removed

navthoc · Post by **navthoc** » Mon Feb 18, 2013 11:49 pm

removed

ray.wurlod · Post by **ray.wurlod** » Tue Feb 19, 2013 1:31 am

Presumably this utility does not work with passwords encrypted strongly using the encrypt.sh (encrypt.bat) utility?

Cranie · Post by **Cranie** » Tue Feb 19, 2013 5:11 am

Easiest way to "recover" a password is to stick a basic routine / before call to write the password parameter to the log file. (i.e. no special job / tool required).

DS has to decrypt it for passing to external stages, so it is only secure before run / passing to DS and not while running. Which is to be expected.

pandeesh · Post by **pandeesh** » Tue Feb 19, 2013 5:14 am

just curious, whether this is an IBM supported utility or unauthorized one?

chulett · Post by **chulett** » Tue Feb 19, 2013 7:48 am

There's nothing "supported" about it.

ray.wurlod · Post by **ray.wurlod** » Tue Feb 19, 2013 4:08 pm

In fact it almost certainly breaches the licence conditions of the author's Information Server installation (the part about reverse engineering).

I make that statement with no knowledge whatsoever of the tool.

navthoc · Post by **navthoc** » Tue Feb 19, 2013 4:19 pm

removed

ray.wurlod · Post by **ray.wurlod** » Tue Feb 19, 2013 4:22 pm

That will be interesting to see. AES-128 encryption should be impossible to break in a reasonable amount of time using the kind of hardware that most Information Server sites use.

navthoc · Post by **navthoc** » Mon Feb 25, 2013 4:47 pm

Looks like this tool is useful for some users. Re-posting the link.

BI-RMA · Post by **BI-RMA** » Tue Feb 26, 2013 8:42 am

Cranie wrote:Easiest way to "recover" a password is to stick a basic routine / before call to write the password parameter to the log file. (i.e. no special job / tool required).

This, indeed, is a serious security threat within DataStage and has been adressed at IBM a number of times already. It should not be possible to print encrypted - or rather decrypted - variables to the log. And it should not be too difficult to disallow this by changing the way DataStage-Basic handles variables of this type, especially in functions like DSLogInfo.

rameshrr3 · Post by **rameshrr3** » Thu Mar 07, 2013 12:52 pm

FYI : This security 'hole' has been fixed in Datastage 8.7 .
You can no longer echo encrypted passwords to the job log using a Before after job subroutine that calls the password-storing Job Parameter/Env Variable.

Im not sure if the 'utility' mentioned is of much use with 8.7 and above. LOL