topic Re: How to encrypt password on log? in SAS Procedures

How to encrypt password on log?

Gil_ — Mon, 04 Jun 2018 13:50:36 GMT

I need to encrypt the pw ln my log
I have this now

Options symbolgen;
%include "h:\passwords.sas";
Proc sql;
Connect to Oracle (user=&user password=&ps path=&db);
Create table table as select * from connection to Oracle

I need the log to show xxxxx for passwords

Re: How to encrypt password on log?

Kurt_Bremser — Mon, 04 Jun 2018 13:55:49 GMT

Have you seen this:

https://blogs.sas.com/content/sasdummy/2010/11/23/five-strategies-to-eliminate-passwords-from-your-sas-programs/

Re: How to encrypt password on log?

Tom — Mon, 04 Jun 2018 14:14:51 GMT

Turn OFF symbolgen for one thing.

It you are running the CONNECT statement inside a macro then also turn off MPRINT (and probably also the older obscure MACROGEN option).

Re: How to encrypt password on log?

Sven111 — Mon, 04 Jun 2018 16:34:29 GMT

I've found PROC PWENCODE is the most bullet-proof method, although it's largely security by obscurity. If all you need is to prevent the plain-text password from being available to people snooping around your files it works well enough though. Especially if you use that password for other stuff (which is also far from ideal, but a different conversation).

Definitely use method sas004 or sas005 if available on your SAS version though.

proc pwencode 
    in='mypassword' 
    method=sas005;
run;

Re: How to encrypt password on log?

Gil_ — Mon, 04 Jun 2018 20:42:34 GMT

Hi Sven
I want to use your example this to connect Proc sql;
Connect to Oracle (user=&user password=&ps path=&db);
Create table table as select * from connection to Oracl
How do I refer
proc pwencode in='mypassword' method=sas005; run
; to connect?

Re: How to encrypt password on log?

SASKiwi — Mon, 04 Jun 2018 21:18:03 GMT

PWENCODE will write the encoded password to the SAS log. You then copy the password string, including the sas005 on the front into your CONNECT statement: Connect to Oracle (user=&user password='sas005MyEncodedPassword' path=&db).

Re: How to encrypt password on log?

Sven111 — Tue, 05 Jun 2018 00:08:25 GMT

@SASKiwi is correct, you basically just run this code:

proc pwencode 
    in='mypassword' 
    method=sas005;
run;

Look in the log file for the results, which when I ran it resulted in (let's say)

'{SAS005}D03BE345341DB5A0A850BD0ABBD3BB49E8711BFF91749877FE1'

Then you'd copy that full text above into your connect string as @SASKiwi showed:

Connect to Oracle (user=MyUserName

PASS='{SAS005}D03BE345341DB5A0A850BD0ABBD3BB49E8711BFF91749877FE1' 

PATH=MY_ORACLE_DB_NAME

SCHEMA=MySchema)

You can also use that password in a LIBNAME connection to Oracle, which I find much more convenient since you can then use it for both implicit and explicit SQL passthrough statements.

LIBNAME OracSAS ORACLE 
USER=MyUserName  

PASS='{SAS005}D03BE345341DB5A0A850BD0ABBD3BB49E8711BFF91749877FE1'

PATH= My_Oracle_DB_Name

SCHEMA=MySchema;



PROC SQL;

    /* Implicit SQL-Passthrough */

    SELECT *

    FROM   OracSAS.TableName;



    /* Explicit SQL-Passthrough */

    CONNECT USING OracSAS AS OracDB;

    SELECT *

    FROM CONNECTION TO OracDB (SELECT * FROM TableName);

    DISCONNECT FROM OracDB;

;QUIT;