Encrypt or remove password in ora2pg-conf.json file
Closed this issue · 4 comments
ora2pg-conf.json file contains the system credentials for the Oracle database. It should be encrypted on the server
https://medium.com/@anned20/encrypting-files-with-nodejs-a54a0736a50a
Hide the config file in the project files listing
Users need a way to supply a encryption key. Ideally this would be transparent in non-production environments. Users who are trying out ora2pg or converting a development database with no sensitive information should not be forced to supply a key.
Update the http-config.js file to accept a the key as an environment variable or default a hard coded string:
- configFileEncryptionKey: process.env.ORA2PG_SECRET||'hardCodedInsecureKey123'
ORA2PG_SECRET can be set using a docker or kubernetes secret
Another option would be to encrypt the password in the JSON document rather than the complete file. The APIs could be modified to accept an encryption key parameter. It would be used to en/decrypt sensitive fields in the JSON doc. The UI would be extended to associate projects and encryption keys
Alternatively we could remove the password entry before writing the file.