Re: exposing passwords in command line

[racke@linuxia.de (Stefan Hornburg Racke)]

Brian May <bam@debian.org> writes:

> >>>>> "Jaakko" == Jaakko Niemi <liiwi@debian.org> writes:
> 
>     Jaakko>  This is not that easily fixed in wwwconfig-common. It
>     Jaakko> might be better for some packages to move the database
>     Jaakko> configuration to separate script that the admin would run
>     Jaakko> after installation, which would run the database client in
>     Jaakko> interactive mode.  Some packages might want to prompt the
>     Jaakko> local admin for a decision.
> 
> mysql can be told read the password $HOME/.my.cnf, and in fact the
> Debian installation instructions specifically say to create a
> /root/.my.cnf file with the root password anyway, for the logrotation
> stuff to work.
> 
> Admittedly, storing the root password in a known location in a clear
> text file seems a crazy idea to me (surely it should be possible to
> rotate the log files without knowing this password?), but I am not the
> maintainer...


As root you can put your own mysql.* files into /var/lib/mysql
anyway, so this is no notable security hole.

Ciao
        Racke


-- 
Racke happily hacks Interchange and maintains Debian packages like Courier.

For projects and other business stuff please refer to COBOLT NetServices
(URL: http://www.cobolt.net; Email: info@cobolt.net; Phone: 0041-1-3884400)