Re: PHP Oracle Authentication using UNIX user account

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



A couple notes / assumptions ..

(1) The web server is on a different machine then database
(2) The DB is not allowing remote OS authentication and only local OS 
authentication

If these are not true then some of my comments will be invalid

(1) The above config will not work as the web-to-db conn is not 
authenticated locally
(2) If remote OS auth is allow that is more of a security risk .. (can be 
mitigated)
(3) If the php files are secured on the server that mitigates risk
(4) Network traffic can be encrypted to prevent passwords being sent in 
plain text
        But if network is compromised all non-secure traffic is 
compromised (ftp/telnet/etc)

My solution
(1) No remote OS Auth
(2) Trust network
(3) I am only person that has access to web server (Web/DB/OS admin)
(4) Use a 'generic' account for general web access that only has the 
following privs
        - CREATE SESSION
        - SELECT on tables needed (via ROLE or direct as required)
(5) If a user needs to modify data allow a method for them to be prompted 
for username/password for database connection

==================================================
If the web server & db server are the same box then local OS auth would be 
fine.  I have not done this before since I like to separate my resources 
for High Avail reasons.  I am now intrigued and will research it.


Roy A. Jones 
US Pharma Database Administration 
GlaxoSmithKline Inc. US Pharma IT, Shared Services 
Email: roy.a.jones@xxxxxxx 




"Ben Gill" <Ben.Gill@xxxxxxxxxxxxxx> 
04-Oct-2004 10:30
 
To
php-db@xxxxxxxxxxxxx
cc

Subject
 PHP Oracle Authentication using UNIX user account






Hi,

 

My DBA's preferred authentication method is to set up a UNIX user
account (i.e. userA) and let them login without using plaintext password
authentication, ie. The user has to be logged in, they can then run (for
example) sqlplus /  and that will log them into the correct database.

 

This is to prevent having to specify a username / password in a PHP
script (or a config file that gets loaded).  If the username / password
is visible in the script, then someone can login and start making manual
edits to the data using sql commands.

 

To implement this, I have ensured my apache instance is running as
'userA' and I have tried all sorts of combinations of things username =
"" password = "", username = "/" password = "", username="/" password
="/" etc.. to get this working (It works fine from the command line) but
the OCILogon function requires a username and a password, so is not
happy.

 

One solution to this is that the DBA opens up the DB to plaintext
authentication, I store the username / password in a config file with
read only permissions (only for the owner, userA), and then only someone
who knows userA's password can login and view this config file.  But
that does not fit in with the way my DBA wants me to authenticate.

 

Has anyone got a solution for this?

 

Regards



[Index of Archives]     [PHP Home]     [PHP Users]     [Postgresql Discussion]     [Kernel Newbies]     [Postgresql]     [Yosemite News]

  Powered by Linux