UNIX for Dummies Questions & Answers

If it's any consolation, trying to obscure a shell script goes against the UNIX philosophy of sharing solutions and avoiding reinventing the wheel.

Obscuring code doesn't even solve any security problems, for instance OpenSSH is totally open but still secure.

Somebody can easily reverse engineer your program by running it under a debugger or using a system trace tool.

The particular issue is that you want to do something different to what the tool was originally intended for.
If you pause for a moment and think about it, all of the procedural programming languages are functionally equivalent, and only differ in syntax. So something you can do in shell, you can do in perl, you can do in C.
You've just got to broaden your horizons a bit.
If you do choose to get a shell script compiler, then you are opening yourself (and your employers) up to a maintenance headache.
So, sometimes the answers to questions are not exactly what you wish to hear.
Life is like that...

Porter,
I am not the orginal guy who created this thread in first place. His intention was not to look into code by some colleages but in our case, it is not the intention.
We use some Oracle monitoring scripts which logs on to oracle database with username/password
We don't want to let everybody see username/password and also don't want to hardcode password in shell script also even though users might have read permissions for script and hence we have used shc.

We don't put locks in our home to challenge that an experieced thief can't break the lock, it is just for normal folks who sometimes could change their mind .

Any way, thanks for your input.

-------------------------------------------------------
There was some other issues which we have even though make shc was okay.

$ ./shc -r -l "" -f pru.sh
pru.sh.x.c:246:24: sys/ptrace.h: No such file or directory
pru.sh.x.c: In function `untraceable':
pru.sh.x.c:274: error: `PTRACE_ATTACH' undeclared (first use in this function)
pru.sh.x.c:274: error: (Each undeclared identifier is reported only once
pru.sh.x.c:274: error: for each function it appears in.)
./shc: Error 0


In order to corrrect this issue, we need to modify shc.c and remove
include <sys/ptrace.h> since ptrace.h does not exists in Solaris 10
and
changed
mine = !ptrace(PTRACE_ATTACH, pid, 0, 0);",
To
mine = !ptrace(10, pid, 0, 0);",

and again make shc

It works okay.

I am writing this here since who knows some body may find this useful and looking for suggestions.

If you pass the password in as either a command line argument or an environment variable then anyone who can run "ps" can see the password to the database.

If you use the ksh93 shell, there is a command named shcomp that will convert a script into an intermediate machine independent form. ksh93 detects this format whenever it runs a script and execute directly from this intermediate format.

No way, that's where my utility comes in picture. We don't pass Password iin command line or store in profile.

We have Password file ( encrypted) which gets read with this code and decrypted on fly using openssl ( You don't see anything on ps or envionment variables)


$ getSQLPLUS SID system
Login using system@SID successful using tnsnames

SQL*Plus: Release 10.2.0.3.0 - Production on Tue Dec 11 17:11:59 2007

Copyright (c) 1982, 2006, Oracle. All Rights Reserved.

SQL> !ps -ef |grep getS
oracle 28202 28159 0 17:12:11 pts/1 0:00 grep getS
oracle 28110 24930 0 17:11:58 pts/1 0:00 getSQLPLUS -c #!/bin/ksh################################################ # Fi

I have known about shcomp but never tried it. I could not find shcomp in my system , possibly, we don't have ksh93 or some package is not installed. How do I know whether I have ksh93 ?