Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to login to a MySQL database from a shell.

Normally I use

mysql -p 

But I just noticed the following in the the MySQL help:

-p, --password[=name] 
                      Password to use when connecting to server. If password is
                      not given it's asked from the tty. WARNING: This is
                      insecure as the password is visible for anyone through
                      /proc for a short time.

Is this saying that the following is insecure?

mysql -p=mypassword

Or that all uses of -p are insecure?

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Only this is insecure:

mysql -p=mypassword

because this way it can be visible when ps is used to view the command line arguments. In short, always use the -p option, and when automation is desired use an "option file"

Refer to http://dev.mysql.com/doc/refman/5.0/en/password-security-user.html for more information:

This is convenient but insecure, because your password becomes visible to system status programs such as ps that may be invoked by other users to display command lines. MySQL clients typically overwrite the command-line password argument with zeros during their initialization sequence. However, there is still a brief interval during which the value is visible. Also, on some systems this overwriting strategy is ineffective and the password remains visible to ps. (SystemV Unix systems and perhaps others are subject to this problem.)

share|improve this answer
1  
Not to mention the command stays in your history for a while. –  slhck Aug 30 '11 at 16:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.