Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I sometimes do echo "secret" | mysql -u root -p .... Now I'm concerend about security here: can someone listing all processes see the password?

To check I tried with echo "test" | sleep 1000 and the echo command with the secret was not visible in the output of "ps aux". So I assume it's secure - but can a security expert confirm it please? :)

share|improve this question
    
Can't see it in a process list when running an endless loop. Good question. –  Tim Dec 22 '11 at 18:42
1  
In addition, don't forget that whatever you type on most shells will be stored in a history file somewhere (like .history). –  Alexander Bird Jan 4 '12 at 5:56
add comment

3 Answers 3

up vote 11 down vote accepted

The answer to this depends on which shell you are using. Many shells have echo as a builtin command meaning that it does not spawn a separate process and hence will not show up in a process listing. However, if you type /bin/echo or ./echo or if you disable the builtins with the enable -n echo command, then the shell will not use its builtin command and will use the binary version instead. This will show up in a process listing.

If you are using the binary rather than the shell builtin, the echo command will show up for as long as it takes to move the data into the other process's STDIN buffer. This buffer has a finite size so if there is more data than will fit in the buffer, the echo command will have to hang around for a while until the other process can read some of the data out of the buffer. For most cases (such as the two examples you gave above) this time period will be microseconds. If you happen to be pasting a 20MB SQL dump into MySQL using echo, this could be longer. No matter how short the time is, if you are using the binary instead of the shell builtin and someone happens to get the timing just right, they will be able to see the process in the process list.

You can avoid this by putting the secret data into a file (with appropriate permissions) and using the file as STDIN like this:

mysql -u root -p < file_with_secret.sql
share|improve this answer
    
Thank you very much for this very detailed answer! :) –  gucki Dec 22 '11 at 19:26
4  
Keep in mind that by typing the password on the command line like that it is most likely being saved into your shell's history file, so it is worth checking the history file permission and contents. –  aculich Dec 22 '11 at 19:44
add comment

For the mysql case ~/.my.cnf can be used to store secrets, ie

[client]
user = DBUSERNAME
password = DBPASSWORD
host = DBSERVER

[mysql]
database = DBNAME
share|improve this answer
add comment

Just use

mysql -uroot -p

and hit enter. You will then be prompted for the password and it will not be visible in either the process list or the history files.

share|improve this answer
    
Data accepted on STDIN by MySQL is the command(s) to be run once you have logged in. The "secret" in the question is not the password. –  Ladadadada Dec 22 '11 at 19:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.