[cisco-voip] OT: storing passwords securely in unix scripts

[Eric Butcher]

Store them with reversible encryption in a 3rd party database with a web app that responds to requests from the UCCX environment.  Set the web app up so it only responds to the UCCX server address.

Use an http request from the script to request the username and password, have the script reverse the encryption (JAVA?) after it receives it from the web response, and then use that to log on to the UCCX repository.

I realize this is absurd, but UCCX doesn't have MLA, which is also absurd.  If it did have MLA, and the script had a special string type "Password" that at least masked the password in the box in a half way secure way, you could have repository manager roles and you could store the credentials to that user role in the script semi-secure.

Or, even better, they could just make uploads to repositories directly from scripts being run on the local box NOT require authentication at all.

There are a million ways for the BU / Developers to fix this.  Until then you pretty much have to backflip through flaming hoops or just store the password in plain text. :)



Eric Butcher

Cisco Unified Communications Engineer
CDW Professional Services

11711 N Meridian, Ste 225

Carmel, IN  46032
( 317.569.4282 – Single Number Reach
＊ eric.butcher at cdw.com<mailto:eric.butcher at cdw.com>

http://www.cdw.com/



From: Matthew Loraditch <MLoraditch at heliontechnologies.com<mailto:MLoraditch at heliontechnologies.com>>
Date: Fri, 2 Mar 2012 22:45:27 +0000
To: "lelio at uoguelph.ca<mailto:lelio at uoguelph.ca>" <lelio at uoguelph.ca<mailto:lelio at uoguelph.ca>>, cisco-voip <cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net>>
Subject: Re: [cisco-voip] OT: storing passwords securely in unix scripts


I may be thinking about this wrong, but if they aren't in plain text how is your script going to be able to use them? As far as I know you'd have to supply them back to the device in plain text which means they'd need to be some sort of decryptable encryption anyway which just puts you into security by obscurity mode. That may be enough for you but seems redundant to me and an extra step if the file the script is using is properly secured file permission wise.


Matthew G. Loraditch - CCVP, CCNA, CCDA

1965 Greenspring Drive
Timonium, MD 21093

voice. 410.252.8830
fax.  410.252.9284

Twitter<http://twitter.com/heliontech>  |  Facebook<http://www.facebook.com/#!/pages/Helion/252157915296>  | Website<http://www.heliontechnologies.com/>  |  Email Support<mailto:support at heliontechnologies.com?subject=Technical%20Support%20Request>
________________________________
From: cisco-voip-bounces at puck.nether.net<mailto:cisco-voip-bounces at puck.nether.net> [cisco-voip-bounces at puck.nether.net<mailto:cisco-voip-bounces at puck.nether.net>] on behalf of Lelio Fulgenzi [lelio at uoguelph.ca<mailto:lelio at uoguelph.ca>]
Sent: Friday, March 02, 2012 5:09 PM
To: cisco-voip
Subject: [cisco-voip] OT: storing passwords securely in unix scripts

this group is a smart bunch of cookies. anyone have any idea how to securely store passwords on unix/linux so that i can run scripts that require passwords?

until Cisco builds SSH key pair recognition (or is it there already? ;), this seems like the only option.

i don't want to be storing passwords in plain text regardless of how secure the directory might be. or at least avoid it if at all possible.

thoughts?

---
Lelio Fulgenzi, B.A.
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
(519) 824-4120 x56354 (519) 767-1060 FAX (ANNU)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Cooking with unix is easy. You just sed it and forget it.
                              - LFJ (with apologies to Mr. Popeil)


_______________________________________________ cisco-voip mailing list cisco-voip at puck.nether.net<mailto:cisco-voip at puck.nether.net> https://puck.nether.net/mailman/listinfo/cisco-voip
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20120303/3755a7a7/attachment.html>