Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an account on a shared web host which allows me to work on the server via SSH. As I have some problems installing Magento using the web installer I switched to the commandline installation. The command to install looks something like this:

php -f install.php -- \
...
--db_host "dbhost" \
--db_name "dbname" \
--db_user "username" \
--db_pass "password" \
...
--admin_username "username" \
--admin_password "password" \
...

While the command is running (and its running for a few minutes), of course everybody else on that server can see the parameters (and passwords) by inspecting running processes (with ps aux for example). I was just wondering if its possible to hide that data in some way (e.g. with some kind of wrapper scripts/programs)?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Not easily. If you wrote a wrapper script that executed that command, that command will still appear in ps.

If you knew enough PHP you could open up that install.php, look for where it handles those user/pass flags and hardcode the values yourself (making sure the script has 700 perms so nobody else can read it), then you can run the command without needing the flags.

Assuming that their script doesn't try to guess how it's being run and react inappropriately, you could do something like this:

<?php
  unset($argv);
  $argv=array("install.php",
     "--db_host","dbhost",
     "--db_name","dbname",
     ...
     "--and_so_on","value"
     );
  include("install.php");
?>

as a new script (mode 700 again) and run it php newinstall.php. $argv is normally the array of command arguments (starting with the name of the command) so here you unset() the existing one and create a new one with all of the commandline options you need, then you include() install.php to make PHP execute that script (with the doctored $argv list to make install.php think it was executed with those options).

share|improve this answer
    
Nice wrapper idea. With minimal tweaking, it could work for just about any command-line installer. –  SmallClanger May 9 '11 at 12:58
    
Nice one, thanks. I wanted to avoid hacking around on the original script to get a general purpose solution for such situations. But modifying ARGV didn't come to my mind. Thanks! –  Mathias May 9 '11 at 16:20

A less technical approach (and I realise ultimately not an answer to your question!), but in situations like this, for ease I have in the past just used throwaway details and once installed, change them through the admin system/generated config files.

share|improve this answer
    
Yep, that's what I did now. –  Mathias May 9 '11 at 16:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.