topic Re: securing plain text passwords in Operating System - HP-UX

securing plain text passwords

Tom Elder — Thu, 28 Feb 2002 18:22:44 GMT

is there a way to secure plain text passwords in a script that you need to pass a password to an application like a database ?

Re: securing plain text passwords

Alan Riggs — Thu, 28 Feb 2002 18:30:43 GMT

Not that I know of. If you really must hardcode an id/password in a script (as for sqlplus connections) make sure that the script itself can be read only by users who already have access to that id. If regular file permissions do not allow the granularity you need, use ACLs.

Re: securing plain text passwords

Tom Elder — Thu, 28 Feb 2002 19:49:37 GMT

I will look up ACL's in my man pages but I was not aware of their use outside of routers and such. Can you point me in a direction for my research?

thanks
tom

Re: securing plain text passwords

Eric Ladner — Thu, 28 Feb 2002 21:15:56 GMT

Also, be aware that if you log into a database like so:

sqlplus scott/tiger

Everybody and their brother on the machine can do a ps -ef and see your password in the process list.

This works:

USERID=scott/tiger
sqlplus <$USERID
select sysdate from dual;
EOF

Your password won't show up on the command line that way. Of course, different applications may have different issues.

Re: securing plain text passwords

K.Vijayaragavan. — Fri, 01 Mar 2002 06:22:30 GMT

Have you seen,

#man setkey
#man makekey
#man crypt
#man encrypt

-K.Vijay

Re: securing plain text passwords

Volker Borowski — Fri, 01 Mar 2002 09:53:05 GMT

You might consider to use the OPS$ connect from Oracle.

Do not know if this helps
Volker

Re: securing plain text passwords

Steven Sim Kok Leong — Fri, 01 Mar 2002 10:01:11 GMT

Hi,

If sudo doesn't suit your needs, then use restricted sam.

Give the script only -r-x------ (chmod 0500) permissions for the owner called eg. sqlmod.

Subsequently, add this script to sam and configure restricted sam for this script:

$ sam -r

A user sqluser1 can thus execute the script from sam without the ability to read the script owned by sqlmod.

$ /usr/sbin/sam

Another alternative is to wrap your script in a C program, but this is not foolproof.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: securing plain text passwords

Tom Elder — Wed, 06 Mar 2002 21:42:35 GMT

thanks for the help; you have given me several ways to try to implement my task.