Connect to remote database from HPUX without cleartext

[Paul Maglinger]

Can anyone provide suggestions for connecting HPUX to a remote Oracle database without the username and password being passed along as cleartext? On our Tru64 system we were able to get around it by using sqlplus /, but this method is not working on the HPUX system. And we do not want to use Oracle single signon. Anyone?

[Ben Dehner]

OracleNET protocol is clear-text. If you want an encrypted client communication channel you need to have the Oracle Advanced Security option. There are no other options that I know of for using password hash or other password-hiding mechanism.

[larsoncu]

you could use something like ipsec to encrypt all the communications between the systems (you'd need ipsec on both systems)

how about with vpn software?

could use ssh port forwarding

[Sandman!]

First set the TWO_TASK environment variable to the Oracle instance you want to connect to and then try the /NOLOG login method viz.

# export TWO_TASK=""
# sqlplus /nolog

[Paul Maglinger]

I appreciate the replies. Yeah, we batted around those suggestions. We were just fishing around for other ideas.

[TwoProc]

Paul, I don't believe it's that bad. Turn on a sniffer and watch - you won't see the password as clear text. Oracle doesn't do that. I've tried it myself way back when. You'll see everything else though, and for that reason you should purchase and install the encrypter tool regardless.

I've heard from others (can't remember where, maybe here) that what I'm saying is correct.

So just fire up a sniffer and watch the traffic from your computer to the destination; unless anything new has happened from several revs back which makes me mistaken, or I just missed it totally back when I checked for the same issue - I don't think you're going see a password in clear text. But seriously, don't rely just on my word, check for yourself and make sure.

[Paul Maglinger]

We don't need a sniffer. If we do a ps -ef command, we can see the password being passed along as part of the process. This is what we're trying to prevent.

[TwoProc]

I see what you're asking. It has nothing to do with cleartext being read over sqlnet, you just don't want to see the password from the ps command. It was unclear because you mentioned "remote connections" and "cleartext" which is all nomenclature/verbage one would use to discuss whether a network conversation is encrypted or not.

Actually your question has nothing to do with a connection being remote or not, it's just that you're using sqlplus and passing the username/password on the command line. Local database, remote database, the problem is the same. To either or a local or remote database, the Unix box originating the sqlplus command can see the username/password from "ps" if you pass it on the command line.

The solution is actually quite simple. You just need to the "/nolog" switch from sqlplus and then issue the connect command from inside of sqlplus.

$ sqlplus /nolog
then from inside sqlplus...
> connect username/password
or
> connect username/password@urdbname

If you need it in a script:

sqlplus /nolog << SCRIPTEOF
connect username/password@urdb
select * from ....;
do your commands...;
exit;
SCRIPTEOF

Where is a tab character stored in the script. Just make sure that you keep permissions on the script where no one else can read it.

[Sandman! · Accepted solution]

Paul,

My earlier post talked about supplying the /nolog token on the SQL*Plus cmd line and thereafter connecting to the desired user by supplying the password. Infact the procedure can be scripted using the shell's "here document" utility i.e.

sqlplus /nolog <connect scott/tiger@Oracle_SID
select * from dual;
exit
EOF

[Paul Maglinger]

Sandman,

That's what we ended up doing. We were hoping for other alternatives, but based on current environment we'll go that route.

Thanks everyone!