Execute command stage with password

[seanc217]

Hi there,

I am trying to secure passwords as much as possible in the development of my jobs. I am attempting to run a sql script that I call from an execute command stage in a sequence.

In this stage I supply the command: sqlplus -s

Then I pass my connect information in the parameters section.

Everything works OK, but when I look in the log the password is shown decrypted. How can I prevent the log from showing the password parameter?

It is defined as an envrionment variable type encrypted.

TIA

[ray.wurlod]

Create a shell script that acts as a wrapper to sqlplus and picks up the password from an environment variable that you've set elsewhere earlier in the same process. You'll need a "here script" within the shell script to respond to the sqlplus "Password:" prompt.

[splayer]

What is a "here script"? Also, I would think that password "encrypted" means it won't show anywhere including the log.

[seanc217]

Would that be your best practice recomendation or is there a better way to handle passwords to databases in datastage and passing them to scripts?

Thanks for the help.

[chulett]

What is a "here script"? Also, I would think that password "encrypted" means it won't show anywhere including the log.

http://en.wikipedia.org/wiki/Heredoc

And "encrypted" doesn't mean "invisible".

[kumar_s]

sqlplus -s would use the silent mode of sqlplus. But the command and the parameter that you pass to sqlplus command need to be executed wihtout logging or atleast log with encrypted.
How are you executing the command.?
If you are trying with Before/After job, use ExecShSilent.

[seanc217]

I put this ticket into support, here's a good resolution.

Thanks for all the help.


Support for the directive "/NOLOG/" was added to the Execute Command stage to address this issue. Add that directive to the beginning of your "Parameters" property in the stage to suppress that logging.

[chulett]

Good to know! Thanks for posting that...