Details
Description
If the username and password are passed to maxctrl on the command line, they will be visible if someone executes ps -ef. Since maxctrl is a script this is impossible to prevent. If maxctrl was a native executable, the command line arguments could be overwritten, so that ps -ef would not reveal the arguments. However, there is a race; a ps -ef executed after the process was launched, but before the process has had time to overwrite the arguments would still reveal the password. So, passing a password on the command line is inherently insecure.
To alleviate the issue, it should be possible to specify the the username and password using environment variables. That could be used like
MAXSCALE_PASSWORD=mypassword maxctrl
|
Since the environment can not be accessed using ps or anything else, the password could not leak.
Attachments
Issue Links
- relates to
-
MXS-5559 maxctrl does not obfuscate password in ps output
-
- Closed
-