Sponsored Content
Top Forums Shell Programming and Scripting How to store the passwords securely and use in scripts? Post 303034046 by Neo on Wednesday 17th of April 2019 03:29:03 AM
Old 04-17-2019
Quote:
Originally Posted by karumudi7
I want to store the passwords in a global file, so that all the users will not use them to login but a process should use it. One way is to keep the passwords in a .ini file and execute the file in the start of the script and use that variable.

But with this, one can echo the variable in the script and see the value.

How are you guys storing, let's say production database password, and use that in the script while writing the database connect statements.
You should do a risk analysis and determine the threats, risk and vulnerabilities and decide the best controls to use based on your risk profile.

If I read your post correctly, you are working on a linux box (which one?) or unix box (which one?) in a commercial application with multiple users with access on that server.

So, you need to look at the permissions, and so I assume the DB is not running as root (that is very unusual), so it is running as a user with certain privs.

You need to example DB privileges relative to the users on the system and come up with a strategy to mitigate risk.

Normally, users cannot read others users files if the permissions are set so others cannot read or access.

So, if your DB process can read the file with the clear text password, but others users cannot, then that is obviously one first step.

If you describe your system environment in more details and your view of the risks (in the case of compromise), then I can assist further.

There is a difference based on the risk, as I have mentioned, and you need a variety of controls (physical, logical [meaning technical] and administrative [meaning rules in this context]) when viewing IT security controls.
 

8 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

How to pass passwords to bash scripts?

I'm finding the following command very tedious to type in all the time, so I created a one line bash script called mount.bash with the following contents: mount -t cifs //mark/C\$ -o unc=//mark\\C$,ip=10.1.1.33,user=Administrator,password=$1 /mnt/mark I don't like the fact that I have to put... (5 Replies)
Discussion started by: siegfried
5 Replies

2. Shell Programming and Scripting

Checking passwords - scripts

Hi Unix experts.... I am in the process checking user and root password of more than 1000 servers manulay. I am very pissed of checking these many servers manualy. Could some one of you help me how can i check the passwords just by runing some scripts..! Need Help Guys..! :confused: (5 Replies)
Discussion started by: bullz26
5 Replies

3. Solaris

installing solaris securely

Ok, I am trying to install solaris, but I would like as a lean installation as possible (while still having a shread of functionality). If I chose the minimal install I have little if no utilities to do work on the box. My question is what installation method do most admins take? ... (7 Replies)
Discussion started by: liven
7 Replies

4. Shell Programming and Scripting

Oracle Passwords in Unix scripts

Hi Most of the shell scripts I am dealing with have to connect to oracle database . The username password is stored in a environment file which sets the variables for username and password . Set user id do not work on AIX so users who will execute these scripts need to have read or execute... (5 Replies)
Discussion started by: clifford
5 Replies

5. Shell Programming and Scripting

SSH - Passing Unix login passwords through shell scripts

Hi All , I need to call a script runscript_B.sh on server A, the runscript_B.sh script locating in server B. The runscript_B.sh in calls another script runscript_A on server A itself. it seend, i need to be connect from Server A to Server B using ssh. I have tryed like this in... (3 Replies)
Discussion started by: koti_rama
3 Replies

6. UNIX for Advanced & Expert Users

When did UNIX start using encrypted passwords, and not displaying passwords when you type them in?

I've been using various versions of UNIX and Linux since 1993, and I've never run across one that showed your password as you type it in when you log in, or one that stored passwords in plain text rather than encrypted. I'm writing a script for work for a security audit, and two of the... (5 Replies)
Discussion started by: Anne Neville
5 Replies

7. AIX

When did AIX start using /etc/security/passwd instead of /etc/passwd to store encrypted passwords?

Does anyone know when AIX started using /etc/security/passwd instead of /etc/passwd to store encrypted passwords? (1 Reply)
Discussion started by: Anne Neville
1 Replies

8. UNIX for Advanced & Expert Users

Store passwords , accounts, IPs, hostnames

Hi, this question is not specially unix related, but I expect advanced and expert unix users to have a solution for this, and I've found no other subforum that fits ;) what do you use to store accounts, customer ids, ip addresses, users and specially passwords, to access them from... (6 Replies)
Discussion started by: funksen
6 Replies
svnserve.conf(5)						File Formats Manual						  svnserve.conf(5)

NAME
svnserve.conf - Repository configuration file for svnserve SYNOPSIS
repository-path/conf/svnserve.conf DESCRIPTION
svnserve.conf controls the behavior of the svnserve daemon on a per-repository basis. It is located in the conf subdirectory of the repos- itory. The overall structure of the file is the same as the structure of Subversion user configuration files. At the top level are sections, which are specified by words in square brackets; inside each section are variable definitions of the form "variable = value". Lines begin- ning with '#' are ignored. svnserve.conf currently uses only one section named "general", and supports the following variables: anon-access = none|read|write Determines the access level for unauthenticated users. write access allows all repository operations. read access allows all opera- tions except committing and changing revision properties. none access allows no access. The default level is read. auth-access = none|read|write Determines the access level for authenticated users, using the same access levels as above. The default level is write. password-db = filename Sets the location of the password database. filename may be relative to the repository conf directory. There is no default value. The password database has the same overall format as this file. It uses only one section "users"; each variable within the section is a username, and each value is a password. authz-db = filename The authz-db option controls the location of the authorization rules for path-based access control. filename may be relative to the repository conf directory. There is no default value. If you don't specify an authz-db, no path-based access control is done. realm = realm-name Sets the authentication realm of the repository. If two repositories have the same password database, they should have the same realm, and vice versa; this association allows clients to use a single cached password for several repositories. The default realm value is the repository's uuid. EXAMPLE
The following example svnserve.conf allows read access for authenticated users, no access for anonymous users, points to a passwd database in the same directory, and defines a realm name. [general] anon-access = none auth-access = read password-db = passwd realm = My First Repository The file "passwd" would look like: [users] joeuser = joepassword jayrandom = randomjay SEE ALSO
svnserve(8) svnserve.conf(5)
All times are GMT -4. The time now is 11:08 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy