ER Connection Issues

[Keith Simmons]

Hi

I currently have ER running between an AIX server (source) and two Solaris servers (targets) in a 'one-way' replication environment. I need to add a RedHat Enterprise (2.6.32-131.0.15.el6.x86_64) server as a third target (prior to removing one or both of the existing targets).

I've set up the sqlhosts, services and .rhosts files on both servers and can connect from RedHat to AIX using dbaccess but am unable to connect from AIX to RedHat. I'm getting error 908 which indicates connection /permission issues.

I suspect I am running into some security block on the RedHat server (note I can only connect using SSH, sftp etc and not telnet or ftp).

Any suggestions on what I need to do to enable this connectivity for dbaccess/ER ?

Many Thanks
Keith

[Alexandre Marini]

Hello.
Have you put the AIX IP and hostname into RedHat /etc/hosts.equiv  file?

If not, try it first, that should work.
But it can also be a mispelled typing error in your AIX or Redhat sqlhosts file, make sure to check it out.

Hope it helps.
Regards.

Alexandre Marini
IBM Informix Certified Professional v10 / v11.50 / v11.70
IBM Information Management Informix Technical Professional
IBM Infosphere DataStage Technical Professional
Informix Senior DBA - Orizon Brasil
BRIUG website administrator
Informix independent consultant

---

Date: Tue, 7 May 2013 11:49:49 +0100
Subject: ER Connection Issues
From: smil...@gmail.com
To: inform...@iiug.org

_______________________________________________ Informix-list mailing list Inform...@iiug.org http://www.iiug.org/mailman/listinfo/informix-list

[Keith Simmons]

Alexandre

Thanks, created /etc/hosts.equiv (even though I normally use ~informix/.rhosts which was set up correctly) and double checked sqlhosts and /etc/services. No joy, still cannot connect using dbaccess.

Keith

[Keith Simmons]

Clive

Thanks, output :
 iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

On 7 May 2013 12:22, Clive Eisen <cl...@hildebrand.co.uk> wrote:

On 7 May 2013, at 11:49, Keith Simmons wrote:
> I suspect I am running into some security block on the RedHat server (note I can only connect using SSH, sftp etc and not telnet or ftp).
> Any suggestions on what I need to do to enable this connectivity for dbaccess/ER ?

run iptables --list and see if your sqlexec port is open on the RH server

--
Clive

[Keith Simmons]

Clive

No, but it won't take telnet from anywhere on any port, only ssh.

Keith

On 7 May 2013 13:19, Clive Eisen <cl...@hildebrand.co.uk> wrote:

Hmnn - that looks ok

Can you telnet from the AIX server to the RH server on the sqlexec port?

--
Clive

[Keith Simmons]

Clive

Many thanks, that done it !!

Need to speak with my hosting supplier about their default level of security !!

Keith

On 7 May 2013 14:01, Clive Eisen <cl...@hildebrand.co.uk> wrote:

Then you need to add an explicit ACCEPT entry in iptables for your sqlexec port

Add it to

/etc/sysconfig/iptables

and do a service iptables restart

--
Clive

[Clive Eisen]

[Clive Eisen]

[Clive Eisen]

Then you need to add an explicit ACCEPT entry in iptables for your sqlexec port

Add it to

/etc/sysconfig/iptables

and do a service iptables restart

--
Clive

On 7 May 2013, at 13:51, Keith Simmons wrote:

> Clive
> No, but it won't take telnet from anywhere on any port, only ssh.
> Keith
>
>
> On 7 May 2013 13:19, Clive Eisen <cl...@hildebrand.co.uk> wrote:

> Hmnn - that looks ok
>
> Can you telnet from the AIX server to the RH server on the sqlexec port?
>
> --
> Clive
>
>
> On 7 May 2013, at 12:54, Keith Simmons wrote:
>
> > Clive
> > Thanks, output :
> > iptables --list
> > Chain INPUT (policy ACCEPT)
> > target prot opt source destination
> > ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
> > ACCEPT icmp -- anywhere anywhere
> > ACCEPT all -- anywhere anywhere
> > ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
> > REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
> >
> > Chain FORWARD (policy ACCEPT)
> > target prot opt source destination
> > REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
> >
> > Chain OUTPUT (policy ACCEPT)
> > target prot opt source destination
> >
> >
> >
> > On 7 May 2013 12:22, Clive Eisen <cl...@hildebrand.co.uk> wrote:
> >

[Clive Eisen]

If you don't need the software firewall then do

service iptables stop

chkconfig iptables off

--

Clive

--

Clive

On 7 May 2013, at 16:39, Keith Simmons <smil...@gmail.com> wrote:

Clive

Many thanks, that done it !!

Need to speak with my hosting supplier about their default level of security !!

Keith

On 7 May 2013 14:01, Clive Eisen <cl...@hildebrand.co.uk> wrote: