Repository navigation
Hide password #172
Description
Activity
Hi @SteveOgh ,
thanks opening an issue.What you can do is to write your password to an environment variable and use it in your call:
Linux/Unix:
export PW=myPassword utplsql run user/$PW@myConnectstringWindows:
$env:PW="myPassword" utplsql run user/$env:PW@myConnectstringThat way it is not shown and - as far as I know - not written to the command history.
It might still be useful to have another option. What comes to my mind:
- Get user, password and connectstring from (predefined, fixed) environment variables when they are not provided
- Prompt for password if it's not set
I prefer 1 over 2, because prompting might break automated setups and it's also harder to implement.
In linux using an environment-variable in/as a commandline parameter does not really hide the value (only in shell history).
It is possible for every user on the system to see the password while the utplsql is running with
ps -efExample
`
export PW=xx; sh -c "sleep 1; echo $PW"& ps -ef | grep echo
[2] 1881476
uwe 1881476 1312384 0 11:07 pts/2 00:00:00 sh -c sleep 1; echo xx
uwe 1881478 1312384 0 11:07 pts/2 00:00:00 grep --color=auto echo`
Hi there,
i am commenting this issue - hope it is okay to track it here:
Let's say i run something like:sh ./utPLSQL-cli/bin/utplsql run -c -q schema-tst/super-secure-pwd@tns-stringCan i hide the password at least from the DEBUG output?
In version 3.1.9 i always get the password printed like:14:37:26.505 [main] DEBUG org.utplsql.cli.Cli - Args: run, -c, -q, schema-tst/super-secure-pwd@tns-stringEDIT 7-AUG-2023: It is possible by placing a
logback.xmlfile in the lib folder with the following content:<configuration> <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender"> <encoder> <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern> </encoder> </appender> <root level="info"> <appender-ref ref="STDOUT" /> </root> </configuration>Reading a bit about Logback it says that Logback scans the classpath for such an .xml. In my case i had to create a ./etc directory:
>tree -D [Aug 7 20:43] . ├── [Aug 7 20:43] bin │ ├── [Aug 7 20:42] utplsql │ └── [Jun 13 2022] utplsql.bat ├── [Aug 7 20:43] etc │ └── [Aug 7 20:39] logback.xml └── [Aug 7 20:42] lib ├── [Jun 13 2022] cli-3.1.9.jar ├── [Jun 13 2022] java-api-3.1.9.jar ├── [Jun 13 2022] javax.activation-api-1.2.0.jar ├── [Jun 13 2022] jaxb-api-2.3.1.jar ├── [Jun 13 2022] jsr305-3.0.2.jar ├── [Jun 13 2022] logback-classic-1.2.11.jar ├── [Jun 13 2022] logback-core-1.2.11.jar ├── [Jun 13 2022] ojdbc8-19.3.0.0.jar ├── [Jun 13 2022] ons-19.3.0.0.jar ├── [Jun 13 2022] oraclepki-19.3.0.0.jar ├── [Jun 13 2022] orai18n-19.3.0.0.jar ├── [Jun 13 2022] osdt_cert-19.3.0.0.jar ├── [Jun 13 2022] osdt_core-19.3.0.0.jar ├── [Jun 13 2022] picocli-4.6.3.jar ├── [Jun 13 2022] simplefan-19.3.0.0.jar └── [Jun 13 2022] slf4j-api-1.7.36.jarI did find my classpath by adding an
echo $CLASSPATHin ./bin/utplsqlimho it still makes sense to change the logging level in the code to
TRACEReacted by Max SatulaHi,
With the upcoming changes the following issues are addressed:- username and password is never shown in logs (including debug mode)
- connections via oracle wallet are supported so no credentials need to be passed to
utPLSQL-cliat all
There is no plan currently to implement a solution to allow cli to use some specific environment variables to read user/password directly from shell instead of using parameters.
There will be probably a support for
jsonoryamlconfig file to handle configuration via file instead of relying strictly on command line. That could help also with managing and hiding passwords.Therefore PR #232 closes this issue
Looking for method(s) to hide the password portion of the for demos and scripts.