Comments on: Using Oracle Wallet to Execute Shell script/cron without hard coded Oracle database password

By: terkel

terkel — Fri, 18 May 2012 09:57:53 +0000

I still dont get it, so if someone get the ewallet.p12 cwallet.sso files and the connect string (simply by reading/copy them from a Live USB system) he is able to connect to the database?! It seems not very secure to me…

By: Finding blogging tough..naah.just copy and do find and replace | AskDba.org Weblog

Sun, 22 Aug 2010 09:05:32 +0000

[...] actual installation and did the steps. I saw this post (check snapshot below) where in he copied my article on Oracle wallet and was amazed by sheer coincidence of wallet files having same timestamp Below snapshot proves [...]

By: Amit

Amit — Thu, 29 Apr 2010 15:20:27 +0000

Niki,

This is not part of oracle database vault.

I didnt find any reference stating that we need enterprise edition to use this feature, so I assume it should be available. Best thing would be to try it.

Cheers
Amit

By: Niki

Niki — Thu, 29 Apr 2010 10:37:20 +0000

Couple of questions

Is this feature part of Oracle Vault? if not is it available with standard edition?

Appreciate your time.

By: Amit

Amit — Tue, 06 Oct 2009 03:07:13 +0000

Anyone who has read permission on files ewallet.p12 and cwallet.sso can connect to the database using connect string. So if you wish to stop a particular user, ensure that the user does not have read permission on it.

Regards
Amit

By: Debi Lorraine

Debi Lorraine — Mon, 05 Oct 2009 21:00:15 +0000

Thanks for the response. I think I am still missing something. What is to stop another user from using this connect string?

By: Amit

Amit — Thu, 01 Oct 2009 10:12:31 +0000

No, it is not mandatory for database and client server to be on same machine. This setup can be done on any client machine. Secondly this is different from OS authentication as you can grant read access to other user or copy the wallet files to other user's directory and change the permissions. In case client is using DB home , it would be helpful if you use TNS_ADMIN variable for the user to have separate sqlnet.ora file/tnsnames.ora file.

Do let me know if I have missed any point or you need further clarification.

By: Debi Lorraine

Debi Lorraine — Wed, 30 Sep 2009 17:29:06 +0000

I am intrigued…and puzzled how this is secure. Although you say the credentials are stored in a "client side" wallet, I assume this must be done on the same host as the database and relies on OS authentication of the user, or else what's to stop anyone from spoofing the user from any host? But then why wouldn't you just use "connect /"? I feel like I'm missing something.

By: Blogroll Report 04/09/2009 – 11/09/2009 « Coskan’s Approach to Oracle

Blogroll Report 04/09/2009 – 11/09/2009 « Coskan’s Approach to Oracle — Fri, 11 Sep 2009 18:29:34 +0000

[...] 5-How to avoid password hardcoding in Shell scripts with Oracle Wallet ? Amit Bansal-Using Oracle Wallet to Execute Shell script/cron without hard coded Oracle database password? [...]

By: Amit

Amit — Wed, 09 Sep 2009 13:47:34 +0000

Thanks Gokul..Yeah this is pretty useful feature and can be used in shell scripts, rman catalog connection and exp/imp for connecting to databases.

Regards
Amit

By: Gokul

Gokul — Wed, 09 Sep 2009 06:24:55 +0000

Excllent feature, explained neatly & simple. A long time pending security feature enabled in 5 mins.

Gooooood work.

Expecting more shortcuts(features).

Gokul…….