6

Usually I connect to a database with R using JDBC/ODBC driver. A typical code would look like

library(RJDBC)
vDriver = JDBC(driverClass="com.vertica.jdbc.Driver", classPath="/home/Drivers/vertica-jdbc-7.0.1-0.jar")
vertica = dbConnect(vDriver, "jdbc:vertica://servername:5433/db", "username", "password")

I would like others to access the db using my credentials but I want to protect my username and password. So I plan save the above script as a "Connections.r" file and ask users to source this file.

source("/opt/mount1/Connections.r")

If I give execute only permission to Connections.r others cannot source the file

chmod 710 Connections.r

Only if I give read and execute permission R lets users to source it. If I give the read permission my credentials will be exposed. Is there anyways we could solve this by protecting user credentials?

5
  • I'm not sure if you can go beyond obfuscation. It might help if you provide more information why you don't create separate users for your clients.
    – bdecaf
    Commented Oct 21, 2014 at 9:18
  • Is this all done on one shared machine or is this code being deployed somewhere? What about basic shell environment variables?
    – Andy V
    Commented Oct 21, 2014 at 19:55
  • @bdecaf: The data is sensitive and I only want them to have read access. If I create separate user credentials they should be able to download the data on their local machine. Whole idea is to protect the database connectivity credentials so that they could read the data only from one server where this code is deployed.
    – Jana
    Commented Oct 21, 2014 at 20:34
  • @Visser: It's all done on one server. I have an R studio server setup for the users. I want users to login to this server and access the database by sourcing the above script but I need to protect the login credentials.
    – Jana
    Commented Oct 21, 2014 at 20:38
  • But you can set up your database that a user can only connect from a specified machine.
    – bdecaf
    Commented Oct 22, 2014 at 5:33

4 Answers 4

4
+25

Unless you were to deeply obfuscate your credentials by making an Rcpp function or package that does the initial JDBC connection (which won't be trivial) one of your only lighter obfuscation mechanisms is to store your credentials in a file and have your sourced R script read them from the file, use them in the call and them rm them from the environment right after that call. That will still expose them, but not directly.

One other way, since the users have their own logins to RStudio Server, is to use Hadley's new secure package (a few of us sec folks are running it through it's paces), add the user keys and have your credentials stored encrypted but have your sourced R script auto-decrypt them. You'll still need to do the rm of any variables you use since they'll be part of environment if you don't.

A final way, since you're giving them access to the data anyway, is to use a separate set of credentials (the way you phrased the question it seems you're using your credentials for this) that only work in read-only mode to the databases & tables required for these analyses. That way, it doesn't matter if the creds leak since there's nothing "bad" that can be done with them.

Ultimately, I'm as confused as to why you can't just setup the users with read only permissions on the database side? That's what role-based access controls are for. It's administrative work, but it's absolutely the right thing to do.

4
  • I don't have any admin rights to the database. I could only use my credentials to read/write to the db. At the same time I need to let a group of people to use a DEDICATED RStudio server,read the data from the db and analyze it. If I setup the users with read-only permission they could use their local machines to read the data and save it locally. I need to protect that.
    – Jana
    Commented Oct 28, 2014 at 15:38
  • Can you setup other infrastructure? You could use something like sqlrelay as a proxy and enforce restrictions that way (not sure if it does the restriction bit, but others do).
    – hrbrmstr
    Commented Oct 28, 2014 at 15:42
  • I see your point but in my case setting up another infrastructure for this issue will be considered as inefficient.
    – Jana
    Commented Oct 28, 2014 at 15:50
  • I get that your bosses don't want more infrastructure, but the alternative is an unsecure setup. Full stop.
    – Andy V
    Commented Oct 31, 2014 at 14:06
2

Do you want to give someone access, but not have them be able to see your credentials? That's not possible in this case. If my code can read a file, I can see everything in the file.

Make more accounts on the SQL server. Or make one guest account. But you're trying to solve the problem that account management solves.

1

Have the credentials sent as command arguments? Here's an example of how one would do that:

suppressPackageStartupMessages(library("argparse"))
# create parser object
parser <- ArgumentParser()
# specify our desired options
# by default ArgumentParser will add an help option
parser$add_argument("-v", "--verbose", action="store_true", default=TRUE,
 help="Print extra output [default]")
parser$add_argument("-q", "--quietly", action="store_false",
 dest="verbose", help="Print little output")
parser$add_argument("-c", "--count", type="integer", default=5,
 help="Number of random normals to generate [default %(default)s]",
 metavar="number")
parser$add_argument("--generator", default="rnorm",
 help = "Function to generate random deviates [default \"%(default)s\"]")
parser$add_argument("--mean", default=0, type="double", help="Mean if generator == \"rnorm\" [default %(default)s]")
parser$add_argument("--sd", default=1, type="double",
 metavar="standard deviation",
 help="Standard deviation if generator == \"rnorm\" [default %(default)s]")
# get command line options, if help option encountered print help and exit,
# otherwise if options not found on command line then set defaults,
args <- parser$parse_args()
# print some progress messages to stderr if "quietly" wasn't requested
if ( args$verbose ) {
 write("writing some verbose output to standard error...\n", stderr())
}
# do some operations based on user input
if( args$generator == "rnorm") {
 cat(paste(rnorm(args$count, mean=args$mean, sd=args$sd), collapse="\n"))
} else {
 cat(paste(do.call(args$generator, list(args$count)), collapse="\n"))
}
cat("\n")

Sample run (no parameters):

usage: example.R [-h] [-v] [-q] [-c number] [--generator GENERATOR] [--mean MEAN] [--sd standard deviation]
optional arguments:
 -h, --help show this help message and exit
 -v, --verbose Print extra output [default]
 -q, --quietly Print little output
 -c number, --count number
 Number of random normals to generate [default 5]
 --generator GENERATOR
 Function to generate random deviates [default "rnorm"]
 --mean MEAN Mean if generator == "rnorm" [default 0]
 --sd standard deviation
 Standard deviation if generator == "rnorm" [default 1]

The package was apparently inspired by the python package of the same name, so looking there may also be useful.

Looking at your code, I'd probably rewrite it as follows:

library(RJDBC)
library(argparse)
args <- ArgumentParser()
args$add_argument('--driver', dest='driver', default="com.vertica.jdbc.Driver")
args$add_argument('--classPath', dest='classPath', default="/home/Drivers/vertica-jdbc-7.0.1-0.jar")
args$add_argument('--url', dest='url', default="jdbc:vertica://servername:5433/db")
args$add_argument('--user', dest='user', default='username')
args$add_argument('--password', dest='password', default='password')
parser <- args$parse_args
vDriver <- JDBC(driverClass=parser$driver, parser$classPath)
vertica <- dbConnect(vDriver, parser$url, parser$user , parser$password)
# continue here
4
  • I don't think this will help me. The goal is to use single credential for all end users without them knowing the username and password. Even if I use 'argparse' option I need to give read access of this file to the end user. In that case they could still see the default username and password.
    – Jana
    Commented Oct 21, 2014 at 21:13
  • No, you don't. You merely require the password to be specified as an argument. If you need only give the user read-access, you can embed R and write a stored procedure to do what you want.
    – hd1
    Commented Oct 21, 2014 at 21:21
  • If I have to specify password as an argument I still have to share the password with the end user. Right? I would like to point out that R UDFs are out of my options. That is the main reason I'm using RJDBC connectivity. Also I tried running the code you mentioned above and I get this error "Error in parser$classPath : object of type 'closure' is not subsettable"
    – Jana
    Commented Oct 21, 2014 at 21:46
  • Hmm... My next suggestion is to use shiny to expose your data to the end-user in real time.
    – hd1
    Commented Oct 21, 2014 at 22:38
1

Jana, it seems odd that you are willing to let the users connect via R but not in any other way. How is that obscuring anything from them?

I don't understand why you would not be satisfied with a guest account that has specific SELECT-only access to certain tables (or even views)?

2
  • @MontesChemist: My main challenge is to protect the data being stored locally(outside a dedicated server) and at the same time I want a set of people to analyze it as well. Even if I assigned a guest account and shared the credentials with the group. They could use those credentials to 'read' the data using R/RJDBC and 'save' it locally on their systems.
    – Jana
    Commented Oct 28, 2014 at 15:44
  • I understand that you want to protect your data. What I don' understand is how protecting it (by some yet undiscovered mechanism in R) gives you any more protection than read-only access in PostgreSQL. That is, in order to analyze the data in R, do not people neeed to read it (into some vector(s) in R)? If so, how is that more secure than read-only (select) access in PostgreSQL? I'd really like to help here but I don't quite see a distinction yet... Commented Oct 29, 2014 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.