14

I have MySQL password saved on a file foo.php, for example P455w0rd, when I try to use it:

$ cat foo.php | grep '$dbpwd=' | cut -d '"' -f 2 | mysql -U root -p mydb -h friendserver
Enter password: (holds)

$ echo P455w0rd | mysql -u root -p mydb -h friendserver
Enter password: (holds)

Both option still ask for password, what's the correct way to send password from stdin?

  • 3
    must be no blank between -p and your password. – Fırat KÜÇÜK May 23 '15 at 7:10
  • mysql doesn't read the password from stdin, I wasn't able to figure it what it does read it from. – Omn Mar 19 '18 at 0:20
  • The proper answer is don't put your passwords on the command line where anyone with access to /proc can trivially read them as long as the program is running. That's what a ~/.my.cnf is for, properly chmod'ed to 0600 – Shadur Jun 16 at 21:29
22

You have to be very careful how you pass passwords to command lines as, if you're not careful, you'll end up leaving it open to sniffing using tools such as ps.


The safest way to do this would be to create a new config file and pass it to mysql using either the --defaults-file= or --defaults-extra-file= command line option.

The difference between the two is that the latter is read in addition to the default config files whereas with the former, only the one file passed as the argument is used.

Your additional configuration file should contain something similar to:

[client]
user=foo
password=P@55w0rd

Make sure that you secure this file.

Then run:

mysql --defaults-extra-file=<path to the new config file> [all my other options]
  • 2
    MySQL will modify its argv to overwrite the parameters given to the -p flag. At least that's what's concluded here, together with other relevant info: unix.stackexchange.com/questions/78757/… – Kusalananda Jan 23 '17 at 13:40
  • This is the best solution, as it provides a measure of security. You need to chmod go-rwx, and make sure this argument preceeds all other arguments. – ChuckCottrill Feb 1 '17 at 0:52
  • @Kusalananda, yes, but as per comments on unix.stackexchange.com/q/385339/135943, that does not mean it's safe! – Wildcard Oct 19 '17 at 5:01
  • Might be worth adding a note about --login-path now that it's supported. It's not much better than this, but it is slightly less plain-text (even though the barrier to converting the contents to plaintext is low). – Geoffrey Wiseman Feb 3 '18 at 1:50
  • 3
    Set MYSQL_PWD in the environment (export MYSQL_PWD=muhpassword) and execute your command without the -p. See MySQL Program Environment Variables. In spite of the manual's dire warnings, this is rather safe. Unless you start weird warez in the same shell later. So we run: MYSQL_PWD=$(cat foo.php etc) mysql -u foouser -h barhost – David Tonhofer Mar 1 '18 at 18:02
9

The mysql client utility can take a password on the command line with either the -p or --password= options.

If you use -p, there must not be any blank space after the option letter:

$ mysql -pmypassword

I prefer the long options in scripts as they are self-documenting:

mysql --password=mypassword --user=me --host=etc
2

If you want to start mysql with a password provided you have to fetch the password in a variable first:

MYSQLPASS=`cat foo.php | grep '$dbpwd=' | cut -d '"' -f 2`

Then you can start your mysql command with:

mysql -U root -p ${MYSQLPASS} mydb -h friendserver
0

I don't have enough reputation to comment so I'm just gonna mention you. Just wanted to say that the --defaults-extra-file must be the first option when executing the mentioned command. For me it didn't work otherwise.

New contributor
user8810865 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.