Hide Password from ps ..

[someone_4]

Hey everyone ..

I noticed another post asking how to hide a password in a flat file.

But I was wondering how you would go about hiding a password that is part of an options -Ppassword, from showing up in a ps -ef.

Richard

[James R. Ferguson · Accepted solution]

Hi Richard:

You wouldn't if the password was merely a clear-text argument as you suggest. In fact, that's why memory dumps are regarded as sensitive, too.

Regards!

...JRF...

[Peter Godron]

Richard,
make the -P parameter the last in a long list of parameters.
Most casual users would not know how to get past the default length displayed by ps.
ps will only show you a certain number of characters.
Not perfect, but should stop normal users.

[Robert Fritz]

I know over time, there has been effort to provide command-line options to read froma file and stdin options to HP-UX commands to address exactly this concern. The plan, in the cases I'm familiar with was to deprecate the -P options.

What command isn't giving you an option to use stdin/file? What version of HP-UX are you on?

[Ivan Ferreira]

I had a similar issue in one of our clients, and we removed the execute permission for all users for the ps command. Only administrator could run the ps command.

You could also create an alias to the ps command to do a grep -v of the process that shows the password, and then, alias the alias command so it cannot be changed.

[Robert Fritz]

I'm thinking that messing with the ps binary won't help. The data it parses is readable by anyone. If you did that, someone could just copy an unmodified "ps" binary into their home dir, and run it as before.