4

I run an application on a linux server, and when I run the application I supply the password as a command line, like this:

 ./myapplication --smtp-password mypassword

In our application, we didn't built so far encrypt/decrypt , because it is supposed to be a very simple monitoring application, and it is very simple "pinging" and health check and send email in case of failure.

Any admin - and we have three other admins - can just list the process with ps, and see the command arguments, and figure out the password.

Is there a way to hide that?

  • 6
    Don't do that; have myapplication instead read the password from a file or via a startup prompt or (almost) anything but putting it in the command line. – thrig Jul 25 '16 at 15:33
4

Better would be to rewrite myapplication so it gets the password via some other mean like stdin. The environ is another option, but that is still visible to processes with the same euid (or euid 0) via /proc/<pid>/environ.

If not, on Linux with versions prior to 4.2, you can limit the exposure by making sure the password is not in the first 4096 bytes of the command line so other processes can't obtain it via reading /proc/<pid>/cmdline (like ps does). 4.2 and above no longer truncate /proc/<pid>/cmdline.

For instance, with zsh

.${(l:4094::/:):-myapplication} --smtp-password=secret

Would run myapplication with the first argument being 4095 bytes large (4096 you'd trip the PATH_MAX limit), something like .//////[...]///myapplication, so your password would be beyond the 4095 break point.

Note that audit logs and shell history files are other areas of concern for secret strings passed on the command line.

4

On a linux system, you can hide process information by mounting /proc with the appropriate hidepid setting, e.g. mount -o remount /proc -o hidepid=2. However, this will not hide process information from anyone with root access. The better solution is to not include sensitive data on the command line.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.