Passing secrets (password) to a program via environmental variable is considered "extremely insecure" according to MySQL docs and as poor choice (from security aspect) across other resources.
I would like to know why - what is it that I'm missing? In the mentioned MySQL manual(I'm using this as an example), passing password via -p
option in command line is considered as "insecure" and via env var as "extremely insecure", bold italic font.
I'm not an expert but I do know the fundamentals: simple ps
command, even issued by unprivileged user reads every program alongside with command parameters while only the same user (and root, of course) may read environment of the process. So, only root
and johndoe
may read environment of the johndoe
- started process, while hacked www-data
script reads all via ps
.
There must be some big deal here that I'm missing - so please explain me what am I missing?
My objective is to have a mean of transferring secret from one program to other, generally, non-interactive.
mysql -ps3cret
puts your password into your shell history file in plain text. Using a script or other means to put your password into an environment variable means that the password (or the means to expose it) is in that script, or if youexport mysqlpasswd=s3cret
, that will again simply add your password in plain text to your shell history.ps
.export
into a script and your password is now in plaintext on disk, which is also a very poor choice.