Skip to Content.
Sympa Menu

freetds - Re: [freetds] 0.91RC1

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Constantin Vasilyev <vasilyev AT ncbi.nlm.nih.gov>
  • To: "konrad AT payplus.com" <konrad AT payplus.com>
  • Cc: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] 0.91RC1
  • Date: Sun, 10 Apr 2011 09:23:16 -0400

That may depend on your Linux, I guess.
I used to hit situations when those are readable for public.

Also, on some Unixes, ps command can show other process' environment.
On Solaris, for example:

/usr/ucb/ps -wwwe <PID>

I believe that accepting password via stdin is safer and freebcp does that
already.
But, for even better protection, Kerberos seems like the way to go :^)



On Sun, Apr 10, 2011 at 09:04:59AM -0400, Konrad J Hambrick wrote:
>
> Constantin --
>
> Thanks for the feedback.
>
> Aren't the perms on '/proc/<PID>/environ set to 0400
> and ownership set to the user ?
>
> [konrad@kjhlt5 freetds]$ ps
>
> PID TTY TIME CMD
> 6649 pts/9 00:00:00 bash
> 24969 pts/9 00:00:00 ps
>
> [konrad@kjhlt5 freetds]$ ls -la /proc/6649/environ
>
> -r-------- 1 konrad users 0 Apr 10 08:00 /proc/6649/environ
>
> I am missing something here but what am I missing ?
>
> Thanks !
>
> -- kjh
>
>
> Constantin Vasilyev wrote, On 04/10/2011 07:56 AM:
> > Hi Konrad,
> >
> > Unfortunatelly, it is not really safe to keep database password in
> > environment variable.
> > On Linux, for example, one could inspect other's process environment
> > by looking into /proc/<PID>/environ
> >
> >
> > Constantin
> >
> >
> > On Sun, Apr 10, 2011 at 07:36:04AM -0400, Konrad J Hambrick wrote:
> >>
> >> I also found it useful (and more secure ps-wise) to
> >> avoid setting the HostName / UserName / PassWord on
> >> the commandline.
> >>
> >> freebcp.c already looks for a environment varb: FREEBCP
> >> so I added code to src/apps/freebcp.c to use FREEBCPHOST,
> >> FREEBCPUSER and FREEBCPPASS from the user's environment
> >> instead of from the commandline.
> >>
> >
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds




Archive powered by MHonArc 2.6.24.

Top of Page