Visit The New, Modern Unix Linux Community


How to store the passwords securely and use in scripts?


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting How to store the passwords securely and use in scripts?
# 1  
How to store the passwords securely and use in scripts?

I want to store the passwords in a global file, so that all the users will not use them to login but a process should use it. One way is to keep the passwords in a .ini file and execute the file in the start of the script and use that variable.

But with this, one can echo the variable in the script and see the value.

How are you guys storing, let's say production database password, and use that in the script while writing the database connect statements.
# 2  
Quote:
Originally Posted by karumudi7
I want to store the passwords in a global file, so that all the users will not use them to login but a process should use it. One way is to keep the passwords in a .ini file and execute the file in the start of the script and use that variable.
But with this, one can echo the variable in the script and see the value.
How are you guys storing, let's say production database password, and use that in the script while writing the database connect statements.
Hello karumudi7,

It is NEVER EVER recommended to store passwords either in plain text or in encrypted format. Why don't you try to use some certificate kind of thing(not sure in your app case), perfect example if password-less SSH which requires public key copied at target server and while making ssh it makes sure that user is NOT being asked for password etc.

Again DO NOT save passwords in any form, it is NEVER recommended at all.

Note: after Neo' comment adding this, you could not avoid writing passwords always but still use them safely.

Thanks,
R. Singh

Moderator's Comments:
Mod Comment Neo: Please do not delete "mistakes and wrong" answers that others have replied do. Everyone makes mistaken. Accept it and "move on".

Last edited by RavinderSingh13; 04-17-2019 at 12:19 AM..
This User Gave Thanks to RavinderSingh13 For This Post:
# 3  
Yes, I understand and I use SSH keys for password-less connections.
But it is more like when you are interacting with other services like database etc.
This User Gave Thanks to karumudi7 For This Post:
# 4  
Ravinder,

Many systems on the network require passwords to be stored in a flat file.

It's not always avoidable, so you can't say "NEVER NEVER DO THIS"... spoken much like someone who has not built a production application which uses clear text passwords.

Theory is not always the same in practice.

Normally, these kind of DB passwords are stored in plaintext in files which are hidden from users, so we must look at who has access to the system, the risk, the criticality of the application and other risk management factors.

Quote:
Originally Posted by karumudi7
Yes, I understand and I use SSH keys for password-less connections.
But it is more like when you are interacting with other services like database etc.
This is correct. Many CMS programs like WordPress store the DB passwords in clear text in a flat configuration file.
These 2 Users Gave Thanks to Neo For This Post:
# 5  
Quote:
Originally Posted by Neo
Ravinder,

Many systems on the network require passwords to be stored in a flat file.

It's not always avoidable, so you can't say "NEVER NEVER DO THIS"... spoken much like someone who has not built a production application which uses clear text passwords.

Theory is not always the same in practice.
Normally, these kind of DB passwords are stored in plaintext in files which are hidden from users, so we must look at who has access to the system, the risk, the criticality of the application and other risk management factors.
This is correct. Many CMS programs like WordPress store the DB passwords in clear text in a flat configuration file.
Thank you Neo for correcting me, I have deleted my answer now, considering it was not adding any value add to post.

Thanks,
R. Singh
# 6  
Ravinder,

Please do not delete "wrong answers or mistakes" which people have replied to.

Everyone makes mistakes.

However, deleting posts which two people have replied is not really correct and is a "bigger mistake", in my view.

Just accept that you learned something and moved on; but I do recommend caution when you have strong opinions based on theory that do not match practical 'the way things are'... we all make mistakes. That's what makes life fun and interesting,

Plus, others can learn for your mistake, so please see it as a way to help others learn, thanks!
This User Gave Thanks to Neo For This Post:
# 7  
The approach to manage risk in IT should be based on a risk analysis.

For example, a person running their own blog who has not much to lose if their DB password is compromised has a much different risk profile than a bank doing financial transactions.

Security controls come with "costs" and so the controls used should be appropriate to the risk profile of the system.

All WordPress blocks, Wikipedia Wikis and indeed most all CMS apps freely available on the network store DB password as clear text in config files which with various standard unix / linux file system permissions and controls.
These 2 Users Gave Thanks to Neo For This Post:

Previous Thread | Next Thread
Thread Tools Search this Thread
Search this Thread:
Advanced Search

Test Your Knowledge in Computers #928
Difficulty: Medium
64-bit versions of the Unix time stamp will cease to work at 15:30:08 UTC on Sunday, 14 December 2922770265960.
True or False?

8 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Store passwords , accounts, IPs, hostnames

Hi, this question is not specially unix related, but I expect advanced and expert unix users to have a solution for this, and I've found no other subforum that fits ;) what do you use to store accounts, customer ids, ip addresses, users and specially passwords, to access them from... (6 Replies)
Discussion started by: funksen
6 Replies

2. AIX

When did AIX start using /etc/security/passwd instead of /etc/passwd to store encrypted passwords?

Does anyone know when AIX started using /etc/security/passwd instead of /etc/passwd to store encrypted passwords? (1 Reply)
Discussion started by: Anne Neville
1 Replies

3. UNIX for Advanced & Expert Users

When did UNIX start using encrypted passwords, and not displaying passwords when you type them in?

I've been using various versions of UNIX and Linux since 1993, and I've never run across one that showed your password as you type it in when you log in, or one that stored passwords in plain text rather than encrypted. I'm writing a script for work for a security audit, and two of the... (5 Replies)
Discussion started by: Anne Neville
5 Replies

4. Shell Programming and Scripting

SSH - Passing Unix login passwords through shell scripts

Hi All , I need to call a script runscript_B.sh on server A, the runscript_B.sh script locating in server B. The runscript_B.sh in calls another script runscript_A on server A itself. it seend, i need to be connect from Server A to Server B using ssh. I have tryed like this in... (3 Replies)
Discussion started by: koti_rama
3 Replies

5. Shell Programming and Scripting

Oracle Passwords in Unix scripts

Hi Most of the shell scripts I am dealing with have to connect to oracle database . The username password is stored in a environment file which sets the variables for username and password . Set user id do not work on AIX so users who will execute these scripts need to have read or execute... (5 Replies)
Discussion started by: clifford
5 Replies

6. Solaris

installing solaris securely

Ok, I am trying to install solaris, but I would like as a lean installation as possible (while still having a shread of functionality). If I chose the minimal install I have little if no utilities to do work on the box. My question is what installation method do most admins take? ... (7 Replies)
Discussion started by: liven
7 Replies

7. Shell Programming and Scripting

Checking passwords - scripts

Hi Unix experts.... I am in the process checking user and root password of more than 1000 servers manulay. I am very pissed of checking these many servers manualy. Could some one of you help me how can i check the passwords just by runing some scripts..! Need Help Guys..! :confused: (5 Replies)
Discussion started by: bullz26
5 Replies

8. Shell Programming and Scripting

How to pass passwords to bash scripts?

I'm finding the following command very tedious to type in all the time, so I created a one line bash script called mount.bash with the following contents: mount -t cifs //mark/C\$ -o unc=//mark\\C$,ip=10.1.1.33,user=Administrator,password=$1 /mnt/mark I don't like the fact that I have to put... (5 Replies)
Discussion started by: siegfried
5 Replies

Featured Tech Videos