Re: Perl Setuid - Oracle Password Hardcoding

Replies are listed 'Best First'.
Re^2: Perl Setuid - Oracle Password Hardcoding by zekeb (Initiate) on Nov 17, 2011 at 00:15 UTC
It sounds like the dbas don't want the developer to know the password to Oracle. If they run the script with sudo or setuid or whatever, what would prevent them from just having the code print out the password that was read from the file?	[reply]
Re^3: Perl Setuid - Oracle Password Hardcoding by JavaFan (Canon) on Nov 17, 2011 at 00:41 UTC
Considering that the OP is talking about an application server, it looks to me this is a standard production security policy, not something to pester developers with. It's not a measure to defend against internal attacks^, but to prevent escalation after an intrusion. Of course, the script should be non-modifiable. ^Although with some effort, it can help to protect against insiders wearing a black hat.	[reply]
Re^3: Perl Setuid - Oracle Password Hardcoding by hmadhi (Acolyte) on Nov 17, 2011 at 16:24 UTC
True. However we will not have access to the scripts on the production servers. They are rollout using SVN.	[reply]
Re^2: Perl Setuid - Oracle Password Hardcoding by afoken (Chancellor) on Nov 19, 2011 at 08:44 UTC
Two hints: Given sufficient permissions in `/etc/sudoers`, the command `/usr/bin/sudo -u foo /usr/bin/cat /home/foo/bar.txt` runs `cat` as user `foo` and writes the contents of `/home/foo/bar.txt` to STDOUT. In Perl, $text=`/usr/games/fortune -a`; runs `/usr/games/fortune -a` and collects all text written to STDOUT in $text. See Safe Pipe Opens for a more robust variant. Alexander -- Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)	[reply] [d/l] [select]