最佳做法壳/ Perl脚本控股密码?

问题描述:

我最近不得不重温我的Perl和shell脚本技能,以帮助一些同事。有问题的同事一直负责从大型Oracle数据库后端内部应用程序提供了一些报告,他们根本没有能力做到这一点。虽然有些人可能会质疑我是否拥有这些技能是(笑),显然足够多的人以为我的意思,我不能逃避责任。

I've recently had to dust off my Perl and shell script skills to help out some colleagues. The colleagues in question have been tasked with providing some reports from an internal application with a large Oracle database backend, and they simply don't have the skills to do this. While some might question whether I have those skills either (grin), apparently enough people think I do to mean I can't weasel out of it.

所以,我的问题 - 为了从数据库中提取的报告,我的剧本显然是有连接并运行查询。我还没有迄今设法拿出在哪里存储数据库的用户名和密码一个好的解决办法,因此,目前正在存储在脚本明文

So to my question - in order to extract the reports from the database, my script is obviously having to connect and run queries. I haven't thus far managed to come up with a good solution for where to store the username and password for the database so it is currently being stored as plaintext in the script.

有没有一个很好的解决方案,别人已经编写,也许作为一个CPAN模块?还是有别的东西那最好不过的事情 - 像保持用户/密码组合在的隐藏起来别的地方在文件系统中一个完全独立的文件?或者我应该保持他们平凡加密,以避免刚刚被他们用一个全系统的grep拿出我的脚本?

Is there a good solution for this that someone else has already written, perhaps as a CPAN module? Or is there something else that's better to do - like keep the user / password combo in a completely separate file that's hidden away somewhere else on the filesystem? Or should I be keeping them trivially encrypted to just avoid them being pulled out of my scripts with a system-wide grep?

编辑:
Oracle数据库位于在HP-UX服务器上。结果
应用服务器(运行shell脚本)是Solaris操作系统。结果
设置脚本通过只是我所拥有的是一个没有去,他们必须通过多个技术支持人员可以使用一个服务帐户所有。结果
这些脚本旨在为运行cron作业。结果
我很想去与公共密钥认证,但我不知道的方法,使与Oracle的工作 - 如果有这样一个方法 - 请赐教结果

The Oracle database sits on an HP-UX server.
The Application server (running the shell scripts) is Solaris.
Setting the scripts to be owned by just me is a no-go, they have to be owned by a service account that multiple support personnel have access to.
The scripts are intended to be run as cron jobs.
I'd love to go with public-key authentication, but am unaware of methods to make that work with Oracle - if there is such a method - please enlighten me!

最佳做法,恕我直言,将是在shell / Perl脚本并无持有任何密码。这就是公共密钥验证是。

Best practice, IMHO, would be to NOT hold any passwords in a shell / Perl script. That is what public key authentication is for.