• [Info-ingres] Snooping on another user session

    From Martin Bowes@21:1/5 to Ingres lists on Tue Oct 6 09:57:02 2020
    Hi All,

    I have a user whose connection details I wish to trap. Specifically their setting of date_type_alias.

    They are running a fairly complicated application and although we *could in theory* get it recut to include a select dbmsinfo('date_type_alias'), in practice that may be a lot harder than it sounds.

    The error experienced by one (and only one) user would indicate they have connected with date alias of ansidate. Yet a scan of their client config says that should be ingresdate. I've trapped their connected activity with sc930 on the two installations
    on which the application is working but have not found any resetting of the date alias with a set date_alias 'ansidate' either.

    Having looked at the session trace, I can provoke the error using a terminal monitor connection, but only if I set date_alias 'ansidate'.

    Ideas?

    Martin Bowes

    <html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
    <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style><!--
    /* Font Definitions */
    @font-face
    {font-family:"Cambria Math";
    panose-1:2 4 5 3 5 4 6 3 2 4;}
    @font-face
    {font-family:Calibri;
    panose-1:2 15 5 2 2 2 4 3 2 4;}
    /* Style Definitions */
    p.MsoNormal, li.MsoNormal, div.MsoNormal
    {margin:0cm;
    margin-bottom:.0001pt;
    font-size:11.0pt;
    font-family:"Calibri",sans-serif;
    mso-fareast-language:EN-US;}
    a:link, span.MsoHyperlink
    {mso-style-priority:99;
    color:#0563C1;
    text-decoration:underline;}
    a:visited, span.MsoHyperlinkFollowed
    {mso-style-priority:99;
    color:#954F72;
    text-decoration:underline;}
    span.EmailStyle17
    {mso-style-type:personal-compose;
    font-family:"Calibri",sans-serif;
    color:windowtext;}
    .MsoChpDefault
    {mso-style-type:export-only;
    font-family:"Calibri",sans-serif;
    mso-fareast-language:EN-US;}
    @page WordSection1
    {size:612.0pt 792.0pt;
    margin:72.0pt 72.0pt 72.0pt 72.0pt;}
    div.WordSection1
    {page:WordSection1;}
    </style><!--[if gte mso 9]><xml>
    <o:shapedefaults v:ext="edit" spidmax="1026" />
    </xml><![endif]--><!--[if gte mso 9]><xml>
    <o:shapelayout v:ext="edit">
    <o:idmap v:ext="edit" data="1" />
    </o:shapelayout></xml><![endif]-->
    </head>
    <body lang="EN-GB" link="#0563C1" vlink="#954F72">
    <div class="WordSection1">
    <p class="MsoNormal">Hi All,<o:p></o:p></p>
    <p class="MsoNormal"><o:p>&nbsp;</o:p></p>
    <p class="MsoNormal">I have a user whose connection details I wish to trap. Specifically their setting of date_type_alias.<o:p></o:p></p>
    <p class="MsoNormal"><o:p>&nbsp;</o:p></p>
    <p class="MsoNormal">They are running a fairly complicated application and although we *<b>could in theory</b>* get it recut to include a select dbmsinfo(&#8216;date_type_alias&#8217;), in practice that may be a lot harder than it sounds.<o:p></o:p></p>
    <p class="MsoNormal"><o:p>&nbsp;</o:p></p>
    <p class="MsoNormal">The error experienced by one (and only one) user would indicate they have connected with date alias of ansidate. Yet a scan of their client config says that should be ingresdate. I&#8217;ve trapped their connected activity with sc930
    on the two
    installations on which the application is working but have not found any resetting of the date alias with a set date_alias &#8216;ansidate&#8217; either.
    <o:p></o:p></p>
    <p class="MsoNormal"><o:p>&nbsp;</o:p></p>
    <p class="MsoNormal">Having looked at the session trace, I can provoke the error using a terminal monitor connection, but only if I set date_alias &#8216;ansidate&#8217;.<o:p></o:p></p>
    <p class="MsoNormal"><o:p>&nbsp;</o:p></p>
    <p class="MsoNormal">Ideas?<o:p></o:p></p>
    <p class="MsoNormal"><o:p>&nbsp;</o:p></p>
    <p class="MsoNormal">Martin Bowes &nbsp;&nbsp;<o:p></o:p></p>
    </div>
    </body>
    </html>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Adrian Williamson@21:1/5 to Martin Bowes on Wed Oct 7 08:57:18 2020
    To: info-ingres@lists.planetingres.org

    This is a multipart message in MIME format.

    Wireshark?



    I've used this network sniffing software in the past to look at Ingres connection details.



    Some of it (e.g. opening a terminal session) is in text.



    Download wireshark/winpcap and do a packet capture when you connect to
    Ingres as a test.



    I've notes somewhere if you need them.







    From: info-ingres-bounces@lists.planetingres.org <info-ingres-bounces@lists.planetingres.org> On Behalf Of Martin Bowes
    Sent: 06 October 2020 10:57
    To: 'Ingres lists' <info-ingres@lists.planetingres.org>
    Subject: [Info-ingres] Snooping on another user session



    Hi All,



    I have a user whose connection details I wish to trap. Specifically their setting of date_type_alias.



    They are running a fairly complicated application and although we *could in theory* get it recut to include a select dbmsinfo('date_type_alias'), in practice that may be a lot harder than it sounds.



    The error experienced by one (and only one) user would indicate they have connected with date alias of ansidate. Yet a scan of their client config
    says that should be ingresdate. I've trapped their connected activity with sc930 on the two installations on which the application is working but have
    not found any resetting of the date alias with a set date_alias 'ansidate' either.



    Having looked at the session trace, I can provoke the error using a terminal monitor connection, but only if I set date_alias 'ansidate'.



    Ideas?



    Martin Bowes


    <html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta
    http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
    /* Font Definitions */
    @font-face
    {font-family:"Cambria Math";
    panose-1:2 4 5 3 5 4 6 3 2 4;}
    @font-face
    {font-family:Calibri;
    panose-1:2 15 5 2 2 2 4 3 2 4;}
    /* Style Definitions */
    p.MsoNormal, li.MsoNormal, div.MsoNormal
    {margin:0cm;
    margin-bottom:.0001pt;
    font-size:11.0pt;
    font-family:"Calibri",sans-serif;
    mso-fareast-language:EN-US;}
    span.EmailStyle19
    {mso-style-type:personal-reply;
    font-family:"Calibri",sans-serif;
    color:windowtext;}
    .MsoChpDefault
    {mso-style-type:export-only;
    font-size:10.0pt;}
    @page WordSection1
    {size:612.0pt 792.0pt;
    margin:72.0pt 72.0pt 72.0pt 72.0pt;}
    div.WordSection1
    {page:WordSection1;}
    </style><!--[if gte mso 9]><xml>
    <o:shapedefaults v:ext="edit" spidmax="1026" />
    </xml><![endif]--><!--[if gte mso 9]><xml>
    <o:shapelayout v:ext="edit">
    <o:idmap v:ext="edit" data="1" /> </o:shapelayout></xml><![endif]--></head><body lang=EN-GB link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Wireshark?<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>I&#8217;ve used this network sniffing
    software in the past to look at Ingres connection details.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>Some of it (e.g. opening a terminal session) is in text.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=
    MsoNormal>Download wireshark/winpcap and do a packet capture when you connect to Ingres as a test.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>I&#8217;ve notes somewhere if you need them.<o:p></o:p></p><p class=MsoNormal><o:p>
    &nbsp;</o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='mso-fareast-language:EN-
    From:</span></b><span lang=EN-US style='mso-fareast-language:EN-GB'> info-ingres-bounces@lists.planetingres.org &lt;info-ingres-bounces@lists.planetingres.org&gt; <b>On Behalf Of </b>Martin Bowes<br><b>Sent:</b> 06 October 2020 10:57<br><b>To:</b> '
    Ingres lists' &lt;info-ingres@lists.planetingres.org&gt;<br><b>Subject:</b> [Info-ingres] Snooping on another user session<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>Hi All,<o:p></o:p></p><p class=
    MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>I have a user whose connection details I wish to trap. Specifically their setting of date_type_alias.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>They are running a fairly
    complicated application and although we *<b>could in theory</b>* get it recut to include a select dbmsinfo(&#8216;date_type_alias&#8217;), in practice that may be a lot harder than it sounds.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=
    MsoNormal>The error experienced by one (and only one) user would indicate they have connected with date alias of ansidate. Yet a scan of their client config says that should be ingresdate. I&#8217;ve trapped their connected activity with sc930 on the two
    installations on which the application is working but have not found any resetting of the date alias with a set date_alias &#8216;ansidate&#8217; either. <o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>Having looked at the
    session trace, I can provoke the error using a terminal monitor connection, but only if I set date_alias &#8216;ansidate&#8217;.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>Ideas?<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</
    </p><p class=MsoNormal>Martin Bowes &nbsp;&nbsp;<o:p></o:p></p></div></body></html>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Chris.Clark@actian.com@21:1/5 to Martin Bowes on Wed Oct 7 14:08:37 2020
    On Tuesday, October 6, 2020 at 2:58:04 AM UTC-7, Martin Bowes wrote:
    ...
    The error experienced by one (and only one) user would indicate they have connected with date alias of ansidate. Yet a scan of their client config says that should be ingresdate. I’ve trapped their connected activity with sc930 on the two
    installations on which the application is working but have not found any resetting of the date alias with a set date_alias ‘ansidate’ either.
    Having looked at the session trace, I can provoke the error using a terminal monitor connection, but only if I set date_alias ‘ansidate’.

    It seems likely the setting is being set on the client side somehow and you want to prove one way or the other which it is.

    If this is a specific user and a libq based client I would recommend setting II_EMBED_SET client side to printgca and asking them to run the application and send the iiprtgca.log - super easy to read compared with other tracing options. Tracing also
    means the SQL actually used can be seen (as well as possible errors).

    If either of those assumptions are incorrect, I'd likely still go the GCA trace route but do it a different kind/place. You can decide if that's client or server depending on what you you know about the client. Docs have some notes on this, https://
    communities.actian.com/s/article/GCA-Trace-Logs-without-Tears-Ingres-II-and-OpenIngres-only is a pretty good server side one (you can always spin up a new GCC server for this specific user so as to avoid tracing everyone).

    Unless you can ensure the encryption is not in play, I would avoid raw tracing the socket or wireshark. If encryption is not enabled then you can use your favorite network sniffing technique :-)

    Its probably worth opening an enhancement request for server side checking of session sessions (in IMA).

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)