FreeTDS Development Group

["James K. Lowden" <jklowden AT freetds.org>]

On Sat, 9 Apr 2011 16:52:37 -0400
a g <mewalig AT gmail.com> wrote:

> I have googled around and haven't found a better solution to this
> security issue than these two approaches. I would like to submit this
> change to be included in the "official" freebcp code. thoughts?

I'll tell you what I did, which is more flexible, not least because it
works with all such utilities.  

But first, a word from our sponsors:  

        $ ./configure --help | grep krb
          --enable-krb5[=LIB]     enable Kerberos support

Get your sysadmin to wire up the machine with Kerberos, and sleep
sounder.  (If it helps, tell him it will glow a cool blue under
the machine between 2 and 3 in the morning.  Don't be surprised if he
doesn't believe you, though.)  

In the Time Before Kerberos, I kept a magic
program /usr/local/bin/password that took a hostname and username as
arguments and printed the password on standard output.  

To use e.g. bsqldb:

        bsqldb -S server -U $USER -P$(password server $USER)

More than ps(1), it solves recording passwords in logfiles.  

To do something more similar to what you had in mind, without reading
the password from anywhere, your script might look like:

        #! /bin/sh
        if [ "$1" ]
        then
                echo $1 > $(HOME}/.password.tmp
                chmod 600 $(HOME}/.password.tmp
        else 
                cat $(HOME}/.password.tmp
                rm  $(HOME}/.password.tmp
        fi

Then you can say:

        password "mypassword"; \
        bsqldb -S server -U $USER -P$(password)

If the few milliseconds the password spends on disk troubles you, think
about your shell history file.  If that bothers you, someone on this
list will doubtless suggest Kerberos.  

HTH.  

--jkl