Solved

oracle passwords in configuration files

Posted on 2014-02-14
5
527 Views
Last Modified: 2014-02-18
albeit not a DBA or developer myself, reading some security articles, it is not uncommon to find oracle DB passwords plain text within files on a servers file system. What kind of files would contain such passwords, are they those relating to the application? Do they need to be plain text or can they be protected by any other means?
0
Comment
Question by:pma111
5 Comments
 
LVL 8

Assisted Solution

by:Surrano
Surrano earned 167 total points
ID: 39858584
I find this question too generic.
Oracle surely doesn't store its own passwords in plain text files; at least not since 10g.
Where apps store the passwords they need has nothing to do with Oracle. Some examples from our projects:
- some scripts store encrypted user/password pairs in a config file.
- Services running in JBoss AS access a self-developed "password safe" that contains encrypted account info not only for Oracle but all various kinds of secure identification, e.g. external systems etc.
- We have an admin user that performs changes in Oracle RDBMS if needed by a software update but its password is not stored anywhere; customers are free to change it as they wish. We simply reset it to "our little secret" password for the duration of the software update and otherwise only Customer knows what's the active password of the admin user.
0
 
LVL 37

Accepted Solution

by:
Geert Gruwez earned 167 total points
ID: 39858597
typically batch files on servers may contain passwords
it's also typical to only allow certain people on those servers

there is pro and con in every which way you store passwords
0
 
LVL 3

Author Comment

by:pma111
ID: 39858667
can you give a beginners guide to what batch files actually do to the database, what they are used for? And what file extension they have?
0
 
LVL 37

Expert Comment

by:Geert Gruwez
ID: 39858719
dos ... just plain old dos ... it still exists
http://en.wikipedia.org/wiki/MS-DOS

a batch file is just a way to start a program (and automate certain tasks)
> extension .bat or .cmd on windows

you can do anything with it
create the database, run reports, change items, destroy the database
0
 
LVL 76

Assisted Solution

by:slightwv (䄆 Netminder)
slightwv (䄆 Netminder) earned 166 total points
ID: 39858853
>>can you give a beginners guide to what batch files actually do to the database, what they are used for? And what file extension they have?

Sorry, nope.  As mentioned above:  They can do anything and everything.  That is sort of like asking for what typically can be done with a program written in C++.

Basically, Bat/Script files are just another form of programming language.

This is further complicated in Unix.  A shell script really doesn't need to have a file extension.

>> extension .bat or .cmd on windows

There is at least one other one in Windows, PS1 for PowerShell scripts.


Also mentioned above:  There is an infinite number of applications that can store config/account information in text file.  That is up to the developer of the program and can typically only be controlled if the developer works for you or you company has influence over the product.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
oracle query help 36 67
Oracle Syntax 8 42
Concat multi row values of a field in oracle 6 41
Index Details in SQL Server 2012 4 18
Checking the Alert Log in AWS RDS Oracle can be a pain through their user interface.  I made a script to download the Alert Log, look for errors, and email me the trace files.  In this article I'll describe what I did and share my script.
Never store passwords in plain text or just their hash: it seems a no-brainier, but there are still plenty of people doing that. I present the why and how on this subject, offering my own real life solution that you can implement right away, bringin…
This video shows, step by step, how to configure Oracle Heterogeneous Services via the Generic Gateway Agent in order to make a connection from an Oracle session and access a remote SQL Server database table.
This video shows how to Export data from an Oracle database using the Datapump Export Utility.  The corresponding Datapump Import utility is also discussed and demonstrated.

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now