Re: hiding username / password info from ps

On Sat, 9 Apr 2011 16:52:37 -0400
a g <[email protected]> wrote:

> I have googled around and haven't found a better solution to this
> security issue than these two approaches. I would like to submit this
> change to be included in the "official" freebcp code. thoughts?

I'll tell you what I did, which is more flexible, not least because it
works with all such utilities.  

But first, a word from our sponsors:  

	$ ./configure --help | grep krb
	  --enable-krb5[=LIB]     enable Kerberos support

Get your sysadmin to wire up the machine with Kerberos, and sleep
sounder.  (If it helps, tell him it will glow a cool blue under
the machine between 2 and 3 in the morning.  Don't be surprised if he
doesn't believe you, though.)  

In the Time Before Kerberos, I kept a magic
program /usr/local/bin/password that took a hostname and username as
arguments and printed the password on standard output.  

To use e.g. bsqldb:

	bsqldb -S server -U $USER -P$(password server $USER)

More than ps(1), it solves recording passwords in logfiles.  

To do something more similar to what you had in mind, without reading
the password from anywhere, your script might look like:

	#! /bin/sh
	if [ "$1" ]
	then
		echo $1 > $(HOME}/.password.tmp
		chmod 600 $(HOME}/.password.tmp
	else 
		cat $(HOME}/.password.tmp
		rm  $(HOME}/.password.tmp
	fi

Then you can say:

	password "mypassword"; \
	bsqldb -S server -U $USER -P$(password)

If the few milliseconds the password spends on disk troubles you, think
about your shell history file.  If that bothers you, someone on this
list will doubtless suggest Kerberos.  

HTH.  

--jkl