Hello All,
I am using the red hat Linux OS and bash shell scripting. Below is my requirement.
I need to store encrypted the passwords of database accounts, ftp acccounts into a file1.
Encrypt that file1 or make it secure with password to open & read it.
Later in shell scripts
I need to decrypt the file1
Read the password for a particular account and close it.
Use that password value further in the scripts.
could you please tell me how can i acheive this? wanted to know industry best standards. I hardly remember at one of my previous companies we were using some kdb file to store the passwords but never get a chance to dwelve further to understand it. please help
Longer version: Any decryption script you build will run just as happily on a thief's machine as it will on yours. If they have the file and the script, they have the data, the cipher, and the key all bundled together in the most convenient form possible for them.
The "standard" way to secure plain passwords is creating an account to hold them and chmoding them 0400. Nobody but that user (and root) can access them. Then you set up sudo to allow people to use that user, but only in very exact and careful ways. Be very careful to avoid putting the password in variables and especially never put it in a commandline. You only want a password to be passed through a stream (or read direct from file).
If "safe from everyone but root" isn't good enough, you are in deep trouble: You cannot protect anything from root, period, no exceptions.
Last edited by Corona688; 09-10-2014 at 06:13 PM..
Longer version: Any decryption script you build will run just as happily on a thief's machine as it will on yours. If they have the file and the script, they have the data, the cipher, and the key all bundled together in the most convenient form possible for them.
The "standard" way to secure plain passwords is creating an account to hold them and chmoding them 0400. Nobody but that user (and root) can access them. Then you set up sudo to allow people to use that user, but only in very exact and careful ways. Be very careful to avoid putting the password in variables and especially never put it in a commandline. You only want a password to be passed through a stream (or read direct from file).
If "safe from everyone but root" isn't good enough, you are in deep trouble: You cannot protect anything from root, period, no exceptions.
I have a .passwd file where i am encrypting the passwords and when the application account runs the shell script i am exporting the variables as shown below.
.passwd file
.dwrc file to export the passwords
shell scripts executes oracle packages etc with passwords exported sourcing .dwrc file
1) Does open ssl base means i am doing encoding only not encrypting?
2) If it is encoding, would you suggest better encrypting utility to encrypt the passwords? i am debating to use "openssl enc -aes-128-cbc -a -salt -pass pass:wtf"
3)
Quote:
You only want a password to be passed through a stream (or read direct from file).
I have more than 10 oracle packages or 10 different steps where i have to log to the database to execute the packages as part of shell script, with out exporting them as variables do i have to read the .passwd file 10 times to execute my packages? even then SUDOing to the functional account would still allow to read the passwords in .passwd file?
Thank you.
Last edited by Corona688; 09-11-2014 at 07:21 PM..
I have a .passwd file where i am encrypting the passwords and when the application account runs the shell script i am exporting the variables as shown below.
.passwd file
.dwrc file to export the passwords
shell scripts executes oracle packages etc with passwords exported sourcing .dwrc file
All your encoding / decoding code is pointless because:
Moderator's Comments:
Encryption does not work that way.
Forgive me for being a bit emphatic, but we get these threads very often.
Quote:
1) Does open ssl base means i am doing encoding only not encrypting
I can decrypt them from here whether it was base64, aes256, or some weird cipher of your own design, because I saw your code. You are not protecting the passwords this way since the script remains vulnerable. In short:
Moderator's Comments:
Encryption does not work that way.
Quote:
2) would you suggest better encrypting utility to encrypt the passwords?
There is no "better" here, because protecting the file and not protecting the script is like a screen door in a submarine. Pointless. In short:
Moderator's Comments:
Encryption does not work that way.
Quote:
3) I have more than 10 oracle packages or 10 different steps where i have to log to the database to execute the packages as part of shell script, with out exporting them as variables do i have to read the .passwd file 10 times to execute my packages?
Yes. Compared to the work it takes to run 10 Oracle packages, that's miniscule...
Quote:
even then SUDOing to the functional account would still allow to read the passwords in .passwd file?
You can configure sudo to not do that.
This would allow users in 'somegroup' to run /path/to/mydbscript.sh as 'passworduser'. If they tried to do anything else with 'passworduser' it wouldn't let them.
Last edited by Corona688; 09-11-2014 at 07:43 PM..
These 2 Users Gave Thanks to Corona688 For This Post:
Maybe I am way off base here, but it's this why there are programs like KeePass?
At the end of the day, for a system to have any chance of being secure, someone needs to manually enter a password that only they know. Even better if you decryption involves key files that are on a portable device and not stored in the file system. At least with KeePass, you only enter one password to unlock the others you have stored. I don't remember if it is script compatible or not, but there are many linux versions.
If your problem is about securing the password for a particular Oracle DB account, could you set up the OS account as (for instance) myapp1 and in the database, the account with:-
If you can, then the shell script running as myapp1 just needs to execute sqlplus / and the DB connection should open without a password. Then you just need to restrict access to the OS account (using sudo rules) and the passwords disappear.
Does that remove the need to worry about storing and encrypting passwords altogether?
When I write Oracle scripts to run as the Oracle Linux owner I just use OS authentication as in, sqplus '/as sysdba'. You should turn off remote OS authentication and you can create database accounts other than sys to use OS authentication.
Hello every one, I will love to know what is the best approach to take in obtaining books online.
I find it disturbing just googling a book online and downloading it without actually paying for it. I strongly believe that this is wrong and that i may not be able to unlock the key contents and... (2 Replies)
Hi-
I need to develop a script for following scenario in AIX and K shell environment.I am from windows server background for most my career ,so please bear with me and advise suitable approach and technical assistance.Having said that I am aware of unix shell commands but never pput together at... (1 Reply)
I have a table in one of my DB. The DB is about 300 gig - of that 249 gig is in this table. The data is somewhat important but even if we delete half of it won't affect anybody.
I would like to reclaim some space back so my question is what would be the best approach to accomplish this task.... (6 Replies)
HI All ,
I am new to oracle procedures. Please help me for the approach to satify the requirement.
I need to create procedures. with parameters passed ( say report,type,identities,country )
It should also call sql query within the procedures and passed parameters should be used in where clause... (2 Replies)
All,
I currently have a requirement to fetch a Date value from a table. And then insert a Header record into a file along with that date value.
ex:
echo "HDR"" "`date +%Y%j` `date +%Y%m%d`
In the above example I used julian date and standard date using Current Date. But the requirement... (0 Replies)
I've been using various versions of UNIX and Linux since 1993, and I've never run across one that showed your password as you type it in when you log in, or one that stored passwords in plain text rather than encrypted. I'm writing a script for work for a security audit, and two of the... (5 Replies)
Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted!
1. The problem statement, all variables and given/known data:
This function is given the day, month and year and returns the Julian date. The Julian date is the... (1 Reply)
Hello all,
I've just joined. I did a google search and your site came up,
I had a look and thought I'd like to become a member.
I'm from Ireland.
I've written a few scripts before, but this new task has me foxed.
I would like to figure out the best approach to achieving the following
... (15 Replies)