Re: Apache::DBI and password security

2002-11-15 Thread Rafiq Ismail (ADMIN)
On Fri, 15 Nov 2002, [iso-8859-1] Faßhauer, Wolfgang, FCI3 wrote: one database user because of resource limits. The problem I see is that the password for connecting to the database is clear readable in the perl script. Does anybody know how to hide that password? Have you thought of running

Re: Apache::DBI and password security

2002-11-15 Thread Rafiq Ismail (ADMIN)
On Fri, 15 Nov 2002, Rafiq Ismail (ADMIN) wrote: On Fri, 15 Nov 2002, [iso-8859-1] Faßhauer, Wolfgang, FCI3 wrote: one database user because of resource limits. The problem I see is that the password for connecting to the database is clear readable in the perl script. Does anybody know

AW: Apache::DBI and password security

2002-11-15 Thread Faßhauer, Wolfgang, FCI3
Hi, I want to build a database application based on mod_perl and Apache::DBI. The goal of Apache::DBI is to get persistent database connections using only one database user because of resource limits. The problem I see is that the password for connecting to the database is clear readable in the

Re: AW: Apache::DBI and password security

2002-11-15 Thread Rafiq Ismail (ADMIN)
On Fri, 15 Nov 2002, [iso-8859-1] Faßhauer, Wolfgang, FCI3 wrote: Have you thought of running your webserver as some 'www' user? You can then make your scripts readonly by a 'dev' group which the www user and the developes are members of. CORRECT: 'readonly' should be 'only readable' by

AW: Apache::DBI and password security

2002-11-15 Thread Faßhauer, Wolfgang, FCI3
Yes, that's our plan, too. But the risk still remains that someone will get a look to the script. I think, there is a golden rule: Never put clear text passwords in files. Those files are stored in archives by backup for example. There maybe a lot of people (sysadmin, developer, ...)

Re: AW: Apache::DBI and password security

2002-11-15 Thread Rafiq Ismail (ADMIN)
On Fri, 15 Nov 2002, [iso-8859-1] Faßhauer, Wolfgang, FCI3 wrote: Hmm. I think that the guy who wrote Blowfish_PP would cut my danglies off for that one. This is an interesting idea. Cutting my danglies off? hmm. Sounds painful. Many thanks to you, Rafiq! s'ok, although I wouldn't implement

Re: AW: Apache::DBI and password security

2002-11-15 Thread Matthew Byng-Maddick
On Fri, Nov 15, 2002 at 12:52:13PM +, Rafiq Ismail (ADMIN) wrote: $Apache::PARANOID::dbiPassword = $bfish-decrypt($encryptedPassword); then whenever you want your password you access $Apache::PARANOID::dbiPassword. Hmm. I think that the guy who wrote Blowfish_PP would cut my

Re: AW: Apache::DBI and password security

2002-11-15 Thread James G Smith
=?iso-8859-1?Q?=22Fa=DFhauer=2C_Wolfgang=2C_FCI3=22?= [EMAIL PROTECTED] ads.net wrote: Hi, I want to build a database application based on mod_perl and Apache::DBI. The goal of Apache::DBI is to get persistent database connections using only one database user because of resource limits. The