Re: Local security on username and password include file...(OCILogon)

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 2 Aug 2000, Serkan AKCIN wrote: > Hi, > > Yesterday, Php worked and a simple code can query the oracle database. > > OCILogon("scott","tiger","a.b.com"); > > worked. > > But this code was written in a oracle.inc file and has 744 permisson on > Linux. > > Anyone has an account on my machine can see the plain text file, > so my database's passwords is reachable by anyone on my linux box. > > grep Logon /var/lib/apache/htdocs/oracle.inc > > How can I secure my include files and let them executable by nobody from the > www. Set permissions to 740 and owner <you>:<grp of nobody>. That's not really a soultion as with another php script all the world will see these data. Best solution would be host and ident identification so you don't need password and username at all - that's possible with Postgres but I GUESS Oracle doesn't support it. If someone knows how to solve that problem using the Oracle wrapper let us know! CIAOii & so on... Thomas Scholz - -- RUM - Computing Center | Tel/Fax: +49 621 4014783 / 4014786 University of Mannheim | Office: +49 621 1813087 / 1813094 Certificate Authority | http://ca.uni-mannheim.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.1 (GNU/Linux) Comment: This signature has been made using PGPenvelope iQEVAwUBOYfPwxogRQP0UDktAQEnoQf/ZKC+O2jFxVSFmYUEpS45+DXobeFcW8CX JglxgyRPTCtTiC9qitvjvhBm84W+MS6Hf/3blzlZE06b2I8yKIvJ89bTIGipAIHx ECssi6u+FkxrBTrTkYa+/ZOkKFUzlBHMecdPobTsWrvKy7y7wLdZpsXAGf2sN242 QW+GxwCgl2ZJXBrGdP4a5uSyMGcJijRWIezWeRHZ63v0lDhwE+ZCap1wIvinw7tE AdO6IsWf5d0ptrFbdZIvwjFFliQ4WRNClJlNx7aluHwmbpUvGlI04sppUJMmeus2 W40h50tnQlx4Mog5mpPKlenZjKbIAS63VAd8nLklQGgx/XduLPZ33Q== =gU/o -----END PGP SIGNATURE-----