Want to encrypt some password data.

[Steven E. Protter]

Due to Oracle 9.0.2 removing the connect internal option, I have about thirty broken scripts which do things such as backups, object compiles and such.

The change on the scripts is easy, just hard code a user id and password into the script.

This is in my opinion a maintenance nightmare and a security hazard, even if permissions are tight on the scripts. Its important that the oracle binary owners password not be just sitting around.

I came up with a scheme to store these passwords in a file in /etc/ that is locked down nice and tight. The permissions would be read only owned by oracle. No other groups or users would get access.

Thats okay, but if for some reason someone gets the file, they've got the oracle password.

I have never had to write a script to encrypt data. Its just never come up, here or on any of my consulting gigs. We have a couple of older scripts that do this, but they became non-functional as part of the 11i upgrade. I'm not sure why.

So, I'm looking for a simple way to encrypt the data in my little password file so that if sonmeone gains access to the file they get garbage.

So, I'm turning to itrc for some a script stub that does the job and improves security a bit.

I'm also open to opinions as to better ideas on how to handle this.

Our system has strong random number encryption/generation and a good variety of security programs.

Note: I will get to my congrats thread, I just want to compose a thoughtful message and thank everyone for their greetings.

Thanks.

As always, points for all participants, bunnies for workable answers. I will try and test these ideas today.

SEP

[John Meissner]

I have a couple of ideas to shoot by you SEP...
One is a utility I've never used (sorry) called crypt. (man crypt for details)

Another way you could do it is to use shc -the generic script compiler. I use shc to prevent people from getting into my scripts and either changing them or seeing what I did. It can be downloaded from here http://www.datsi.fi.upm.es/~frosal/frosal.html

let me know what you decide.. i'm interested in this topic

[Robert-Jan Goossens]

Hi,

Crypt would be very simple or somathing like

http://www.ricksoft.co.uk/downloads/rccrypt/rccrypt.htm

Regards,
Ribert-Jan

[Peter Nikitka]

Hi Steve,

in Linux-envs you can find a utility 'htpasswd' , which handles 'private' passwd-like files. We use that for CVS- and Apache-stuff.
A HP-UX port shouldn't be too difficult.

mfG Peter

[Graham Cameron_1]

Why don't you use
CONNECT / AS SYSDBA
where you used to use
CONNECT INTERNAL
?

-- Graham

[John Palmer]

Hi SEP,

Just change connect internal in your scripts to connect '/ as sysdba' (note the apostrophes). This works for 8i also.

If you want to go the other way then crypt is what you want but you'll have to keep the encryption key secret somehow.

Regards,
John

[Steven E. Protter]

What I was looking for was a little script stub, which might be on one of the links.

I will go to the test environment and check try out the last two suggestions.

SEP

[Massimo Bianchi · Accepted solution]

i would use ssh + connect '/ as sysdba' as the oracle owner of the database.


This way:
- secure connection possible
- no plain text password EVER tramsmitted
- changes to script are trivial
- full sysdba access
- even a "ps -ef " trick will only show "/", with no hint on the password itself

Massimo

[Steven E. Protter]

I have tested the sqlplus '/ as sysdba' on the command line.

I am asking my dba if this is acceptable to him.

SEP

[John Palmer]

Apologies, my original post should have said
sqlplus '/ as sysdba' replacing sqlplus internal rather than connect...

with the apostrophes being relevant.

Can't see any reason for your dba to object, the first is the 9i equivalent of the second.

Regards,
John

[Steven E. Protter]

Thanks John.

I've tested it in a script and think he will approve. I'm slightly surprised he did not suggest it.

The ecnryption thing will also work because our forms compile scripts need to use this scheme.

Still investigating, will get to point assignment today.

The dba is off, taking care of his baby daughter today so I'm not going to bother him.

SEP

[Ron Brown_2]

Try the attached script as a starting point.

[Graham Cameron_1]

SEP - Just to clarify the need for apostrophes:
When starting from the command line they are needed, ie
sqlplus '/ as sysdba'.
When calling from within sqlplus, they are not, ie
connect / as sysdba

The confusion is perhaps confounded by the fact that the svrmgrl tool (used at oracle 7 and 8) has been removed, and its functionality rolled up into sqlplus.

So in oracle 7/8 you would typically:
--

# svrmgrl
SVRMGR> connect internal

-- in 9i you would either

# sqlplus '/ as sysdba/'

-- or, as at this site

# sqlplus /nolog
SQL> connect / as sysdba

--

Hope that helps

-- Graham