3

So I'm setting up a WordPress backup guide/making a backup schedule for myself for real.

I want to do MySQL dumps daily, but the command either requires

-p then user input 

or

--password="plain text password"

Could I pass it to a file that is atleast MD5 or better hashed and protected to increase security but make the command require no user input?

Any help is appreciated!

For Reference here is the command I want to run

mysqldump -u [username] --password=~/wp_backups/sqldumps/.sqlpwd [database name] > ~/wp_backups/sqldumps/"$(date '+%F').sql"
  • Im closer! --defaults-extra-file=~/wp_backups/sqldumps/.sqlpwd seems to work, but as of now, I have PWD in plain text, but I will secure file with CHMOD CHOWN, but could I put in hashed PWD? – FreeSoftwareServers Sep 5 '15 at 4:02
6

You have following password options:

  • provide the password on the command line through the -p option
  • provide the password via the MYSQL_PWD environment variable
  • put your configuration in the ~/.my.cnf file under the [mysqldump] section

In all cases your client needs a plain text password to be able to authenticate. You mentioned hashes, but the trait of a hash is that it's a one way conversion function (i.e. you won't be able to restore the original password from a hash), therefore it's unusable as the authentication token.

Since you are backing up the Wordpress database from, allegedly, the same account that hosts your Wordpress there is no security improvements of trying to hide the password from the user that runs Wordpress (the database credentials can be easily extracted from the wp-config.php file anyway).

So, I'd suggest to define the following ~/.my.cnf:

[mysqldump]
host = your_MySQL_server_name_or_IP
port = 3306
user = database_user_name
password = database_password

Then ensure that the file has the 0600 permissions. This way mysqldump does not need any database credential specified on its command line (they will be read from the ~/.my.cnf file.

  • yea I kinda figured, if the permissions arent 0600 then even if it was "hashed" somebody could just use the hashed password in their own ~/.my.cnf, but I prefer --defaults-extra-file= as it can use ~/.my.cnf or any file anywere inside OS. Less like somebody will "find -name .my.cnf" – FreeSoftwareServers Sep 5 '15 at 6:24
  • while I haven't tested your way, in my file, there are no spaces between user=username or any of the parameters. – FreeSoftwareServers Sep 5 '15 at 6:25
  • I believe you can use spaces there and if any of the parameters need to start or end with a space you need to enclose the whole string in double quotes. – galaxy Sep 5 '15 at 12:20
  • 1
    Also, re: your comment on using a non-standard file -- won't help to much since wp-config.php of your Wordpress will reveal this information anyway. – galaxy Sep 5 '15 at 12:21
  • I see what you are saying, the credentials are already in plain text on the server lol, O well, guess the best you can do is CHOWN CHMOD the 2 files. – FreeSoftwareServers Sep 5 '15 at 14:17
2

This creates a file (it could be any file anywere is OS) that passes the password and username from the file. Even if it were "hashed" it would not make a difference if somebody got a hold of the file, they could just use it as is. If it works for me, it would work for them.

So to answer the security part of my question, chmod 0600 & sudo chown $USER:nogroup will prevent unauthorized access to file once created.

mkdir ~/wp_backups/sqldumps &&  touch ~/wp_backups/.sqlpwd &&  nano ~/wp_backups/.sqlpwd && chmod 600 ~/wp_backups/.sqlpwd && sudo chown $USER:nogroup ~/wp_backups/.sqlpwd

--.sqlpwd contents

[mysqldump]             # NEEDED FOR DUMP
user=username
password=password

[mysql]             # NEEDED FOR RESTORE
user=username
password=password

--SQL CLI Syntax

mysqldump --defaults-extra-file=~/wp_backups/.sqlpwd [database] > ~/wp_backups/sqldumps/"$(date '+%F').sql"
  • This does not improve security a single bit, unfortunately. Moreover, instead of two sections you could have used just one called [client]. – galaxy Sep 5 '15 at 12:23
  • This is the ONLY option really that suits my needs, and the point is the CHMOD CHOWN is the security. And I know of client, but didnt try it, wasn't sure what it was for, thanks! – FreeSoftwareServers Sep 5 '15 at 14:15
  • Here is the final Backup WP via Crontab Script TAR & SQL dump guide! It seems to be working great, and easily scale-able for multiple domains. – FreeSoftwareServers Sep 5 '15 at 14:18
2

You can have a look at mysqldump-secure which acts as a wrapper script around mysqldump and will take care about password security (via a defaults-extra-file) and also offers your to encrypt your mysql databases via asymmetric encryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.