Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As part of running a backup script for a linux server, I have commands like mysqldump within a bash script which contain the mysql root password, and certain ftp server passwords. Are these retrievable by a malicious user, from the server logs?

I know that while the script is being run, processes like mysqldump can be viewed with the command line parameters, on invoking a ps ax. Do these get logged to server logs? If so, how can I cleanup after script execution? Is it at all possible to avoid these issues altogether?

Addendum: My question is not specifically regarding mysqldump. There are other binaries like lftp and mysqldump that require passwords as an argument. I am aware that mysqldump accepts file inputs, as does lftp. However, is it possible to generically protect commands invoked in a bash script, which may contain sensitive information, from snooping?

share|improve this question
    
intresting scenario , +1 –  nsd Jun 9 '13 at 18:21
1  
This isn't an "exact" duplicate, but the Accepted Answer has the solution you're looking for. –  Chris S Jun 9 '13 at 18:31
    
I wasnt looking for a mysqldump specific solution. I am wondering how to secure passwords sent via bash scripts, from snooping. –  Droidzone Jun 10 '13 at 10:45

2 Answers 2

The history command will bring up a list of commands you have typed. In theory this data could be retrievable.

share|improve this answer

There is no generic solution for this. Tools must provide their own protection for sensitive data such as passwords. Usually, they can load credentials from a file which must be protected appropriately, like mysql with --defaults-file=. Command line arguments cannot be protected.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.