Re: [R] readline() for passwords?

From: Dalphin, Mark <mdalphin_at_amgen.com>
Date: Thu 16 Feb 2006 - 09:36:40 EST


I don't like to have my password exposed by typing at all. I also don't like to enter it each time that I wish to open a database (or when I run scripts automatically across a Linux cluster). My solution has been to keep a file in my HOME directory containing the username and password for the databases. This file has read and write permission set so only I (and root) can read it; this is something of a security hole, but it is the best I have come up with so far.

I then wrap my dbConnect() or in your case, odbcConnect(), in a function that picks up the information. I've included my function below.

While I use this function often, I have not tested some of it. My files for the databases all contain one username and one password. Multiple names and passwords have not been tested.

Mark Dalphin

openDB <- function(dbname, user=Sys.getenv('USER'), dbg=FALSE) {   if(length(grep('ROracle', search())) == 0)     stop("Libraries not loaded: library(DBI) and library(ROracle)")

  path <- paste(Sys.getenv('HOME'), paste('.', dbname, sep=''), sep='/')   if(dbg) cat("Reading file:", path, "\n")

  input <- scan(file=path, what='character', quiet=TRUE)   if(dbg) cat("Found", length(input), "items in file\n")

## Generally, 'input' will contain two items: username and password.
## Assume it will always contain pairs:
## username \t password \n username \t password \n
## Match the username to 'user' and then pickup the password as the next
## item.

  i.1 <- seq(1, length(input), by=2)
  usr <- input[i.1]
  psd <- input[i.1 + 1]

  inx <- usr==user
  if(dbg) cat("\tUser=", usr[inx], "\n")

  if(sum(inx) < 1)
    stop(paste("User, '", user, "', not present in file: ", path, sep=''))
  if(sum(inx) > 1) stop("Unable to locate unique USER in input")
  if(dbg) cat("\tPass=", psd[inx], "\n")   return(dbConnect('Oracle', dbname=dbname, user=usr[inx], pass=psd[inx])) }

-----Original Message-----
From: r-help-bounces@stat.math.ethz.ch
[mailto:r-help-bounces@stat.math.ethz.ch]On Behalf Of Ulf Mehlig Sent: Wednesday, February 15, 2006 1:22 PM To: r-help@stat.math.ethz.ch
Subject: [R] readline() for passwords?

Hello,

I am using RODBC to access a password-protected database. Is there a possibility to prevent that the password appears on the screen when issuing the odbcConnect() command? I thought of something like readline() without echo. I guess that a getpass()-based solution wouldn't work for ESS/Emacs, anyway, would it?

Thanks for your attention!
Ulf

R 2.2.1, i386-pc-linux-gnu

-- 
 Ulf Mehlig    <ulf.mehlig@gmx.net>

______________________________________________
R-help@stat.math.ethz.ch mailing list
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide!
http://www.R-project.org/posting-guide.html

______________________________________________
R-help@stat.math.ethz.ch mailing list
https://stat.ethz.ch/mailman/listinfo/r-help
PLEASE do read the posting guide! http://www.R-project.org/posting-guide.html
Received on Thu Feb 16 10:07:43 2006

This archive was generated by hypermail 2.1.8 : Thu 16 Feb 2006 - 16:34:49 EST