Solved

VBscript Sybase Query DSN credentials

Posted on 2011-02-10
11
1,545 Views
Last Modified: 2012-05-11
Hi,

I need to run a vbscript (from a windows 2003/2008 server) that will use a system  DSN ODBC connection to a sybase database on a Unix  server to do a query. (select statement)
I cant have the password in the script (cleartext) so I want to configure a DSN with the username and password in there .

It this possible?
Can I call a DSN odbc connection from VBscript and use something like trusted for the credentials?
If so, what do I use to open the connection to the DB?
The user account and password will be  local sybase user/pass.

0
Comment
Question by:neoptoent
  • 6
  • 5
11 Comments
 
LVL 65

Expert Comment

by:RobSampson
Comment Utility
Hi, this should show you some examples on how to use a System DSN:
http://www.activexperts.com/activmonitor/windowsmanagement/adminscripts/enterprise/databases/

This line should cover the main connection part:
objConnection.Open "DSN=Inventory;"


Regards,

Rob.
0
 

Author Comment

by:neoptoent
Comment Utility
Rob,

What do I do about password.
I dont think you can store a password in a dsn.
And i need to connect to Sybase and Oracle databases using sql authentication.

I can have it in the connection string because we cant have a password in clear text

Any ideas?
0
 
LVL 65

Expert Comment

by:RobSampson
Comment Utility
I don't actually think it's possible.  With VBScript, the details will always be in clear text somewhere along the line, whether you encrypted them or not.  There is no way to predefine SQL authentication credentials in a DSN.

Perhaps your best bet is to put the connection details in the script without using a DSN (so use a DSN-less connection string), and then compile the VBS into an EXE, using something like the VBSToEXE tool here:
http://www.f2ko.de

Regards,

Rob.
0
 

Author Comment

by:neoptoent
Comment Utility
Not a bad idea,
If  it is converted to an exe, is anything still in clear? meaning can someone open the exe and see the password?


I wish there would be  a way for me to encrypt the password in a reg key or file and then use the vbscript to call that key/file decrypt the password.


If I use a dsn then the password stays encrypted over the wire...
0
 
LVL 65

Accepted Solution

by:
RobSampson earned 500 total points
Comment Utility
If it's an EXE, it's FAR more difficult to decompile, but I guess not "impossible".  Another idea, maybe more secure, is to write the script in Visual Studio Express, as a .NET application, which is compiled into an EXE.

There *is* a way to encrypt something to a file, but it requires an encryption "key", and the key would need to put into the VBScript, meaning someone only has to copy your code, and use the encryption key to decrypt the file themselves.

People have tried to do what you're doing everywhere:
http://stackoverflow.com/questions/1244350/sybase-iq-and-encrypted-passwords

The most common solution is just lock down a specific account to allow only what you need, and put that in your connection string.

Regards,

Rob.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:neoptoent
Comment Utility
ahhh

i dont know .net... can i use vbscript in there and just compile it?
0
 
LVL 65

Expert Comment

by:RobSampson
Comment Utility
No, unfortunately, that doesn't work, you might just be best trying out the VBSToEXE approach.

Regards,

Rob.
0
 

Author Comment

by:neoptoent
Comment Utility
if i wrote it VB and compiled it, can u encrypt the code so it cant be viewed?
0
 
LVL 65

Expert Comment

by:RobSampson
Comment Utility
If you conver the VBS to an EXE, it is written in "machine code", so cannot be interpreted.  I've tried running a few "sniffers" over the EXE compiled by the VBS2EXE, and couldn't find any clear text code, so I think it's pretty safe.

Regards,

Rob.
0
 

Author Comment

by:neoptoent
Comment Utility
Rob,

do you think i could use blowfish, encrypt the password in the registry and use it?
0
 
LVL 65

Expert Comment

by:RobSampson
Comment Utility
I assume you're talking about something like this:
http://www.example-code.com/vbscript/vbscript-blowfish.asp

But, as far as I can see, if people can still read your plain text vbscript, then they could make a new script that includes these lines (in particular):

keyBytes = blowfish.GenerateSecretKey("secret_password")
blowfish.SecretKey = keyBytes

Then read the cypherText (encrypted string) from the registry where you store it, and simply decrypt it using this:

clearText = blowfish.DecryptStringENC(cipherText)

VBScript really isn't the secure way to do this, because it's always plain text.

There might be one way of making the SecretKey unknown though, or if we go back a few steps, the database username and password for the DSN, unknown.  That would be to pass those values from AD as a login script perhaps.  The parametes passed from AD are unkown to the user, and they can't copy the code to try to run it from somewhere else, because it needs to run from that particular GPO.

To do that, use a DSN-less connection string, and code like this:

strUsername = WScript.Arguments.Item(0)
strPassword = WScript.Arguments.Item(1)
strConnString = "Data Source=\\myserver\myvolume\mypat\mydd.add;User ID=" & strUsername & ";Password=" & strPassword & ";ServerType=REMOTE;"

Connection strings are here: http://www.connectionstrings.com/sybase-advantage

Then, in a GPO, set up a login script to point to the script, and in the parameters section type
username password

Regards,

Rob.
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Over the years I have built up my own little library of code snippets that I refer to when programming or writing a script.  Many of these have come from the web or adaptations from snippets I find on the Web.  Periodically I add to them when I come…
Not long ago I saw a question in the VB Script forum that I thought would not take much time. You can read that question (Question ID  (http://www.experts-exchange.com/Programming/Languages/Visual_Basic/VB_Script/Q_28455246.html)28455246) Here (http…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now