Securely specifying passwords for freebcp and such

Benjamin Moody <[email protected]> Thu, 2 Aug 2018 19:45:42 +0000
Newsgroups gmane.comp.db.tds.freetds
Message-ID <CAAk6P0V6+hc576+a24bq93kYsifdudsEMWcwtru-AdY8nuJ-EQ@mail.gmail.com>
There's a useful feature which is not mentioned in the FreeTDS man
pages: for several of the command-line tools, if you specify the
option '-P -', the password will be read from standard input.  This is
the case for tsql, freebcp, defncopy, and bsqldb.

The feature isn't all that useful for tsql, but for the other tools,
it may be a helpful option for batch processing.  Indeed, at least for
freebcp, it appears to be the only secure way to supply a password
(on a system where program command lines are visible to everyone via
/proc/.)

(For example, in a shell script:

    freebcp [...] -U "$user" -P "$pass"

typically allows other users to see the password using 'ps', but

    freebcp [...] -U "$user" -P - <<EOF
    $pass
    EOF

doesn't.)

So, this feature should probably be documented.