Ways to encrypt passwd in shell script

[Ivan Ferreira]

I wonder if you run "strings" over the shm file, will be able to see the username and password.

[Frank de Vries]

Interesting extra intelligence, could
be handy to know.
I presume shm files are the extended tables ?

I value your input.

Knowledge = power = $$$$$

[Arturo Galbiati]

Hi Frank,
I had in the past your same problem.
To fix this I put all the datbase passwords in a file crypted *I handle it using vi -x).
To get the password in the script I develloped a script that giving in input the user retrun the password in clear.
Let me know if you are intersted in this and I can post it.
(I like avoind post unrequested script).
HTH,
Art

[Frank de Vries]

Arturo
Yes that could solve a lot of time and admin
for me , thanks !!

[Arturo Galbiati]

Hi,
these are the files I use.
1].
Create a directory ACCESS under unix user i.e.: pwdadm
/home/pwdadm/ACCESS

1].create the crypted file .access:

vi -x your_key access.dat
# Record format: unix_user;key;value
# The separator MUST be ';', space is a valid character
pwdadm;logon;password
#eof

logon is the database user and passowrd is teh user password

3]. created the parameter file .access
#!/usr/bin/ksh
export AccKey=your_key
export AccUsr=$(whoami)
#eof

4. create the script access.ksh:
#!/usr/bin/ksh
typeset -l ScrStr="${AccUsr};${1}"
#
AccFil=/home/pwdadm/ACCESS/access.dat
AccKey=${AccKey:-dummy}
AccVal=$(crypt $AccKey<$AccFil|awk -F"${ScrStr};" '/'$ScrStr'/ {print $2}')
if [[ -z "$AccVal" ]] ;then
echo "********"
exit 1
else
echo "$AccVal"
fi
#eof

the files should be these permissions:
-rwxr-xr-x .access
-rw-r--r-- access.dat
-rwxr-xr-x access.ksh

and the directories msut be readabel by all
(if you want to use this way in each Unix user, otherwise decide different permission)
Take care to add the path in your $PATH so any users can use it.

in your script you have to use:
. access
Oracle_password=$(access.ksh oracle_user)

the script access.ksh retuns the password for the oracle_user if aclled for the unix user pwdadm. You can have same user/password for different unix users.

HTH,
Art