2.3 Do Not Specify Passwords in Command Line

Information

When a command is executed on the command line, for example mysql -u admin -p password, the password may be visible in the user's shell/command history or in the process list.

Rationale:

If the password is visible in the process list or user's shell/command history, an attacker will be able to access the MySQL database using the stolen credentials.

Impact:

Depending on the remediation chosen, additional steps may need to be undertaken like:

Entering a password when prompted.

Ensuring the file permissions on .my.cnf is restricted yet accessible by the user.

Using mysql_config_editor to encrypt the authentication credentials in .mylogin.cnf.

Additionally, not all scripts/applications may be able to use .mylogin.cnf.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Use -p without password and then enter the password when prompted, use a properly secured .my.cnf file, or store authentication information in encrypted format in .mylogin.cnf.

See Also

https://workbench.cisecurity.org/files/3859

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|16.4

Plugin: Windows

Control ID: 666a329e20732b4198aaa176bfce87bf0ca828f8b2b82876c672ae05d9e351b0