Password security - Githubissues

ShahriyarR / MySQL-AutoXtraBackup

MySQL-AutoXtraBackup commandline tool written in Python 3 based on Percona XtraBackup

https://autoxtrabackup.azepug.az/

MIT License

140 stars 79 forks source link

Password security #306

Closed BarbzYHOOL closed 6 years ago

BarbzYHOOL commented 6 years ago

Is it safe to have the password written in clear in the configuration file?

Even more worrying, when I use verbose debug mode to see what happens, it shows the password.

And if I log it to a file, it's now also in that log file!

ShahriyarR commented 6 years ago

Yes it is OK to have password in config file as clear text -> it is up to user to secure its file in Linux from the

It was fixed and in new version of our tool the output will be like:

018-08-01 12:18:25 DEBUG    The following backup command will be executed /usr/bin/xtrabackup --defaults-file=/etc/mysql/mysql.conf.d/mysqld.cnf --user=root --password='*'  --target-dir=/home/shako/XB_TEST/backup_dir/full/2018-08-01_12-18-25 --backup --host=127.0.0.1 --port=3306 --no-version-check

BarbzYHOOL commented 6 years ago

Ok cool, when is the new version out? :)

ShahriyarR commented 6 years ago

Soon :)

ShahriyarR commented 6 years ago

Released as 1.5.3. Closing.