FreeTDS Development Group

[Konrad J Hambrick <konrad AT payplus.com>]

Constantin --

Yikes !

I did not know about the 'new'  -P- commandline arg.

I'll look at putting that one to work.

Wouldn't:  `echo PassWord |freebcp ...` still be visible via ps ?

I do see that there's 'new' code (since 0.62) that zero's the
optarg for the -P Arg which might (?should?) clear the same
from the process table.

I imagine that depends on the implementation of ps on the
particular OS as well.

I don't think I can effectively bzero() the environment varb
because it's inherited from the PPID so even if I did bzero()
the FREEBCPPASS Varb in the freebcp Process, it would still
exist in the Parent's  /proc/<PID>/environ file.

Will take a look at using the -P- Arg instead of FREEBCPPASS.

And thanks again !

-- kjh


Constantin Vasilyev wrote, On 04/10/2011 08:23 AM:
> That may depend on your Linux, I guess.
> I used to hit situations when those are readable for public.
>
> Also, on some Unixes, ps command can show other process' environment.
> On Solaris, for example:
>
> /usr/ucb/ps -wwwe<PID>
>
> I believe that accepting password via stdin is safer and freebcp does that 
> already.
> But, for even better protection, Kerberos seems like the way to go :^)
>
>
>
> On Sun, Apr 10, 2011 at 09:04:59AM -0400, Konrad J Hambrick wrote:
> > Constantin --
> >
> > Thanks for the feedback.
> >
> > Aren't the perms on  '/proc/<PID>/environ set to 0400
> > and ownership set to the user ?
> >
> > [konrad@kjhlt5 freetds]$ ps
> >
> >     PID TTY          TIME CMD
> >    6649 pts/9    00:00:00 bash
> > 24969 pts/9    00:00:00 ps
> >
> > [konrad@kjhlt5 freetds]$ ls -la /proc/6649/environ
> >
> > -r-------- 1 konrad users 0 Apr 10 08:00 /proc/6649/environ
> >
> > I am missing something here but what am I missing ?
> >
> > Thanks !
> >
> > -- kjh
> >
> >
> > Constantin Vasilyev wrote, On 04/10/2011 07:56 AM:
> > > Hi Konrad,
> > >
> > > Unfortunatelly, it is not really safe to keep database password in 
> > > environment variable.
> > > On Linux, for example, one could inspect other's process environment
> > > by looking into /proc/<PID>/environ
> > >
> > >
> > > Constantin
> > >
> > >
> > > On Sun, Apr 10, 2011 at 07:36:04AM -0400, Konrad J Hambrick wrote:
> > > > I also found it useful (and more secure ps-wise) to
> > > > avoid setting the HostName / UserName / PassWord on
> > > > the commandline.
> > > >
> > > > freebcp.c already looks for a environment varb: FREEBCP
> > > > so I added code to src/apps/freebcp.c to use FREEBCPHOST,
> > > > FREEBCPUSER and FREEBCPPASS from the user's environment
> > > > instead of from the commandline.
> > _______________________________________________
> > FreeTDS mailing list
> > FreeTDS AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/freetds