Tony’s Oracle Tips

October 15, 2008

Hiding sqlplus passwords from “ps” output

Filed under: Uncategorized — tonyhasler @ 10:17 am

It is a common concern that passwords entered on the sqlplus command line appear in “ps” output on UNIX systems. If you execute sqlplus from a Korn shell script you can usually avoid passing the password on the command line as follows:


#!/bin/ksh
sqlplus /nolog << EOF
connect username/password@orcl
exec dbms_lock.sleep(20) ;
EOF

If you modify this script to provide a valid connection string and then execute it from one terminal and do a “ps” on another you will not see the password.

However, suppose your script is setup to start an interactive session for a user providing the password for the user?

An unsecured version of the script might look like this:


#!/bin/ksh
sqlplus username/password@orcl

This script logs a user onto sqlplus (so the user doesn’t need to know the password) but exposes the password to “ps”‘.

One simple solution is as follows:


#!/bin/ksh
(echo connect username/password@orcl ; cat - ) | sqlplus /nolog

This technique gives the user her sqlplus prompt but the password appears in the “ps” output only for a moment during the echo command.

Even more secure is:


#!/bin/ksh
(cat - << EOF ; cat - ) | sqlplus /nolog
connect username/password@orcl
EOF

This hides the password completely.

Advertisements

October 12, 2008

UK Oracle User Group Annual Conference – Early Bird rate about to close!

Filed under: Uncategorized — tonyhasler @ 11:14 pm

Useful information:

 

         UKOUG is an independent membership organisation serving the Oracle, PeopleSoft, JD Edwards, Hyperion, Siebel & Stellent communities.

 

         UKOUG 2008 Conference & Exhibition, 1st – 5th December, International Convention Centre, Birmingham, United Kingdom – 5-day agenda with over 400 sessions and a 4 day exhibition with over 100 stands

 

         Registration is open and people can register for both UKOUG 2008 Conference & Exhibition and the PeopleSoft Conference & Exhibition at www.ukoug.org/2008

 

      Early bird rates close on 17th October and apply to UKOUG 2008 Conference & Exhibition and PeopleSoft Conference & Exhibition

 

         Register before this date and save £100 – to find rates go to www.ukoug.org/2008 click on the Register link and click No voucher. Early bird rates also available for 12mth membership/conference pass packages.

 

         Ticket types range from a 1 day pass to a 5 day pass

 

 

 

UKOUG 2008 Conference & Exhibition – one conference, four dates:

 

         This year the UKOUG 2008 Conference & Exhibition is made up of four events – the main UKOUG 2008 Conference & Exhibition, an Executive Summit, a PeopleSoft Conference & Exhibition and a JD Edwards Conference & Exhibition

 

        Executive Summit – the inaugural event to be held on 1st-2nd December during UKOUG 2008. Exclusive, invitation only event for C-level executives.

 

        PeopleSoft Conference & Exhibition – 4th-5th December during UKOUG 2008. 2-day agenda with over 30 sessions for all experience levels and an exhibition.

 

        JD Edwards Conference & Exhibition – 4th-5th November, Ascot Racecourse, Berkshire. Four stream, 2-day agenda and an exhibition. Registration for JD Edwards Conference & Exhibition is here: http://jdedwards.ukoug.org/default.asp?p=1339

 

New page on launhing SQL*PLUS from APEX

Filed under: Uncategorized — tonyhasler @ 11:09 pm

I decided to create this as a page so have a look over at the pages.

Create a free website or blog at WordPress.com.