This project is archived and is in readonly mode.
dbconsole support password passing through /dev/fd/
-
Stephan Wehner
- Tag changed from dbconsole, mysql, patch to dbconsole, mysql, patch, security
-
Stephan Wehner
Ticket
asks about dbconsole using the database_configuration_file in config/environment.rb. This may be half-way accomplished through the option of this patch to specify the database.yml on the command line.
-
Stephan Wehner
Attaching patch after rebasing / smaller changes.
-
CancelProfileIsBroken
- Tag changed from dbconsole, mysql, patch, security to bugmash, dbconsole, mysql, patch, security
-
Rizwan Reza
not reproducible
-1 Both patches fail.
-
Elad Meidar
i didn't quiet understand how to reproduce this ticket, pointers?
-
Stephan Wehner
The point of this ticket is that the implementation of dbconsole's -p option, in the mysql case, is not as safe as it could be.
The idea of the -p option is that the database password is available when reading the config/database.yml file, and so the
user should not have to provide it.The implementation before this patch uses mysql'd command line switch -p ... in other words, the password is passed to the mysql process through its argument list.
In general, the argument list of a process is not protected on Unix systems, and can be obtained by any other process.
In other words, the password is left to float around in plaintext in the system. Not a good idea!
So this patch provides a different, hopefully safer solution. It is based on the comment to the article at
http://dev.mysql.com/doc/refman/5.0/en/password-security-user.html
(as the description of this ticket begins with.)
-
John Pignata
-1 This is a very involved change for a small security gain. It would probably be best to inform users via the --help msg that using -p could have security implications.
-
Stephan Wehner
I believe it's good to make use of operating system features. I don't think I would judge the security gain as small.
The change is involved mostly because it includes unit tests, and the corresponding, new, "units".
Should be good also for future changes to have these tests. -
Rizwan Reza
- Tag changed from bugmash, dbconsole, mysql, patch, security to dbconsole, mysql, patch, security
-
Rizwan Reza
- State changed from new to wontfix
- Importance changed from to
