How to store Database Password encrypted in Perl script?

Question

I am a newbie in Perl scripting, and I am asked to write a script in Perl programming language to access Database and read a particular table to get one status value. In this script, I need to provide the Database connection details which include Password too. I want to store this password in an encrypted manner so that anyone reading the script should not identify the password. Also, the encrypted value should be able to be decrypted in the same script.

Can someone please suggest me how to achieve this?

Answer 1

You can't. This is literally impossible.

If the perl script needs to be able to provide the password, it needs to be able to decrypt the password. If it can decrypt the password, so can anyone who uses the script.

The closes you can get is to set up some sort of trusted-key authentication, like ssh uses. That's reliant on your database supporting it. But even then, your client has a private key that functions a lot like a password, that someone with access to the script can get access to the private key, and use that to authenticate themselves.

Answer 2

You can't keep something secret from someone by encrypting it and giving them both the encrypted data and the tools to decrypt it !

Let say your code looked something like this:

my $crypted = get_encrypted_password();
my $password = decrypt($crypted);
my $connection = connect_to_database($password);

Then it would be trivial for someone to edit that so it looked like:

my $crypted = get_encrypted_password();
my $password = decrypt($crypted);
print "The database password is: " . $password;

So that approach just won't work.

---

You need to put your restrictions in somewhere outside the control of the user.

This could be a matter of applying database-level permissions (eg granting only SELECT rights and rights to specific tables — depending on what you want to allow).

This could be a case where you would be better off writing a webservice to run between the database and the client software. The service could then do authn/authz and provide a very limited set of operations that the client could perform.