Re: 0.91RC1

That may depend on your Linux, I guess.
I used to hit situations when those are readable for public.

Also, on some Unixes, ps command can show other process' environment.
On Solaris, for example:

/usr/ucb/ps -wwwe <PID>

I believe that accepting password via stdin is safer and freebcp does that already.
But, for even better protection, Kerberos seems like the way to go :^)



On Sun, Apr 10, 2011 at 09:04:59AM -0400, Konrad J Hambrick wrote:
> 
> Constantin --
> 
> Thanks for the feedback.
> 
> Aren't the perms on  '/proc/<PID>/environ set to 0400
> and ownership set to the user ?
> 
> [konrad@kjhlt5 freetds]$ ps
> 
>    PID TTY          TIME CMD
>   6649 pts/9    00:00:00 bash
> 24969 pts/9    00:00:00 ps
> 
> [konrad@kjhlt5 freetds]$ ls -la /proc/6649/environ
> 
> -r-------- 1 konrad users 0 Apr 10 08:00 /proc/6649/environ
> 
> I am missing something here but what am I missing ?
> 
> Thanks !
> 
> -- kjh
> 
> 
> Constantin Vasilyev wrote, On 04/10/2011 07:56 AM:
> > Hi Konrad,
> >
> > Unfortunatelly, it is not really safe to keep database password in environment variable.
> > On Linux, for example, one could inspect other's process environment
> > by looking into /proc/<PID>/environ
> >
> >
> > Constantin
> >
> >
> > On Sun, Apr 10, 2011 at 07:36:04AM -0400, Konrad J Hambrick wrote:
> >>
> >> I also found it useful (and more secure ps-wise) to
> >> avoid setting the HostName / UserName / PassWord on
> >> the commandline.
> >>
> >> freebcp.c already looks for a environment varb: FREEBCP
> >> so I added code to src/apps/freebcp.c to use FREEBCPHOST,
> >> FREEBCPUSER and FREEBCPPASS from the user's environment
> >> instead of from the commandline.
> >>
> >
> _______________________________________________
> FreeTDS mailing list
> [email protected]
> http://lists.ibiblio.org/mailman/listinfo/freetds