I sometimes do echo "secret" | mysql -u root -p .... Now I'm concerend about security here: can someone listing all processes see the password?

To check I tried with echo "test" | sleep 1000 and the echo command with the secret was not visible in the output of "ps aux". So I assume it's secure - but can a security expert confirm it please? :)

  • Can't see it in a process list when running an endless loop. Good question. – Tim Dec 22 '11 at 18:42
  • 1
    In addition, don't forget that whatever you type on most shells will be stored in a history file somewhere (like .history). – Alexander Bird Jan 4 '12 at 5:56

The answer to this depends on which shell you are using. Many shells have echo as a builtin command meaning that it does not spawn a separate process and hence will not show up in a process listing. However, if you type /bin/echo or ./echo or if you disable the builtins with the enable -n echo command, then the shell will not use its builtin command and will use the binary version instead. This will show up in a process listing.

If you are using the binary rather than the shell builtin, the echo command will show up for as long as it takes to move the data into the other process's STDIN buffer. This buffer has a finite size so if there is more data than will fit in the buffer, the echo command will have to hang around for a while until the other process can read some of the data out of the buffer. For most cases (such as the two examples you gave above) this time period will be microseconds. If you happen to be pasting a 20MB SQL dump into MySQL using echo, this could be longer. No matter how short the time is, if you are using the binary instead of the shell builtin and someone happens to get the timing just right, they will be able to see the process in the process list.

You can avoid this by putting the secret data into a file (with appropriate permissions) and using the file as STDIN like this:

mysql -u root -p < file_with_secret.sql
  • 5
    Keep in mind that by typing the password on the command line like that it is most likely being saved into your shell's history file, so it is worth checking the history file permission and contents. – aculich Dec 22 '11 at 19:44

For the mysql case ~/.my.cnf can be used to store secrets, ie

password = DBPASSWORD

database = DBNAME

Just use

mysql -uroot -p

and hit enter. You will then be prompted for the password and it will not be visible in either the process list or the history files.

  • Data accepted on STDIN by MySQL is the command(s) to be run once you have logged in. The "secret" in the question is not the password. – Ladadadada Dec 22 '11 at 19:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.