Or you can echo the password in as the start of a pipeline.
-----Original Message-----
From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx]
On Behalf Of D'Hooge Freek
Sent: Sunday, April 24, 2011 2:21 PM
To: cicciuxdba@xxxxxxxxx; troach@xxxxxxxxx
Cc: bwmyers@xxxxxxxxx; oracle-l@xxxxxxxxxxxxx
Subject: RE: Alternatives to RMAN cleartext password in batch file for
backups?
Alan,
I think that if you start rman with the password on the command line like
below, the password will be visible via the process list (ps or pargs).
To avoid this, you should modify the script so that the connection to the
database or repository is done in the rman script itself.
I have not had the chance to test it, so I reserve the right to be mistaken.
Sent: zondag 24 april 2011 17:52
To: troach@xxxxxxxxx
Cc: bwmyers@xxxxxxxxx; oracle-l@xxxxxxxxxxxxx
Subject: Re: Alternatives to RMAN cleartext password in batch file for
backups?
Well, you must use a decryptable encryption for this to work, but you could
always call RMAN like this:
$!/bin/bash
CATALOG_PASSWORD=`decrypt_command encrypted_password_file`
rman target / catalog catalog_user/${CATALOG_PASSWORD}@SID script ...
Where the decrypt_command is a command that returns a cleartext password
from the 'encrypted_password_file'. It's not the best solution as anyone
with execute permissions on decrypt_command and/or read permissions on
encrypted_password_file would be able to access the cleartext password. But
then again,in several cases security guidelines are not about security, but
about compliance.
On Sun, Apr 24, 2011 at 12:27 AM, Thomas Roach<troach@xxxxxxxxx> wrote:
Why don't you encrypt your shell script?
set oracle_sid=mydatadb
rman target / catalog mycatusr/mycatpwd@mycatdb script Daily_Backup>>
backup.log
My organization requires the catalog password (mycatpwd) above to be
encrypted and not stored as clear text in any other file or environment
variable. How can I still use this batch file for scheduled backups without
providing a clear text password?
The only option I can think of is to compile the commands into a binary
executable. Any other ideas besides that?
