username/password is displayed in Linux process list

[Dang Nguyen <da...@docusign.com>]

I use CruiseControl (continuous build system) to run hourly and nightly
builds.  Part of its task is to delete the local working copy and
checkout the latest from SVN.  I've noticed that when the checkout
occurs, the username and password that I pass on the command line is
displayed in plain text if I look at the process list (i.e., ps -ef).
This is obviously a real security problem.  Has this been reported
before?  The username and password should be masked, as I've seen other
applications do.
 
I am running svn 1.3.2 on a Redhat Linux 4 Enterprise Edition server.

Re: username/password is displayed in Linux process list

[Johnathan Gifford <jg...@wernervas.com>]

We use CruiseControl as well.  To get around this, we use an account that has only read rights to the repository.  We also cache those credentials on the box where the build happens.  The idea is that if someone can log onto the computer, it assumed they also have rights to build.  This allows us to not display that information in logs and screen consoles.

Not sure if you setup is like ours, but hope this helps,

Johnathan

>>> On Mon, Jan 29, 2007 at  1:22 PM, in message
<3A...@patron.docusignhq.com>, "Dang Nguyen"
<da...@docusign.com> wrote: 
> I use CruiseControl (continuous build system) to run hourly and nightly
> builds.  Part of its task is to delete the local working copy and
> checkout the latest from SVN.  I've noticed that when the checkout
> occurs, the username and password that I pass on the command line is
> displayed in plain text if I look at the process list (i.e., ps - ef).
> This is obviously a real security problem.  Has this been reported
> before?  The username and password should be masked, as I've seen other
> applications do.
>  
> I am running svn 1.3.2 on a Redhat Linux 4 Enterprise Edition server.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org

Re: username/password is displayed in Linux process list

[Kenneth Porter <sh...@sewingwitch.com>]

--On Monday, January 29, 2007 11:22 AM -0800 Dang Nguyen 
<da...@docusign.com> wrote:

> I use CruiseControl (continuous build system) to run hourly and nightly
> builds.  Part of its task is to delete the local working copy and
> checkout the latest from SVN.  I've noticed that when the checkout
> occurs, the username and password that I pass on the command line is
> displayed in plain text if I look at the process list (i.e., ps -ef).
> This is obviously a real security problem.  Has this been reported
> before?  The username and password should be masked, as I've seen other
> applications do.

Is it possible to pass the credentials in environment variables? I think 
this is one of the solutions Samba uses to prevent exposing them through 
process status utilities.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org