topic Re: Hide Password from ps .. in Operating System - HP-UX

Hide Password from ps ..

someone_4 — Mon, 27 Feb 2006 10:29:29 GMT

Hey everyone ..

I noticed another post asking how to hide a password in a flat file.

But I was wondering how you would go about hiding a password that is part of an options -Ppassword, from showing up in a ps -ef.

Richard

Re: Hide Password from ps ..

James R. Ferguson — Mon, 27 Feb 2006 10:31:58 GMT

Hi Richard:

You wouldn't if the password was merely a clear-text argument as you suggest. In fact, that's why memory dumps are regarded as sensitive, too.

Regards!

...JRF...

Re: Hide Password from ps ..

Peter Godron — Mon, 27 Feb 2006 10:44:46 GMT

Richard,
make the -P parameter the last in a long list of parameters.
Most casual users would not know how to get past the default length displayed by ps.
ps will only show you a certain number of characters.
Not perfect, but should stop normal users.

Re: Hide Password from ps ..

Robert Fritz — Tue, 28 Feb 2006 12:14:44 GMT

I know over time, there has been effort to provide command-line options to read froma file and stdin options to HP-UX commands to address exactly this concern. The plan, in the cases I'm familiar with was to deprecate the -P options.

What command isn't giving you an option to use stdin/file? What version of HP-UX are you on?

Re: Hide Password from ps ..

Ivan Ferreira — Tue, 28 Feb 2006 13:38:10 GMT

I had a similar issue in one of our clients, and we removed the execute permission for all users for the ps command. Only administrator could run the ps command.

You could also create an alias to the ps command to do a grep -v of the process that shows the password, and then, alias the alias command so it cannot be changed.

Re: Hide Password from ps ..

Robert Fritz — Tue, 28 Feb 2006 14:14:00 GMT

I'm thinking that messing with the ps binary won't help. The data it parses is readable by anyone. If you did that, someone could just copy an unmodified "ps" binary into their home dir, and run it as before.