Why shouldn't someone use passwords in the command line?

Question

Why do people fear writing passwords in the command line?

The history file is located in ~/.history, so it's available only to the user who executed the commands (and root).

You can avoid to log some commands in your history file. See the answers in Avoid to keep command in history — Luc M, Jun 08 '13 at 21:06
Yuk! Even if you define your password with export mypass=secret and you use a_command --password=$mypass, you'll see secret in ps table. — Luc M, Jun 08 '13 at 21:12

score 54 · Accepted Answer · answered Jun 08 '13 at 19:31

Command lines are not just available in history. They are also available, for example, in the output of ps -ocmd or through the /proc filesystem. (/proc/<pid>/cmdline) which is where ps reads them.

Also, users' home directories are often world- or group- readable; you can make the history file only user-readable, but that might not survive deletion and recreation.

score 20 · Answer 2 · answered Jun 09 '13 at 00:35

20

Passwords on the command line are just a bad idea all the way around. In addition to the methods discussed in the other answers:

/proc
process list (ps)
user's history file

User commands can show up in these locations as well:

audit logs
/var/log/*

In addition user's commands can also show up when users login between systems, so in general it's a bad practice and should be avoided at all times.

answered Jun 09 '13 at 00:35

slm

369,824

3

+1 for the /var/log reference - note that often the important system logs can be sent elsewhere, and don't necessarily stay on the same system. Thus your passwords may inadvertently also be transmitted across the network in cleartext form. – Mark Glossop Jun 14 '13 at 01:33

score 11 · Answer 3 · answered Jun 08 '13 at 19:32

11

The problem is the visibility of the parameters (to other users in most cases, even for root) while the command is running. See the output of

ps -eo pid,user,args

answered Jun 08 '13 at 19:32

Hauke Laging

90,279

Why shouldn't someone use passwords in the command line?

3 Answers3

Linked