Shell Programming and Scripting

My DB days are gone for quite long time, and my sql has corroded away, but as far as I recall, sqlldr is an independent command of its own and thus should not occur in the input stream of sqlplus, i.e. it should disappear from the "here document"?

Not entirely silly, it's halfway to a real solution, but only halfway. The password file can be placed at a remove via ownerships and file permissions. Then you can use sudo to run the script, so that only the script and nothing else can read the password file.

Hi Don, what do you mean by the follows ?
Do you mean to name the credential file with loginName and password as "xxxx.secret" ?
If so, I tried to name it as "login.secret", but it can still show up with "ls" command.

" To make it slightly less obvious to people looking for passwords, I would suggest that the last component of the absolute path named by DATAFILE should have a period as the first character (such as .secret) so it won't show up in an ls command unless the -a option is included. "

That is not what I said. Look more closely at the red text in your quote from my earlier message above.
The first character of xxx.secret and login.secret is not a period so they will not be hidden when listed by ls. If you name the file .secret (with a period as the first character as I suggested), it will not show up in ls output unless you include the -a option on the ls command.

You can echo the username and password and pipe it into either sqlplus or sqlldr.

Code:

echo "${USERNAME}/${PASSWORD}@${TNS_ALIAS}" | sqlplus ...
echo "${USERNAME}/${PASSWORD}@${TNS_ALIAS}" | sqlldr ...

You can also create a password file under your $HOME/.ssh directory and have a separate script read that file and store the passwords as local environment variables. Meaning to add the word export. If someone can log on as the Oracle user on a Linux/Unix system they can authenticate using the us user.

Code:

sqlplus '/as sysdba'

Thus you already need to keep the $HOME/.ssh locked down, so that is the best place to keep passwords.

Hiding it is pointless.

If you want to secure it so people won't get at it, secure it so people can't get at it. UNIX has file permissions for a reason.