Skip to Content.
Sympa Menu

freetds - Re: [freetds] hiding username / password info from ps

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "James K. Lowden" <jklowden AT freetds.org>
  • To: freetds AT lists.ibiblio.org
  • Subject: Re: [freetds] hiding username / password info from ps
  • Date: Sat, 9 Apr 2011 17:47:23 -0400

On Sat, 9 Apr 2011 16:52:37 -0400
a g <mewalig AT gmail.com> wrote:

> I have googled around and haven't found a better solution to this
> security issue than these two approaches. I would like to submit this
> change to be included in the "official" freebcp code. thoughts?

I'll tell you what I did, which is more flexible, not least because it
works with all such utilities.

But first, a word from our sponsors:

$ ./configure --help | grep krb
--enable-krb5[=LIB] enable Kerberos support

Get your sysadmin to wire up the machine with Kerberos, and sleep
sounder. (If it helps, tell him it will glow a cool blue under
the machine between 2 and 3 in the morning. Don't be surprised if he
doesn't believe you, though.)

In the Time Before Kerberos, I kept a magic
program /usr/local/bin/password that took a hostname and username as
arguments and printed the password on standard output.

To use e.g. bsqldb:

bsqldb -S server -U $USER -P$(password server $USER)

More than ps(1), it solves recording passwords in logfiles.

To do something more similar to what you had in mind, without reading
the password from anywhere, your script might look like:

#! /bin/sh
if [ "$1" ]
then
echo $1 > $(HOME}/.password.tmp
chmod 600 $(HOME}/.password.tmp
else
cat $(HOME}/.password.tmp
rm $(HOME}/.password.tmp
fi

Then you can say:

password "mypassword"; \
bsqldb -S server -U $USER -P$(password)

If the few milliseconds the password spends on disk troubles you, think
about your shell history file. If that bothers you, someone on this
list will doubtless suggest Kerberos.

HTH.

--jkl




Archive powered by MHonArc 2.6.24.

Top of Page