[cisco-voip] OT: storing passwords securely in unix scripts

[Lelio Fulgenzi]

you know it's time to go home when you want to read more about this unix utility called 'shc' that is supposed to compile these scripts for you and the the first hit on google for shc is.... 

Spontaneous human combustion - Wikipedia, the free encyclopedia 



--- 
Lelio Fulgenzi, B.A. 
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1 
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU) 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
Cooking with unix is easy. You just sed it and forget it. 
- LFJ (with apologies to Mr. Popeil) 


----- Original Message -----
From: "Lelio Fulgenzi" <lelio at uoguelph.ca> 
To: "Erick" <ewellnitzvoip at gmail.com> 
Cc: "cisco-voip" <cisco-voip at puck.nether.net>, "Matthew Loraditch" <MLoraditch at heliontechnologies.com> 
Sent: Friday, March 2, 2012 6:09:09 PM 
Subject: Re: [cisco-voip] OT: storing passwords securely in unix scripts 


i'd settle for a nebulous .exe file. 

i'm searching for compilers of scripts to see what i get. i shudder at the thought of writing something in C--. 

--- 
Lelio Fulgenzi, B.A. 
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1 
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU) 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
Cooking with unix is easy. You just sed it and forget it. 
- LFJ (with apologies to Mr. Popeil) 


----- Original Message -----
From: "Erick" <ewellnitzvoip at gmail.com> 
To: "Matthew Loraditch" <MLoraditch at heliontechnologies.com> 
Cc: "Lelio Fulgenzi" <lelio at uoguelph.ca>, "cisco-voip" <cisco-voip at puck.nether.net> 
Sent: Friday, March 2, 2012 6:05:04 PM 
Subject: Re: [cisco-voip] OT: storing passwords securely in unix scripts 


It depends. 


Basic CUCM user/password combos are in a base 64 encoding so you could store that somewhere but I'm not sure how secure that would be. 


You could also look into encryption algorithms where your script could decode the stored value. 


Problem with either one lies in the fact anyone with access to your code could easily figure out the user/password combination. That is the downfall of scripts instead of a language which compiles a nebulous .exe 

On Mar 2, 2012, at 4:45 PM, Matthew Loraditch < MLoraditch at heliontechnologies.com > wrote: 








I may be thinking about this wrong, but if they aren't in plain text how is your script going to be able to use them? As far as I know you'd have to supply them back to the device in plain text which means they'd need to be some sort of decryptable encryption anyway which just puts you into security by obscurity mode. That may be enough for you but seems redundant to me and an extra step if the file the script is using is properly secured file permission wise. 






Matthew G. Loraditch - CCVP, CCNA, CCDA 

1965 Greenspring Drive 
Timonium, MD 21093 

voice. 410.252.8830 
fax. 410.252.9284 

Twitter | Facebook | Website | Email Support 


From: cisco-voip-bounces at puck.nether.net [ cisco-voip-bounces at puck.nether.net ] on behalf of Lelio Fulgenzi [ lelio at uoguelph.ca ] 
Sent: Friday, March 02, 2012 5:09 PM 
To: cisco-voip 
Subject: [cisco-voip] OT: storing passwords securely in unix scripts 




this group is a smart bunch of cookies. anyone have any idea how to securely store passwords on unix/linux so that i can run scripts that require passwords? 

until Cisco builds SSH key pair recognition (or is it there already? ;), this seems like the only option. 

i don't want to be storing passwords in plain text regardless of how secure the directory might be. or at least avoid it if at all possible. 

thoughts? 

--- 
Lelio Fulgenzi, B.A. 
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1 
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU) 
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
Cooking with unix is easy. You just sed it and forget it. 
- LFJ (with apologies to Mr. Popeil) 

_______________________________________________ 
cisco-voip mailing list 
cisco-voip at puck.nether.net 
https://puck.nether.net/mailman/listinfo/cisco-voip 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20120302/96b5c60d/attachment.html>