Shell Programming and Scripting

Hello All,
I am using the red hat Linux OS and bash shell scripting. Below is my requirement.could you please tell me how can i acheive this? wanted to know industry best standards. I hardly remember at one of my previous companies we were using some kdb file to store the passwords but never get a chance to dwelve further to understand it. please help

Thank you.

Short and sweet explanation:

Moderator's Comments:

Encryption does not work that way.

Longer version: Any decryption script you build will run just as happily on a thief's machine as it will on yours. If they have the file and the script, they have the data, the cipher, and the key all bundled together in the most convenient form possible for them.

The "standard" way to secure plain passwords is creating an account to hold them and chmoding them 0400. Nobody but that user (and root) can access them. Then you set up sudo to allow people to use that user, but only in very exact and careful ways. Be very careful to avoid putting the password in variables and especially never put it in a commandline. You only want a password to be passed through a stream (or read direct from file).

If "safe from everyone but root" isn't good enough, you are in deep trouble: You cannot protect anything from root, period, no exceptions.

I have a .passwd file where i am encrypting the passwords and when the application account runs the shell script i am exporting the variables as shown below.

.passwd file

Code:

DBBATCHUSER|Redacted
DBBATCHPASS|Redacted

.dwrc file to export the passwords

Code:

export DBBATCHUSER=`cat "${BIN_DIR}"/.passwd | grep "DBBATCHUSER" | awk -F "|" '{print $2}' | openssl enc -base64 -d`
export DBBATCHPASS=`cat "${BIN_DIR}"/.passwd | grep "DBBATCHPASS" | awk -F "|" '{print $2}' | openssl enc -base64 -d`

shell scripts executes oracle packages etc with passwords exported sourcing .dwrc file

Code:

#!/bin/bash
. /usr/local/dw/.dwrc

1) Does open ssl base means i am doing encoding only not encrypting?
2) If it is encoding, would you suggest better encrypting utility to encrypt the passwords? i am debating to use "openssl enc -aes-128-cbc -a -salt -pass pass:wtf"
3) I have more than 10 oracle packages or 10 different steps where i have to log to the database to execute the packages as part of shell script, with out exporting them as variables do i have to read the .passwd file 10 times to execute my packages? even then SUDOing to the functional account would still allow to read the passwords in .passwd file?

Thank you.

All your encoding / decoding code is pointless because:

Moderator's Comments:

Encryption does not work that way.

Forgive me for being a bit emphatic, but we get these threads very often.

I can decrypt them from here whether it was base64, aes256, or some weird cipher of your own design, because I saw your code. You are not protecting the passwords this way since the script remains vulnerable. In short:

Moderator's Comments:

Encryption does not work that way.

There is no "better" here, because protecting the file and not protecting the script is like a screen door in a submarine. Pointless. In short:

Moderator's Comments:

Encryption does not work that way.

Yes. Compared to the work it takes to run 10 Oracle packages, that's miniscule...

You can configure sudo to not do that.

Code:

%someusergroup ALL=NOPASSWD: (passworduser) /path/to/mydbscript.sh

This would allow users in 'somegroup' to run /path/to/mydbscript.sh as 'passworduser'. If they tried to do anything else with 'passworduser' it wouldn't let them.

Maybe I am way off base here, but it's this why there are programs like KeePass?

At the end of the day, for a system to have any chance of being secure, someone needs to manually enter a password that only they know. Even better if you decryption involves key files that are on a portable device and not stored in the file system. At least with KeePass, you only enter one password to unlock the others you have stored. I don't remember if it is script compatible or not, but there are many linux versions.

LMHmedchem

If your problem is about securing the password for a particular Oracle DB account, could you set up the OS account as (for instance) myapp1 and in the database, the account with:-

Code:

create user OPS$myapp1 IDENTIFIED EXTERNALLY default tablespace ........

If you can, then the shell script running as myapp1 just needs to execute sqlplus / and the DB connection should open without a password. Then you just need to restrict access to the OS account (using sudo rules) and the passwords disappear.

Does that remove the need to worry about storing and encrypting passwords altogether?

CREATE USER


Robin

When I write Oracle scripts to run as the Oracle Linux owner I just use OS authentication as in, sqplus '/as sysdba'. You should turn off remote OS authentication and you can create database accounts other than sys to use OS authentication.

Here is the doc for authentication with Oracle.

Authentication Methods