Hello all ,
I looked up this site for solutions to hide login info from ps -ef | grep like using a seperate file and store the password in that especially for oracle sqlplus scripts.
I just got this thought , But dont know how to implement this in UNIX.
Is there a way to revoke access from "ps" command so that the user may not be even able to use ps command.
This is a non oracle unix user.
How would I do this in HP UX ?
Thanx
Please anyone any answers.
Thanx
Please follow forum rules and do not bump up posts.
sqlplus<<!
user/pass
<sql_statement>;
@<script_name>
...
whatever
!
Sorry I am new to this forum. What does bump up posts mean ?
BTW Radoulov Thanx for your response. But my questions was
""
Is there a way to revoke access from "ps" command so that the user may not be even able to use ps command. ""
You can just go into /bin and adjust the permissions for the ps utility.
Thanx for you response piper28.
But how to revoke execute from /bin/ps only from "a" specific user ?
Thats all I have been asking for. Say user TESTUSER should not be able to use ps command
$ls -lrt ps
-r-xr-xr-x 1 bin sys 94468 May 30 2005 ps
How about if you wrote a script named ps to replace the ps program (which you renamed to, say, ps.bin or something.
Then in the script you say if not xxx user run ps.bin otherwise do nothing or whatever would be better.
Thanx GSalisbury. I am still wondering is there no simple straighforward way to do this.
I am new to UNIX. I am sure there must be a way thru some os permission setting.
I see this is such a basic requirement. WHy would we even need to write a script to do this.
Dont you think the OS should be able to handle this.
Its like in a Database I can easily revoke permissions from a procedure from a specific USER.
Would the OS not have such a provision for a specific user ?
Thanx
Well... not wanting to get drawn into a big debate as others may have more intimate knowledge... but that's pretty much the way it is.
Generally speaking if "it's on the path" and executable to the user than it runs. There is no inherent user/command "matrix".
"nix" provides the flexibility for you to implement the by user controls if you wish a number of different ways.
You could use the rename and intercepting script method.
You could alter the user's path (at login) so they can't see it or what they see is something different and/or in a different place (a variation on the intercepting script method).
As root:
. make a directory:
mkdir -m755 /.bin_trap
. make an empty file named ps in that directory:
cp /dev/null /.bin_trap/ps
or a non-empty file to do whatever is good for you
. make that file executable:
chmod 555 /.bin_trap/ps
Then in the user's login script set the path variable to have your /.bin_trap at the beginning of the list so your ps is found first. The syntax for doing that varies depending upon the shell in use.
Of course, a reasonably astute user would eventually be able to get around that but, perhaps, you're not concerned there.
Geo.
I feel your asking the wrong question....
you are passing a password into a command/script?
then you can see the password in the full commandline using ps -ef
GSalisbury,
Thanx again for your valuable inputs.
I will try the .bin_trap method which you suggested.
I wish unix was a bit flexible.
robsonde,
I hear you but I am asking the apprpriate question. This requirement could be generic for any utility not just ps.
Thanx for your inputs. I agree sometimes we do ask the wrong question to because we think there lies the solution 
radoulov post shows how not to place the Oracle username and password on the command line ... which makes it not visible in "ps".
To stop "ps" for a particular user, try alias in their profile. Ensure that root owns the profile to stop the user making changes.
alias ps='false'
try
chmod 554 /bin/ps
Provided u have root privledges for this command
Unix and GNU/Linux are extremely flexible. There are a many many ways of achieving what you want from finegrained control using SELinux and ACLs to simple methods such as aliasing. Depends on what you want to achieve and your level of expertise.
Fpmurphy,
Thank you . You mentioned about ACLS and SELINUX .Can you please point me to some Documentation. So that I can lean how to fish.
I am a DBA by profession, So I have some knowledge of UNIX but not to an expert level.
I need to do it on HPUX but I am open to learn how it may be done on LINUX.
BTW also Thank you all for responding to this thread. Such useful tips and responses and knowledge sharing is soo important. This is indeed a great forum.
The simplest method is to use alias for ps. Then lock down profile.
This should give you info on SeLinux and ACL
Let me google that for you
forbid it for this particular user via acl set to this command
Rgds
zxmaus