Re: Re: Question of safe data passing...

[suaveant]

I read hiding DBI passwords... it hides them, but nothing protects the virtual user from being used by other people (I know, I asked the author)... so you still get the scripts access to the DB... anyway, it is not too much work because I want to make a generic tool people can use... its not just a one time shot. It can also be used for other data, not just DBI passwords...
                - Ant

[frankus]

Okay write a request server as a daemon that the scripts can ask for stuff from. If you want to make it bafflingly encrypted. Store the data as encrypted and use several salts. Store the data in the server in encrypted form and transmit it encrypted.

After you've done this compile the perl code for the server and delete the history files, burn your notes..... kill the sys admins for your site¹

1. This isn't totally necessary, but if your gonna be thorough ;^)

--

Brother Frankus.

[suaveant]

Ok.. tell me how I can call it securely? Same problem, if it has a password, it is visible in perl script, and other people can write something to access the request daemon.
                - Ant

[frankus]

It's a daemon, root can run it, you can fire it up at run time,by adding it to rc.d.
Since root ran it you can store the DB settings in a file only root can access (you can use another user, it doesn't have to be root).

--

Brother Frankus.

[Sinister]

In that case would it not be use-full to use a tunnel to protect your data. Something like the C script you talked about opens an SSH tunnel to the localhost and throws the data in there, with perl script waiting on the other side waiting to munge... ??? 8-& Sinister greetings.

[suaveant]

That sounds like more work than what I am planning... and harder for general users to set up... and I'm not even sure it is more secure... or more robust.
                - Ant

[Sinister]

The work involved shouldn't be to hard. You'd only need a user which can only connect to and from localhost defined in your SSHD, with a key, so it can passwordless connect to localhost. The general user will never notice a thing if you do it right. Right?

Sinister greetings.