suganoo / s3fs

Automatically exported from code.google.com/p/s3fs
0 stars 0 forks source link

Access keys are displayed in process list #88

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago
What steps will reproduce the problem?
1. run s3fs with access key arguments
2. run ps command
3. access keys are displayed

What is the expected output? What do you see instead?
Access keys should be obfuscated.  (there should be a coding example in htdig 
source code, since I believe the htsearch binary hides passwords like this)

What version of the product are you using? On what operating system?
r191 - CentOS 5.5 x86

Please provide any additional information below.

Original issue reported on code.google.com by warbirdc...@gmail.com on 17 Jun 2010 at 2:42

GoogleCodeExporter commented 8 years ago
I realized later that you can work around this by using the /etc/passwd-s3fs 
file.  Feel free to close this out.

Original comment by warbirdc...@gmail.com on 17 Jun 2010 at 4:33

GoogleCodeExporter commented 8 years ago
This appears to be a security hole. I researched this a little bit and could 
not find how to prevent the process table from picking up the command line 
options. (one way was to use a wrapper, ugly).

An easy way to plug this hole to is to force the usage of a password file. Of 
course, not every user has write access to /etc/passwd-s3fs, so providing a 
default location in the user's home directory is an option as well as providing 
a command line option to specify the location of the file.

Any other ideas?

Original comment by dmoore4...@gmail.com on 21 Oct 2010 at 4:05

GoogleCodeExporter commented 8 years ago
Mainly a question for Randy and Adrian: How do you feel about closing this 
security hole but removing the command line options that specify the keys?  
There are now several other ways for non-privileged users to specify 
credentials without exposing them.

Original comment by dmoore4...@gmail.com on 8 Nov 2010 at 4:01

GoogleCodeExporter commented 8 years ago

Original comment by dmoore4...@gmail.com on 20 Nov 2010 at 6:09

GoogleCodeExporter commented 8 years ago
This issue was closed by revision r243.

Original comment by dmoore4...@gmail.com on 21 Nov 2010 at 1:30