I am using watch to monitor the progress of a MySQL replication slave. The way I have it set up now, the password shows up in the header of the watch output. I am not exceedingly worried that someone will steal the password, but on principle I would prefer not to be showing a naked password to anyone who happens to wander up and look over my shoulder.

The command line I am currently using with watch is:

watch -n1 -d mysql -pmypass -e "'show slave status\G'"

Should I just bury the mysql command in a tiny little shell script?


A better option than providing the password on the command line at all is to make a ~/.my.cnf file with the credentials in it:


That way they are also protected against someone looking at the ps output, or your shell history.

That said, you can turn off the watch title entirely with the -t or --no-title option, which will:

Turn off the header showing the interval, command, and current time at the top of the display, as well as the following blank line.

You do lose a little more information than you were wanting, but it's not hugely vital. Otherwise, a shell script also works, as you suggested.


It will not only show up on your screen, but also in ps output, in your ~/.bash_history (though that one should only be readable to you and the admins) and possibly in some audit or performance logs.

You should not pass passwords as arguments to commands. Arguments to commands should be considered public knowledge.

For mysql, use ~/.my.cnf as Michael has shown or in another file (readable only do yourself) passed as --defaults-extra-file=the-file

  • Good point about the ps output. – amacleod Aug 21 '14 at 21:38

Are you okay with typing the password when you run it? You can read it in a bash script without making it visible in the terminal, saving to history, etc:


if ! IFS= read -rs -p "Enter password: " password < /dev/tty 2> /dev/tty
  echo "Password entry failed"
  exit 1

somecommand -user me -password $password

Looking at the other answer, this is vulnerable to the ps problem, though, since there will be a process there for somecommand

  • This could work, as I trust all the admins on that system. I will keep the technique in mind in case I want to do a similar thing with any program that does not allow putting settings in a file like .my.cnf. – amacleod Aug 22 '14 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.