[pca] Account security settings

[French, David]

Create a dummy MOS account.  All you need is an email address.  So if you are a CSI admin, create a new account with an email address that goes to you.  Approve it, then add it to all of the proper CSI(s) for the support you need.   Once you have done that, use that account.  That is what I do here.

                --Dave

From: pca-bounces at lists.univie.ac.at [mailto:pca-bounces at lists.univie.ac.at] On Behalf Of Fred
Sent: Monday, May 09, 2011 9:48 AM
To: PCA (Patch Check Advanced) Discussion
Subject: [pca] Account security settings

I'm looking at setting up a pca proxy. On the client side, I have the config file referencing the webserver CGI for patches, xref file and pcafile. It's all working great.

On the server side, my pca-proxy.conf specifies where patches are cached, as well as a wgetproxy necessary for external access, and for now, it's using my MOS account. But this needs to change. My concern is regarding the MOS username and password, and where to specify it. The patching process will be used by many sysadmins, all of whom have their own MOS accounts (all licensed under the corporate CSI).

Ideally, I would like the sysadmin running the pca client to use the -a argument so that he/she is prompted for the MOS credentials interactively, but doing this doesn't seem to send the credentials to the proxy server. Rather, the client tries the proxy and it returns a 401 unauthorized error. The client then proceeds to authenticate directly against getupdates.oracle.com<http://getupdates.oracle.com>. In my environment, hosts don't have access to the big band Internet, so these attempts will fail.

So I'm resigned to think that I must have an MOS account user and passwd configured within the /etc/pca-proxy.conf file on the server side. All out admins have access to the servers. so the problem here is I don't think I'll get someone to volunteer to have their MOS account's password written in cleartext on the proxy host's filesystem.

What other options do I have?

--
Fred Chagnon
fchagnon at gmail.com<mailto:fchagnon at gmail.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20110509/88584499/attachment.html>