Skip to content

# Even more on MySQL password security

MySQL Security June 8, 2009August 10, 2009

This post follows Ronald Bradford’s More Basic MySQL Security, and Lenz Grimmer’s Basic MySQL Security: Providing passwords on the command line and More on MySQL password security.

In Ronald’s post I’ve argued that passwords provided on command line are visible in plaintext on “ps aux”. Lenz has argued that this is incorrect, providing the source code to support that. Giuseppe commenting that this has been fixed since 2002. Later on, Lenz shows that passwords are visible in plaintext on OpenSolaris, Solaris and variants of BSD and SysV.

Mental note: old habits die hard; I must remember to revisit issues from time to time.

#### Centralizing

Back to the question: why use a file to store your password, and not provide it on command line?

As in software programming, where you only define ‘magic numbers’ once, as some constant or parameter, thus able to change that value in one single place – instead of hunting for it throughout the code – placing the password in a config file helps in changing passwords.

Many utilities can use the config-file syntax: the various mysql clients, mytop, maatkit, others…

Instead of placing passwords in numerous scripts, crontabs etc., why not write it down in one single place, then let everyone look for it there? (Obviously don’t give out root password to everyone freely, just enough privileges as required).

How frequently does one change passwords? In my experience – not often. I suspect the reason being the overhead of verifying everyone got the change properly. For command line utilities, a config file may ease the burden.

- Twitter
- LinkedIn
- WhatsApp
- Email
- Facebook
- Print

###
2
Leave a Reply

2 Comment threads
0 Thread replies
0 Followers
Most reacted comment
Hottest comment thread
2 Comment authors
Recent comment authors

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Subscribe
Notify of
Guest
Gerry

You mean like in the “~/.my.cnf” file? 😉 … of course the permissions have to be set to “u+rw” (0600) so they don’t get published to the world.

Author
shlomi

@Gerry
Thanks. Yes, that was the discussion.

wpDiscuz
Send to Email Address Your Name Your Email Address Cancel
Post was not sent - check your email addresses!
Email check failed, please try again
Sorry, your blog cannot share posts by email.