Re: Hiding passwords in scripts...

Apart from a suid script, which is really the only way to do this "properly", there are few options that will actually work to the same degree.

I can only assume that you are concerned about 'shell-level' access to the database, and not through the Web in particular. As such, you want to prevent the average user from discovering the DB password, such that they can connect to the DB and do all sorts of horrible things to it, outside the scope of the script(s) which are presumably safe.

The reality is that if the user's Perl interpreter can read the script, and the associated password, then there is little you can do to prevent it from being discovered. You can obfuscate it a bit (i.e. 'perlcc' plus some tricks to prevent a plain-text attack), but that only buys you limited time from a determined cracker. If the script can't read the password, it can't access the DB.

If it's applicable, you might want to move your application to a Web based format, such that the users don't have direct access to the system. This will go a long way to preventing unauthorized activity.

As a cheaper alternative, you may be able to restrict 'shell' access by setting their login shell to be the application. Historically, though, it is easy to escape from this kind of restriction using something as simple as ':shell' in vi, so some care will have to be taken when testing.

Comment on Re: Hiding passwords in scripts...

Replies are listed 'Best First'.
Re: Re: Hiding passwords in scripts... by suaveant (Parson) on Apr 13, 2001 at 19:46 UTC
Basically system stuff on systems where people are allowed shell access... For ISPs, depending on their setup, web based isn't the best, necessarily... If they aren't set up with suexec or something similar, though I guess they probably should be, still.. on a shell system it's not as simple as suexec... - Ant	[reply]
Re^3: Hiding passwords in scripts... by tadman (Prior) on Apr 13, 2001 at 19:55 UTC
On a shell system, you can have a gateway 'suid' program that controls access to your application/module. You have to be careful about '-T'aint checking when you do this, though, to avoid being exploited. `#!/usr/bin/perl -wT use strict; use MyModule; # Your important module(s) # Now do something as the suid user MyModule::DoSomething();` [download] Then set it to `-rwsr-xr-x` suid: `% chmod 4755 theprogram`	[reply] [d/l] [select]