Security Basics mailing list archives
Re: script credentials
From: Ansgar Wiechers <bugtraq () planetcobalt net>
Date: Mon, 1 Mar 2010 23:37:18 +0100
On 2010-03-01 jason.gerfen () gmail com wrote:
If your working with perl and are worried about exposing your password through a config file (which you could limit access through with the proper permissions), or as noted above in regards to exposing the username, password information through arguments then you might want to utilize an encrypted version of the password within the config file. Take a look at the mcrypt perl module as it would handle it easily for you: http://search.cpan.org/dist/MCrypt/MCrypt.pm
What exactly is that supposed to solve? The OP's script would need to decrypt the credentials in order to authenticate against the database. Meaning that he'd need *another* password/key to do that. Which would have to be stored somewhere as well. Regards Ansgar Wiechers -- "All vulnerabilities deserve a public fear period prior to patches becoming available." --Jason Coombs on Bugtraq ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- Re: Re: script credentials jason . gerfen (Mar 01)
- Re: script credentials Ansgar Wiechers (Mar 02)
- Re: script credentials Wimpie du Plessis (Mar 04)
- Re: script credentials Ansgar Wiechers (Mar 04)
- Re: script credentials Wimpie du Plessis (Mar 04)
- Re: Re: script credentials Jeffrey Walton (Mar 02)
- Re: script credentials Ansgar Wiechers (Mar 02)