Password passed on the command line is shown in process list / bash history

[Piotr Kilczuk]

Originally reported as: https://answers.launchpad.net/mydumper/+question/203617
I'm just pasting as this issue stops me from using this promising project.

Hi,

I'm new to mydumper and think it's a great tool, but what worries me is that the password for the account used to create the export is shown in the process list.

I can live with the fact that I have to provide the password at the command-line, but showing the password in the processlist is a big security risk as all users on a normal Linux machine can see all processes... and thus see a username/password combination which they can use to login at MySQL...

Is there any way to secure this in mydumper?

Michel

[Domas Mituzas (domas-mituzas)]

It should be able to read your ~/.my.cnf ([client] and [mydumper] groups probably, I'm not sure if I actually implemented :)

[HighKing (esz-ei6h3l-n1h)]

Ah, yes this works great! I created a ~/.my.cnf with only [mydumper] and a password line. Now I see no login information in the processlist.

Probably should document that. ;-)

[Piotr Kilczuk (p-kilczuk)]

Glad that works - are you planning to implement reading the password from STDIN like in mysqldump?

[Domas Mituzas (domas-mituzas)]

I'd keep stdin available for other future uses instead, I don't see urgent
need for this feature with my.cnf in place. Do note, mysql library also may
pick certain environment variables, if passed.

[Dmitry Ilyin (idv1985)]

I have posted password masking patch. Look in original question comments.

[rat (szczur-i)]

fixed patch for 0.6.1 version

[rat (szczur-i)]

fixed patch for 0.6.1 version - for myloader.c

[Max Bubenick (max-bubenick)]

Thanks for the patch, I will test it and commit