RE: Alternatives to RMAN cleartext password in batch file for backups?

From: Michael Dinh <mdinh_at_XIFIN.Com>
Date: Sun, 24 Apr 2011 08:59:39 -0700
Message-ID: <>

Here is another one that I have used at a company before.

From: [] On Behalf Of Guillermo Alan Bort [] Sent: Sunday, April 24, 2011 8:51 AM
Cc:; Subject: Re: Alternatives to RMAN cleartext password in batch file for backups?

Well, you must use a decryptable encryption for this to work, but you could always call RMAN like this:

CATALOG_PASSWORD=`decrypt_command encrypted_password_file`

rman target / catalog catalog_user/${CATALOG_PASSWORD}_at_SID script ...

Where the decrypt_command is a command that returns a cleartext password from the 'encrypted_password_file'. It's not the best solution as anyone with execute permissions on decrypt_command and/or read permissions on encrypted_password_file would be able to access the cleartext password. But then again,in several cases security guidelines are not about security, but about compliance.


On Sun, Apr 24, 2011 at 12:27 AM, Thomas Roach <<>> wrote: Why don't you encrypt your shell script?

On Sat, Apr 23, 2011 at 9:05 PM, Bill Myers <<>> wrote: Hi all,
I have the following commands in a batch file scheduled for daily execution:

set oracle_sid=mydatadb
rman target / catalog mycatusr/mycatpwd_at_mycatdb script Daily_Backup >> backup.log

My organization requires the catalog password (mycatpwd) above to be encrypted and not stored as clear text in any other file or environment variable. How can I still use this batch file for scheduled backups without providing a clear text password?

The only option I can think of is to compile the commands into a binary executable. Any other ideas besides that?

Thanks in advance.


Thomas Roach

-- Received on Sun Apr 24 2011 - 10:59:39 CDT

Original text of this message