Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using watch to monitor the progress of a MySQL replication slave. The way I have it set up now, the password shows up in the header of the watch output. I am not exceedingly worried that someone will steal the password, but on principle I would prefer not to be showing a naked password to anyone who happens to wander up and look over my shoulder.

The command line I am currently using with watch is:

watch -n1 -d mysql -pmypass -e "'show slave status\G'"

Should I just bury the mysql command in a tiny little shell script?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

A better option than providing the password on the command line at all is to make a ~/.my.cnf file with the credentials in it:

[client]
password=something

That way they are also protected against someone looking at the ps output, or your shell history.

That said, you can turn off the watch title entirely with the -t or --no-title option, which will:

Turn off the header showing the interval, command, and current time at the top of the display, as well as the following blank line.

You do lose a little more information than you were wanting, but it's not hugely vital. Otherwise, a shell script also works, as you suggested.

share|improve this answer

It will not only show up on your screen, but also in ps output, in your ~/.bash_history (though that one should only be readable to you and the admins) and possibly in some audit or performance logs.

You should not pass passwords as arguments to commands. Arguments to commands should be considered public knowledge.

For mysql, use ~/.my.cnf as Michael has shown or in another file (readable only do yourself) passed as --defaults-extra-file=the-file

share|improve this answer
    
Good point about the ps output. –  amacleod Aug 21 at 21:38

Are you okay with typing the password when you run it? You can read it in a bash script without making it visible in the terminal, saving to history, etc:

#!/bin/bash

if ! IFS= read -rs -p "Enter password: " password < /dev/tty 2> /dev/tty
then
  echo "Password entry failed"
  exit 1
fi

somecommand -user me -password $password

Looking at the other answer, this is vulnerable to the ps problem, though, since there will be a process there for somecommand

share|improve this answer
    
This could work, as I trust all the admins on that system. I will keep the technique in mind in case I want to do a similar thing with any program that does not allow putting settings in a file like .my.cnf. –  amacleod Aug 22 at 17:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.