Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID"

I know that not good to have clear text password in scripts (there is no alternative at the moment). But question

  • is the username and password transmitted over network securely encrypted?
  • is the SQL code transmitted over network securely encrypted?
  • is the Data transmitted over network securely encrypted?
share|improve this question
add comment

4 Answers

check out TNSALIAS that hides the password in the Oracle Wallet. Sure, it's not hidden for everyone but it allows you to enforce separation between the DBA's and the script admin from peeking at passwords and TNS strings.

share|improve this answer
add comment

The answers are

  1. No (username is visible) /yes (mostly password is hidden)
  2. and 3 Not normally, unless you pay extra and implement the Advanced Security Options.

To fill out (1). The Oracle database has a hash of the password, not the actual password. When you connect, Oracle picks a value and sends it to the client. The client hashes the user-entered password to get the same hash as the database is storing, then uses that to hash the value sent by the database. It sends that back to the database. In the mean time, the database has also hashed that value with the same hashed password.

If the client has got to the same value as the database, then it is assumed to have come from the same starting point (ie the user's password). Full explanation

The 11g algorithm is a bit different but the fundamental idea is that the password isn't passed in clear text or trivial hash. It would take a serious attacker.


If the script is sitting on the database server, you can use OS authentication instead of a password. There's other tricks you can do (such as having the database determine which IP address is coming from and whitelist/blackist accordingly).

share|improve this answer
add comment

It depends on your configuration. Oracle supports TLS as part of its protocol and data drivers, so it can authenticate and communicate entirely over TLS (SSL).

Whether or not this is enabled by default depends on:

  • Which version of Oracle DBMS you're using.
  • Which data driver you're using.
  • The version of the data driver.

I'm not sure whether it's possible to authenticate via TLS and do the rest of the communication in plaintext, but I doubt it - it wouldn't be very secure.

share|improve this answer
add comment

From what I know I would say:

  • No
  • No
  • No

And It will pretty sum it up :) If you want some security setup VPN to DB (dedicated connection is better). And use certificate authentication (little overhead).

share|improve this answer
    
Actually, all three are most likely "yes", since Oracle uses TLS as part of its data driver. –  Polynomial Dec 1 '12 at 22:29
    
I don't think it's enabled by default. And I was "evaluating" default setup :) –  fatfredyy Dec 2 '12 at 16:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.