Code, Data and Passwd encrypted? sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID

Question

Lots of our *NIX scripts use "sqlplus $USER/$PASSWORD@$ORACLE_REMOTE_SID"

I know that not good to have clear text password in scripts (there is no alternative at the moment). But question

• is the username and password transmitted over network securely encrypted?
• is the SQL code transmitted over network securely encrypted?
• is the Data transmitted over network securely encrypted?

Answer 1

It depends on your configuration. Oracle supports TLS as part of its protocol and data drivers, so it can authenticate and communicate entirely over TLS (SSL).

Whether or not this is enabled by default depends on:

• Which version of Oracle DBMS you're using.
• Which data driver you're using.
• The version of the data driver.

I'm not sure whether it's possible to authenticate via TLS and do the rest of the communication in plaintext, but I doubt it - it wouldn't be very secure.

Answer 2

The answers are

1. No (username is visible) /yes (mostly password is hidden)
2. and 3 Not normally, unless you pay extra and implement the Advanced Security Options.

To fill out (1). The Oracle database has a hash of the password, not the actual password. When you connect, Oracle picks a value and sends it to the client. The client hashes the user-entered password to get the same hash as the database is storing, then uses that to hash the value sent by the database. It sends that back to the database. In the mean time, the database has also hashed that value with the same hashed password.

If the client has got to the same value as the database, then it is assumed to have come from the same starting point (ie the user's password). Full explanation

The 11g algorithm is a bit different but the fundamental idea is that the password isn't passed in clear text or trivial hash. It would take a serious attacker.

---

If the script is sitting on the database server, you can use OS authentication instead of a password. There's other tricks you can do (such as having the database determine which IP address is coming from and whitelist/blackist accordingly).

Answer 3

From what I know I would say:

• No
• No
• No

And It will pretty sum it up :) If you want some security setup VPN to DB (dedicated connection is better). And use certificate authentication (little overhead).

Answer 4

check out TNSALIAS that hides the password in the Oracle Wallet. Sure, it's not hidden for everyone but it allows you to enforce separation between the DBA's and the script admin from peeking at passwords and TNS strings.