Skip to Content.
Sympa Menu

freetds - Re: [freetds] 0.91RC1

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Konrad J Hambrick <konrad AT payplus.com>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] 0.91RC1
  • Date: Sun, 10 Apr 2011 08:45:33 -0500



Constantin --

Yikes !

I did not know about the 'new' -P- commandline arg.

I'll look at putting that one to work.

Wouldn't: `echo PassWord |freebcp ...` still be visible via ps ?

I do see that there's 'new' code (since 0.62) that zero's the
optarg for the -P Arg which might (?should?) clear the same
from the process table.

I imagine that depends on the implementation of ps on the
particular OS as well.

I don't think I can effectively bzero() the environment varb
because it's inherited from the PPID so even if I did bzero()
the FREEBCPPASS Varb in the freebcp Process, it would still
exist in the Parent's /proc/<PID>/environ file.

Will take a look at using the -P- Arg instead of FREEBCPPASS.

And thanks again !

-- kjh


Constantin Vasilyev wrote, On 04/10/2011 08:23 AM:
That may depend on your Linux, I guess.
I used to hit situations when those are readable for public.

Also, on some Unixes, ps command can show other process' environment.
On Solaris, for example:

/usr/ucb/ps -wwwe<PID>

I believe that accepting password via stdin is safer and freebcp does that
already.
But, for even better protection, Kerberos seems like the way to go :^)



On Sun, Apr 10, 2011 at 09:04:59AM -0400, Konrad J Hambrick wrote:

Constantin --

Thanks for the feedback.

Aren't the perms on '/proc/<PID>/environ set to 0400
and ownership set to the user ?

[konrad@kjhlt5 freetds]$ ps

PID TTY TIME CMD
6649 pts/9 00:00:00 bash
24969 pts/9 00:00:00 ps

[konrad@kjhlt5 freetds]$ ls -la /proc/6649/environ

-r-------- 1 konrad users 0 Apr 10 08:00 /proc/6649/environ

I am missing something here but what am I missing ?

Thanks !

-- kjh


Constantin Vasilyev wrote, On 04/10/2011 07:56 AM:
Hi Konrad,

Unfortunatelly, it is not really safe to keep database password in
environment variable.
On Linux, for example, one could inspect other's process environment
by looking into /proc/<PID>/environ


Constantin


On Sun, Apr 10, 2011 at 07:36:04AM -0400, Konrad J Hambrick wrote:

I also found it useful (and more secure ps-wise) to
avoid setting the HostName / UserName / PassWord on
the commandline.

freebcp.c already looks for a environment varb: FREEBCP
so I added code to src/apps/freebcp.c to use FREEBCPHOST,
FREEBCPUSER and FREEBCPPASS from the user's environment
instead of from the commandline.


_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds





Archive powered by MHonArc 2.6.24.

Top of Page