RE: clear-text passwords in shell/perl scripts

["M. Shirk" <shirkdog_list () hotmail com>]

I would add it is important to know the risks of the system, and have plans 
to mitigate the risks; or just have the proper official sign off this as an 
allowed risk (C&A).

I know in NIST-SP800-026(Security Selft Assessment), Security Control 
#15.1.3 asks whether passwords are embedded in scripts. In other words, 
there better be a very good reason for it. :-)

Shirkdog
http://www.shirkdog.us



> From: "Ofer Shezaf" <Ofer.Shezaf () breach com>
> To: "Jeff Robertson" <Jeff.Robertson () DigitalInsight com>,"Webappsec 
> (E-mail)" <webappsec () securityfocus com>
> Subject: RE: clear-text passwords in shell/perl scripts
> Date: Wed, 23 Mar 2005 14:58:11 -0500
>
>
>
> Well Jeff, I think that you must combine both methods.
>
> The limitation of file permissions is the numerous privilege escalation
> vulnerabilities out there.
>
> You are right about encrypting passwords with keys stored on the machine
> (or otherwise trying to hide the password), but it does help to deter
> casual hackers.
>
> I like Jeremiah Grossman's article "The 80/20 Rule for Web Application
> Security" (http://www.webappsec.org/articles/013105-plain.html). We must
> always remember the total security is an unachievable goal and that we
> should do our best. The chances that a hacker, looking for the weakest
> point, will skip us are greater the more we invest in security.
>
> ~ Ofer
>
>
> Ofer Shezaf
> CTO, Breach Security
>
> Tel: +972.9.956.0036 ext.212
> Cell: +972.54.443.1119
> ofers () breach com
> http://www.breach.com
>
>
> > -----Original Message-----
> > From: Jeff Robertson [mailto:Jeff.Robertson () DigitalInsight com]
> > Sent: Friday, March 18, 2005 8:19 PM
> > To: Webappsec (E-mail)
> > Subject: clear-text passwords in shell/perl scripts
> >
> > Say that a perl script needs access to a database, and access to this
> > database requires a password. The script needs to run automatically
> with
> > no
> > human intervention, so it is not possible to prompt a user to enter
> the
> > password at run time. This means that the password must either be in
> the
> > script itself or in a file readable by the script.
> >
> > I have been asked what can be done to protect this password from
> falling
> > into the wrong eyes. My recommendation is to tightly control read
> > permissions to the script and/or the file that contains the password.
> Make
> > the file owned by a special-purpose user who only exists to run this
> > script,
> > and chmod it to 600. That sort of thing.
> >
> > It has been suggested to encrypt the password. Since the script needs
> to
> > get
> > the clear text of the passwords in order to use them, this will need
> to be
> > symmetric encryption and the script will need to have the key
> available,
> > presumably stored in yet another file. As there would be no way to
> keep
> > the
> > key from being stolen other than to use the file permissions that were
> > being
> > relied on previously, you've just increased the complexity of the
> system
> > without actually making it any more secure. This is bad. You'd be
> better
> > off
> > sticking with the simpler solution, since the security is the same
> either
> > way.
> >
> > Can anyone either refute or provide further points in support of my
> stance
> > on this?
> >
> > Jeff Robertson
> > Manager of Web Application Security
> > Digital Insight

_________________________________________________________________
On the road to retirement? Check out MSN Life Events for advice on how to 
get there! http://lifeevents.msn.com/category.aspx?cid=Retirement