Enhancing Security - Expert Oracle and Java Security - page 274

"You may enter APPVER password on command line." );
The intention at this point is that you would call OracleJavaSecure once with your intended appver
password, then copy the encoded connection string into the code of OracleJavaSecure.java in the
setAppVerConnection() method.
Hard Coding the Encoded APPVER Connection String
We will modify the setAppVerConnection() method by hard-coding our encoded appver connection
string, and by calling the OJSC.y() method to decode it when calling setConnection() . (See Listing 11-9.)
By decoding the connection string at the last moment when calling setConnection() , and not setting a
member variable to the decoded value, we minimize the attack profile and duration when a hacker may
view the clear-text password.
Listing 11-9. Hard-Coding the Encoded appver Connection String
String prime =
"030a42105f1b3311133a0048370707005f020419190b524215151b1c13411b0a601f0a17201c18391606795e5b5c5
4591b1b0c02"
setConnection( OJSC.y( prime ) );
appVerConn = conn;
Create an Oracle Client Wallet
There is a standard way for obfuscating/encrypting passwords stored on the client computer that is
provided in the Oracle client. It is called the secure external password store, but it is better known as the
wallet. Because wallets can be used on both the server and the client, we should call this the client wallet.
I hope to give you a good overview of Oracle client wallets, but we will not end up using them in our
security infrastructure.
The first thing about client wallets that you should know is that, by default, they must exist in each
OS user's home directory. Client wallets are considered to be personal stores for Oracle credentials. This
is quite the opposite of what I'd like to achieve, which is no Oracle user credentials on the desktop. And
now, if we mix our appver user password in with potentially other additional user passwords, there is no
practical way we can centrally manage it, e.g., update the password.
The second thing you should know about Oracle client wallets is that they can be copied and used
by anyone who possesses them. I can create a client wallet and put the appver password in it, then copy
it to every computer user' s home directory, and they can all use the wallet to log in as appver . This might
appear to be a way to do centralized distribution of password updates. Perhaps, but it is also
problematic. These wallet files can be given away like candy, e-mailed to buddies, stolen from backup
tape—whatever. That is not protection. The assumption is that the OS is providing access control to user
home directories and can protect the files.
The third thing to know is that client wallets are protected from modification and viewing by a
wallet password, but there is no authentication required in order to use the client wallet if you have the
files. If we place our appver password in a client wallet, then literally anyone who has the wallet files can
connect to Oracle database as appver .