schemacrawler / SchemaCrawler

Free database schema discovery and comprehension tool
http://www.schemacrawler.com/
Other
1.62k stars 200 forks source link

Pass in database password _not_ on the command line? #360

Closed philCryoport closed 4 years ago

philCryoport commented 4 years ago

New Feature Request

Describe the solution you'd like We use SchemaCrawler to create a schema diagram from the command line. Currently the command we're using is: schemacrawler.cmd --server=mysql --database=%SCHEMA% --host=%DB_HOST% --port=3306 --user=%v2_dbuser% --password=%v2_dbpass% --info-level=standard --command=schema --portable-names --Gdpi=300 --output-format=scdot --output-file="%SUBFILENAME%-graph.dot" --log-level=INFO --useSSL=false --schemas=%SCHEMA%

Is there any way to run SchemaCrawler from the command line without specifying the database password?

Describe alternatives you've considered Perhaps take advantage of mysql_config_editor -- or failing that, refer to a credentials file, e.g.

[mysqldump]
user=<username>
password=<password>

Additional context Add any other context or screenshots about the feature request here.

sualeh commented 4 years ago

@philCryoport - I am trying to understand what the underlying concern is - please explain. Are you worried that the password would show up in plain-text in logs?

SchemaCrawler provides multiple ways to provide a password on the command-line. Have you explored those options before requesting a new way to read options?

--password=<password> Database password --password:env=<environment variable name> Database password, from an environmental variable value --password:file=<path to password file> Database password, read from a file --password:prompt Database password, prompted from the console

Have you tried something like this?

schemacrawler.cmd --server=mysql --database=%SCHEMA% --host=%DB_HOST% --port=3306 --user=%v2_dbuser% --password:env=v2_dbpass --info-level=standard --command=schema --portable-names --Gdpi=300 --output-format=scdot --output-file="%SUBFILENAME%-graph.dot" --log-level=INFO --useSSL=false --schemas=%SCHEMA%

If none of these options work for you, then you can write a custom wrapper (it is easy) that looks like ExecutableExample.java, and provide your database connection in a secure way that works for you.