securing plain text passwords

[Tom Elder]

is there a way to secure plain text passwords in a script that you need to pass a password to an application like a database ?

[Alan Riggs]

Not that I know of. If you really must hardcode an id/password in a script (as for sqlplus connections) make sure that the script itself can be read only by users who already have access to that id. If regular file permissions do not allow the granularity you need, use ACLs.

[Tom Elder]

I will look up ACL's in my man pages but I was not aware of their use outside of routers and such. Can you point me in a direction for my research?

thanks
tom

[Eric Ladner]

Also, be aware that if you log into a database like so:

sqlplus scott/tiger

Everybody and their brother on the machine can do a ps -ef and see your password in the process list.

This works:

USERID=scott/tiger
sqlplus <$USERID
select sysdate from dual;
EOF

Your password won't show up on the command line that way. Of course, different applications may have different issues.

[K.Vijayaragavan. · Accepted solution]

Have you seen,

#man setkey
#man makekey
#man crypt
#man encrypt

-K.Vijay

[Volker Borowski]

You might consider to use the OPS$ connect from Oracle.

Do not know if this helps
Volker

[Steven Sim Kok Leong]

Hi,

If sudo doesn't suit your needs, then use restricted sam.

Give the script only -r-x------ (chmod 0500) permissions for the owner called eg. sqlmod.

Subsequently, add this script to sam and configure restricted sam for this script:

$ sam -r

A user sqluser1 can thus execute the script from sam without the ability to read the script owned by sqlmod.

$ /usr/sbin/sam

Another alternative is to wrap your script in a C program, but this is not foolproof.

Hope this helps. Regards.

Steven Sim Kok Leong

[Tom Elder]

thanks for the help; you have given me several ways to try to implement my task.