Home / server / Questions / 343559
Accepted
gucki
Asked: 2011-12-23 10:25:50 +0800 CST

piping a password and security

  • 772

I sometimes do echo "secret" | mysql -u root -p .... Now I'm concerend about security here: can someone listing all processes see the password?

To check I tried with echo "test" | sleep 1000 and the echo command with the secret was not visible in the output of "ps aux". So I assume it's secure - but can a security expert confirm it please? :)

security shell

5 Answers

  1. Best Answer

    The answer to this depends on which shell you are using. Many shells have echo as a builtin command meaning that it does not spawn a separate process and hence will not show up in a process listing. However, if you type /bin/echo or ./echo or if you disable the builtins with the enable -n echo command, then the shell will not use its builtin command and will use the binary version instead. This will show up in a process listing.

    If you are using the binary rather than the shell builtin, the echo command will show up for as long as it takes to move the data into the other process's STDIN buffer. This buffer has a finite size so if there is more data than will fit in the buffer, the echo command will have to hang around for a while until the other process can read some of the data out of the buffer. For most cases (such as the two examples you gave above) this time period will be microseconds. If you happen to be pasting a 20MB SQL dump into MySQL using echo, this could be longer. No matter how short the time is, if you are using the binary instead of the shell builtin and someone happens to get the timing just right, they will be able to see the process in the process list.

    You can avoid this by putting the secret data into a file (with appropriate permissions) and using the file as STDIN like this:

    mysql -u root -p < file_with_secret.sql
    • 13

  2. For the mysql case ~/.my.cnf can be used to store secrets, ie

    [client]
user = DBUSERNAME
password = DBPASSWORD
host = DBSERVER

[mysql]
database = DBNAME
    • 3

  3. Just use

    mysql -uroot -p

    and hit enter. You will then be prompted for the password and it will not be visible in either the process list or the history files.

    • 1

  4. passing passwords via command line arguments is always not recommended, try at least stdin or fifo, such as:

    mysql -p <<END
$password
END

    this way the $password will not be exposed to history or ps aux

    • 0

  5. If by "secure" you mean "not visible in the output of ps", then yes, it is secure. But don't forget that other processes that share the UID with the running mysql client (or those running with root privileges, obviously) can access its STDIN. To use your echo/sleep example:

    sh-5.1$ echo "test" | sleep 1000 &
[1] 3960020
sh-5.1$ cat /proc/3960020/fd/0
test

    The above is Linux specific, and relies on procfs.

    • 0