Re: [Tutor] passwords in scripts

2006-01-24 Thread Alan Gauld
> Compiling is certainly helpful in my case, and I did > not realise how simple it was until you explained it. Remember that only *imported* modules are compiled. Your main program will not be compiled. You can fix that by having your main program look like this: ### dummy mainprog.py

Re: [Tutor] passwords in scripts

2006-01-24 Thread Ben Vinger
Compiling is certainly helpful in my case, and I did not realise how simple it was until you explained it. I estimate that most of our MCSEs will not know about the strings command or attempt to look inside something like test.pyc for a password. As for users, I'll be amazed if they tried it. An

Re: [Tutor] passwords in scripts

2006-01-24 Thread Ben Vinger
--- Alan Gauld <[EMAIL PROTECTED]> wrote: > command line arguments? > > $ startapp -d mydb -l user/password & > > That way they are > 1) kept secret(especially if you turn shell history > off ;-) and > 2) can be changed every time you restart the server > app and > 3) you can have production a

Re: [Tutor] passwords in scripts

2006-01-24 Thread Danny Yoo
On Tue, 24 Jan 2006, Ivan Furone wrote: > I'm not sure I understand what you are saying here. Surely if the file > is compiled it can just run (and will only need to be RE-compiled when I > have to change the code (such as when one of the servers has their > password changed). Hi Ivan, But the

Re: [Tutor] passwords in scripts

2006-01-24 Thread Ivan Furone
Hi Ivan I'm not sure I understand what you are saying here. Surely if the file is compiled it can just run (and will only need to be RE-compiled when I have to change the code (such as when one of the servers has their password changed). I would never need to de-compile, because I'll just keep a c

Re: [Tutor] passwords in scripts

2006-01-24 Thread Alan Gauld
> an SSH implementation for them exists, but it is not > worth my while trying to find out, because I will not > be allowed to install anything on them (or even > suggest it). So I access them using telnetlib: Hmm, they won;t lket you install a secure access tool but are happy to let you in with

Re: [Tutor] passwords in scripts

2006-01-23 Thread Danny Yoo
On Mon, 23 Jan 2006, Danny Yoo wrote: > Jon Libes of the National Institute of Standards and Technology (NIST) ^^^ Gaah. I'm sorry, that should be "Don", not "Jon". My muscle memory slipped. *grin* ___ Tutor maillist - Tutor@python.org http://

Re: [Tutor] passwords in scripts

2006-01-23 Thread Danny Yoo
Hi Ben, Jon Libes of the National Institute of Standards and Technology (NIST) has written a guide on how to handle passwords in backgrounded processes: http://expect.nist.gov/doc/bgpasswd.pdf It has more suggestions on how to handle passwords securely. As you might expect, it doesn't have

Re: [Tutor] passwords in scripts

2006-01-23 Thread Ben Vinger
Hi Danny The Unix servers are ancient HP-UX ones. I doubt if an SSH implementation for them exists, but it is not worth my while trying to find out, because I will not be allowed to install anything on them (or even suggest it). So I access them using telnetlib: host = 'hpserver' user = 'backup

Re: [Tutor] passwords in scripts

2006-01-23 Thread Ben Vinger
Hi Ivan I'm not sure I understand what you are saying here. Surely if the file is compiled it can just run (and will only need to be RE-compiled when I have to change the code (such as when one of the servers has their password changed). I would never need to de-compile, because I'll just keep a

Re: [Tutor] passwords in scripts

2006-01-21 Thread Danny Yoo
> > I've written a couple of scripts that check log files on our WIndows > > and Unix servers. These scripts have plain text passwords in them, so > > anyone who can access the filesystem of the Windows server that runs > > the scripts can discover the passwords of the servers. Hello, I guess o

Re: [Tutor] passwords in scripts

2006-01-21 Thread Ivan Furone
2006/1/21, Ben Vinger <[EMAIL PROTECTED]>: > Hello > > I've written a couple of scripts that check log files > on our WIndows and Unix servers. These scripts have > plain text passwords in them, so anyone who can access > the filesystem of the Windows server that runs the > scripts can discover th