I wrote the following as a quick script to find all files on the system
that contain any hard coded passwords for our database. For testing
purposes I used a file called testing123 in my find string, so as not to
search the entire directory tree for each test. The problem I'm having
lies in the while loop of my search subroutine. If I use a for loop to
iterate over all the passwords for each line of the input file, $_ is
overwritten with a numeric value before the matching can take place, so
I can't match the line I'm reading in from the file. If I get rid of
the for loop and use a counter like $count to iterate through my array,
the file I'm reading often has more lines then the array, so the looping
gets messy, having to reset the counter each time through the array for
each line in the file, and I can't use shift of course, because I need
to iterate through the array multiple times. So I'm hoping maybe
someone might know a more elegant solution to my problem?
#!/usr/bin/perl -w
# Author: Jason Wozniak
# Purpose: To find any hard coded passwords in shell scripts, so they
can be changed.
use File::Finder;
my $prod_pass_file = "/u01/app/oracle/orausers.prod";
my $test_pass_file = "/u01/app/oracle/orausers.test";
my $tmpfile = "/u01/app/oracle/hdpjfw_scripts/tempfile.tmp";
my $user;
my $pass;
my $newline;
my $count = 0;
my @passwords;
print "This program will search for passwords in all regular text files
in the directory specified\n";
print "for all passwords listed in either $prod_pass_file or
$test_pass_file\n";
print "depending on the database specified\n";
print "Enter a directory to search\n";
chomp(my $search_dir = <STDIN>);
my @file_list = File::Finder->name('testing123')->in($search_dir);
#foreach (@file_list) {
#my $vartest = shift(@file_list);
#print "my file list is $vartest\n";
#}
print "Enter Database SID\n";
chomp(my $database = <STDIN>);
my $passfile =
($database eq "P01") ? $prod_pass_file :
($database eq "R01") ? $prod_pass_file :
($database eq "T01") ? $test_pass_file :
($database eq "X01") ? $prod_pass_file :
($database eq "D01") ? $test_pass_file : "Invalid";
if ($passfile eq "Invalid") {
print "Invalid database SID\n";
exit;
}
else {
open (PASSFILE, "<$passfile")
or die "Could not open $passfile: $!\n";
}
while (<PASSFILE>) {
($user, $pass, $newline) = split( /:/, $_);
$passwords[$count] = $pass;
$count++;
}
open (TMPFILE, ">$tmpfile")
or die "Could not open temporary file: $!\n";
foreach $file_list (@file_list) {
&search();
}
close TMPFILE;
sub search {
my $file = shift(@file_list);
open (FILE, "<$file")
or die "Could not read $file: $!\n";
print "$file opened\n";
while (<FILE>) {
for (0..$#passwords) {
if (/$passwords[$_]/) {
print "Match found!\n";
print TMPFILE $file
or die "Could not write to file: $!\n";
}
}
}
}
Jason Wozniak
Systems Administrator,
Oracle DBA
Henkels & McCoy
985 Jolly Road
Blue Bell PA, 19422
