DomainKey-Signature: a=rsa-sha1; c=nofws;        d=gmail.com; s=gamma;        h=mime-version:in-reply-to:references:date:message-id:subject:from:to         :cc:content-type;        b=RLh7tvWZamuPqng+zMpcz9s4rcXFGaC2vEKEs3J3ktxs/E5G9bta3DtjB6/9mc2sGc         qST9D49N8qZF60EfjWgkoJpNJQqrshtI60DeWTafIaWALei9cvT7BcedtILqP1vAfADy         QNyv2dSjPzh5Gv+7H0QFA9czWK3sSFRuEStq0=
MIME-Version: 1.0
In-Reply-To: <AANLkTi=Q3AUwB_JKsvSHBieW-UO4mCQVY3UUj78i=6FD@mail.gmail.com>
References: <770572.52317.qm@web57505.mail.re1.yahoo.com>	<4D48EE4D.5010808@tpg.com.au>	<AANLkTi=Q3AUwB_JKsvSHBieW-UO4mCQVY3UUj78i=6FD@mail.gmail.com>
Date: Wed, 2 Feb 2011 07:30:09 +0000
Message-ID: <AANLkTi=8FW6+28NPmV0wqDekn4N+ET5vJmLyJ=kQKg6D@mail.gmail.com>
Subject: Re: unix Ksh script variable
From: Niall Litchfield <niall.litchfield@gmail.com>
To: dedba@tpg.com.au
Cc: oracle-l@freelists.org, ajoshi977@yahoo.com
Content-Type: multipart/alternative; boundary=0016364274d963ae8e049b479efc
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-To: niall.litchfield@gmail.com
--0016364274d963ae8e049b479efc
Content-Type: text/plain; charset=ISO-8859-1

Hi
I'm pretty sure that Oracle Wallet requires the advanced security option to
be licensed. So a great solution if its already there, but somewhat overkill
compared to parsing a protected text file if it isn't. I wonder these days
how big the security risk of storing passwords in scripts is (not the
convenience of only storing them once). Time was when we had real users
logging onto the db server able to read scripts and sniff command lines.
Those days pretty much died with client server though.

(p.s my phone adaptive auto correct changed "command lin" to "named pipes"
as I was typing . I should get out more)

On 2 Feb 2011 05:42, "De DBA" <dedba@tpg.com.au> wrote:

Have you considered using Oracle Wallets? It takes a bit of effort to setup,
but is quite resilient. We have used it for years to great satisfaction. You
store just the credential's db_connect_string in a plain-text configuration
file, which the script then picks up and uses to connect.

see e.g.:
http://askdba.org/weblog/2009/09/using-oracle-wallet-to-execute-shell-scriptcron-without-hard-coded-oracle-database-password/

There used to be an Oracle Whitepaper as well which showed how to set this
up with the sys account, but I cannot find it any more on the Oracle
website. The actual topic of the whitepaper was "Using Oracle Recovery
Manager (RMAN) with Database Vault", published in 2006. Basically you just
create a credential as demonstrated in the link above and pass the connect
string with "as sysdba" as per usual.

Hth,
Tony


A Joshi wrote:
>
> hi
> I have a script which is to be executed on many databases and different
da...

--0016364274d963ae8e049b479efc
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<p>Hi<br>
I&#39;m pretty sure that Oracle Wallet requires the advanced security optio=
n to be licensed. So a great solution if its already there, but somewhat ov=
erkill compared to parsing a protected text file if it isn&#39;t. I wonder =
these days how big the security risk of storing passwords in scripts is (no=
t the convenience of only storing them once). Time was when we had real use=
rs logging onto the db server able to read scripts and sniff command lines.=
 Those days pretty much died with client server though. </p>

<p>(p.s my phone adaptive auto correct changed &quot;command lin&quot; to &=
quot;named pipes&quot; as I was typing . I should get out more)</p>
<p><blockquote type=3D"cite">On 2 Feb 2011 05:42, &quot;De DBA&quot; &lt;<a=
 href=3D"mailto:dedba@tpg.com.au">dedba@tpg.com.au</a>&gt; wrote:<br><br>Ha=
ve you considered using Oracle Wallets? It takes a bit of effort to setup, =
but is quite resilient. We have used it for years to great satisfaction. Yo=
u store just the credential&#39;s db_connect_string in a plain-text configu=
ration file, which the script then picks up and uses to connect.<br>

<br>
see e.g.: <a href=3D"http://askdba.org/weblog/2009/09/using-oracle-wallet-t=
o-execute-shell-scriptcron-without-hard-coded-oracle-database-password/" ta=
rget=3D"_blank">http://askdba.org/weblog/2009/09/using-oracle-wallet-to-exe=
cute-shell-scriptcron-without-hard-coded-oracle-database-password/</a><br>

<br>
There used to be an Oracle Whitepaper as well which showed how to set this =
up with the sys account, but I cannot find it any more on the Oracle websit=
e. The actual topic of the whitepaper was &quot;Using Oracle Recovery Manag=
er (RMAN) with Database Vault&quot;, published in 2006. Basically you just =
create a credential as demonstrated in the link above and pass the connect =
string with &quot;as sysdba&quot; as per usual.<br>

<br>
Hth,<br>
Tony<p><font color=3D"#500050"><br><br>A Joshi wrote:<br>&gt;<br>&gt; hi<br=
>&gt; I have a script which is to be executed on many databases and differe=
nt da...</font></p></blockquote></p>

--0016364274d963ae8e049b479efc--
--
http://www.freelists.org/webpage/oracle-l