2.3 Do Not Specify Passwords in Command Line

Information

When a command is executed on the command line, for example mysql -u admin -p password, the password may be visible in the user's shell/command history or in the process list.

Rationale:

If the password is visible in the process list or user's shell/command history, an attacker will be able to access the MySQL database using the stolen credentials.

Impact:

Depending on the remediation chosen, additional steps may need to be undertaken like:

Entering a password when prompted.

Ensuring the file permissions on .my.cnf is restricted yet accessible by the user.

Using mysql_config_editor to encrypt the authentication credentials in .mylogin.cnf.

Additionally, not all scripts/applications may be able to use .mylogin.cnf.

Solution

Use -p without password and then enter the password when prompted, use a properly secured .my.cnf file, or store authentication information in encrypted format in .mylogin.cnf.

See Also

https://workbench.cisecurity.org/files/3855

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|16.4

Plugin: Unix

Control ID: 48151d2256a8fedae34ee25adf9d0108d57b903edca1c624213726c2e8d9b530