automated mongodump: how to hide password from ps output?

Question

okay so we we have the mongodump tool, it has --password option. Everything works great except this plain password is visible in ps output to everybody.

our database has plain user/password authentication.

The only thing that I found to work is doing like this

echo secretpwd |  mongodump --username backup --oplog

no trace of password in ps and still working.

Is there any better way?

Karlkarla

Answer 1

From the docs:

Changed in version 3.0.2: If you wish mongodump to prompt the user for the password, pass the --username option without --password or specify an empty string as the --password value, as in --password "" .

Seems like what you are doing is the recommended way.

Also, this can help further:

If the secret doesn't change between executions, use a special configuration file, ".appsecrets". Set the permissions of the file to be read-only by owner. Inside the file set an environment variable to the secret. The file needs to be in the home directory of the user running the command.

Norvol

looks ugly anyway. Maybe it'd be slighly less ugly if we do it like cat /home/password.txt | mongodump .... Does echo show up in process list by the way? I think it does. – Karlkarla

Haha I just added a reference to something similar from another thread. – Norvol

Oh and echo doesn't show up because it doesn't spawn a new process in bash. Check this out. – Norvol

Answer 2

Old post, but it looks like recent versions of mongodump do explicitly support reading the password from standard in. I didn't see anything about it in the documentation, but when I use a similar command to the one in the OP, mongodump generates output like:

reading password from standard input

I'm not sure if it's any better than using echo like in the OP, but I store the password in a file and then use it like this: mongodb --username backup < /path/to/password.txt

Durware