From: Daniel Berger <djberge@...>
Date: 2002-11-06T04:49:46+09:00
Subject: Re: Ruby encoder

Carl Youngblood wrote:

> Question:  Has anyone developed a Ruby encoder that would allow me to
> encrypt my Ruby code to avoid revealing database passwords or other such
> things to a potential hacker?
>
> Thanks,
> Carl

Carl,

Even if you could encrypt your database passwords, at some point you have
to decrypt them in order to make a database connection.  That means if I
have access to your script, I can figure out your password via a debugger
or whatever.

The best you can really do is obfuscation.  Michael has added my dbrc
module to the DBI distro, which is specifically designed for this.  It
provides an interface to a file called ".dbrc", moduled somewhat on Perl's
Net::Netrc module.  It's good for preventing "over your shoulder" syndrome.

Your best security, really, is permissions. :)

Regards,

Dan

------

Description

This is a supplement to the dbi module, allowing you to avoid hard-coding
passwords in your programs that make database connections.

Synopsis

require 'dbi/dbrc'

dbrc = DBRC.new("mydb")

or

dbrc = DBRC.new("mydb","someUser")

puts dbrc.db
puts dbrc.user
puts dbrc.driver
puts dbrc.timeout
puts dbrc.max_reconn
puts dbrc.interval
puts dbrc.dsn

dbh = DBI.connect(dbrc.dsn,dbrc.user,dbrc.password)

Requirements

The 'etc' module

Designed for *nix systems.  Untested on Windows.

Notes on the .dbrc file

This module relies on a file in your home directory called ".dbrc", and it
is meant to be analogous to the ".netrc" file used by programs such as
telnet.
The .dbrc file has several conditions that must be met by the module or it
will fail:

1) Permissions must be set to 600.
2) Must be owned by the current user
3) Must be in the following space-separated format:

   <database> <user> <password> <driver> <timeout> <maximum reconnects>
<interval>

e.g. mydb     dan    mypass     oracle   10        2                    30

You may include comments in the .dbrc file by starting the line with a "#"
symbol

Class Methods

new(db,?user?)

      The constructor takes one or two arguments. The first argument is the
database name. This *must* be provided. If only the database name is
passed, the
      module will look for the first database entry in the .dbrc file that
matches.

      The second argument, a user name, is optional. If it is passed, the
module will look for the first entry in the .dbrc file where both the
database *and* user
      name match.

Instance Methods

<database>

      The name of the database. Note that the same entry can appear more
than once, presumably because you have multiple user id's for the same
database.

<user>

      A valid user name for that database.

<password>

      The password for that user.

<driver>

      The driver type for that database (Oracle, MySql, etc).

<timeout>

      The timeout period for a connection before the attempt is dropped.

<maximum reconnects>

      The maximum number of reconnect attempts that should be made for the
the database. Presumablly, you would use this with a "retry" within a
rescue block.

<interval>

      The number of seconds to wait before attempting to reconnect to the
database again should a network/database glitch occur.

<dsn>

      Returns a string in "dbi:<driver>:<database>" format.

Summary

These "methods" don't really do anything.  They're simply meant as a
convenience
mechanism for you dbi connections, plus a little bit of obfuscation (for
passwords).