for auditevent = 'AUTHENTICATE' with auditstatus = 'Y'.

I've tried monkeying with gca tracing but to no avail.

I've tried monkeying with IMA, to no avail.

I'm pretty sure that this is a VDBA connection coming in from a PC. So whatI would like is for the errlog string to contain the PC name or IP. I would also like to see some residue in iiaudit that indicates an authenticationfailed.

Is this a bug or am I doing something wrong? Is there an easier way?

Martin Bowes

Hi Martin,

For me VDBA sessions have a session description set to "Visual/DBA
something", but perhap's only on recent versions ...

Hope this help,

Regards,
--
Jean-Pierre Zuate
La Fage Conseil
+33(0)6 11 40 11 09
jean-pierre.zuate (AT) lafageconseil (DOT) fr
http://lafageconseil.fr/


2011/1/17 Martin Bowes <martin.bowes (AT) ctsu (DOT) ox.ac.uk>

Hi Jean,

Sadly that's only going to help whenh the user establishes a connection. Inmy case the user fails to authenticate and gets thrown out.

Marty

From: Jean-Pierre Zuate, La Fage Conseil [mailto:jean-pierre.zuate (AT) lafageconseil (DOT) fr]
Sent: 17 January 2011 14:46
To: Ingres and related product discussion forum
Subject: Re: [Info-Ingres] tracing failing user connections

Hi Martin,

For me VDBA sessions have a session description set to "Visual/DBA something", but perhap's only on recent versions ...

Hope this help,

Regards,
--
Jean-Pierre Zuate
La Fage Conseil
+33(0)6 11 40 11 09
jean-pierre.zuate (AT) lafageconseil...nseil (DOT) fr>
http://lafageconseil.fr/

2011/1/17 Martin Bowes <martin.bowes (AT) ctsu (DOT) ox.ac.uk<mailto:martin.bowes (AT) ctsu (DOT) .ox.ac.uk>>
Hi All.

I'm trying to trace a user who keeps stufffing up their username and password.
Sadly this isn't as easy as it seems....

The errlog is filled with messages like:
E_GC000E_RMT_LOGIN_FAIL_INFO A remote login attempt failed. The remote machine was 'brat.ctsu.ox.ac.uk<http://brat.ctsu.ox.ac.uk>', and the userid was 'ingres'.

The trouble is that the 'remote machine' mentioned here is actually the local host, whch given that the username is a generic account, is making this a tad tricky to track down.

I've enable security_audit User, database. But the user details are not being captured...presumbly as the user never manages to authenticate the system is not writing an entry into iiaudit. I only seem to catch details in iiaudit for auditevent = 'AUTHENTICATE' with auditstatus = 'Y'.

I've tried monkeying with gca tracing but to no avail.

I've tried monkeying with IMA, to no avail.

I'm pretty sure that this is a VDBA connection coming in from a PC. So whatI would like is for the errlog string to contain the PC name or IP. I would also like to see some residue in iiaudit that indicates an authenticationfailed.

Is this a bug or am I doing something wrong? Is there an easier way?

Martin Bowes

_______________________________________________
Info-Ingres mailing list
Info-Ingres (AT) kettleriverconsulti...ting (DOT) com>
http://ext-cando.kettleriverconsulti...fo/info-ingres