Security with scripts

Question

Right now, I am coding the username/password@something into the scripts that I am writing for oracle8i database. I understand that there are security issues with this. They want the password to be hidden. Someone suggested me to set the username and password into the path. I'm just wondering how am I able to do that? What steps do I need to take?

Answer 1

The system we use for this type of thing is to create an externally identified user in Oracle.
CREATE USER ops$oracle IDENTIFIED EXTERNALLYWhat this means is, that if you are logged into the server as the O/S user oracle, then you can connect to a database without a password like:
/home/oracle/dba>sqlplus / The ops$ is Oracle's default prefix for externally identified users. You can change this by setting the parameter os_authent_prefix to something else.
Any valid O/S user can be granted access to the database this way. However, you can only connect without a password if you are physically connected to the server where the database resides (either the console or a telnet session). You can give a password to an ops$ user as well so that the account can be used when not directly connected. It is the ops$ prefix (or whatever you set) that allows the connection.
We give user ops$oracle DBA privileges on the database (note you want to be very careful who has the password to the oracle O/S account). Then when we need to run automated scripts through cron we would do something like:
#!/usr/bin/ksh
export ORACLE_HOME=/u01/app/oracle/product/8.1.7
export ORACLE_SID=prod
export PATH=$ORACLE_HOME/bin:$PATH
sqlplus -s / <<EOF
ALTER SESSION SET current_schema=table_owner;
SELECT * FROM t;
exit;
EOFthe SET current_schema puts us in table_owner's namespace, so we can refer to his objects without qualifying them with owner.table_name. Changing schemas does not give access to any thing that you could not see by qualifying the table name with the owner name, but it is convenient.
HTH
John