Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Witness:

$ ps f
  PID TTY      STAT   TIME COMMAND
31509 pts/3    Ss     0:01 -bash
27266 pts/3    S+     0:00  \_ mysql -uroot -p
25210 pts/10   Ss+    0:00 /bin/bash
24444 pts/4    Ss     0:00 -bash
29111 pts/4    S+     0:00  \_ tmux attach
 4833 pts/5    Ss+    0:00 -bash
 9046 pts/6    Ss     0:00 -bash
17749 pts/6    R+     0:00  \_ ps f
 4748 pts/0    Ss     0:00 -bash
14635 pts/0    T      0:02  \_ mysql -uroot -px xxxxxxxxxxxxxxxx
16210 pts/0    S+     0:01  \_ mysql -uroot -px xxxxxxxxxxxxxxxx

How did ps know to hide the mysql passwords? Can I incorporate this into my own scripts to hide particular CLI attributes?

share|improve this question
5  
It is probably the other way and mysql does the magic, not ps: “MySQL clients typically overwrite the command-line password argument with zeros during their initialization sequence.” – End-User Guidelines for Password Security –  manatwork Aug 29 '13 at 10:03
    
Thank you, that is an informative document. I'll see about how I might overwrite cli arguments in my own scripts. –  dotancohen Aug 29 '13 at 10:30
1  
@manatwork I would put that as an answer, because that is exactly what is happening - and it's a useful link for security issues regarding mysql. :) –  Drav Sloan Aug 29 '13 at 10:48
    
Note that while command line arguments can be snooped, environment variables are safe. –  Gilles Aug 29 '13 at 21:29

2 Answers 2

up vote 12 down vote accepted

ps does not hide the password. Applications like mysql overwrite arguments list that they got. Please note, that there is a small time frame (possible extendible by high system load), where the arguments are visible to other applications until they are overwritten. Hiding the process to other users could help. In general it is much better to pass passwords via files than per command line.

In this article it is described for C, how to do this. The following example hides/deletes all command line arguments:

#include <string.h>

int main(int argc, char **argv)
{
    // process command line arguments....

    // hide command line arguments
    if (argc > 1) {
        char *arg_end;    
        arg_end = argv[argc-1] + strlen (argv[argc-1]);
        *arg_end = ' ';
    }

    // ...
}

Look also at http://stackoverflow.com/questions/724582/hide-arguments-from-ps and http://stackoverflow.com/questions/3830823/hiding-secret-from-command-line-parameter-on-unix .

share|improve this answer
    
Very nice, thanks. I did not realize that the arguments are mutable as such. –  dotancohen Aug 29 '13 at 12:01
    
Also note that not all programs will do this with passwords. –  ash Aug 30 '13 at 6:18
    
The link to this article is broken. Anyone to explain the code for me?(Why the code work, just set \0 to space?) Any link to setproctitle()? –  schemacs Mar 7 at 16:13
    
Or the answer lies here? –  schemacs Mar 7 at 16:19

The mysql program replaces the password from the command line with x in this line of code:

while (*argument) *argument++= 'x';     // Destroy argument
share|improve this answer
    
Very nice find, thank you schemacs! –  dotancohen Mar 9 at 7:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.