diff options
| author | Alexey Yurchenko <ayurchen@gmail.com> | 2015-06-06 01:08:41 +0300 |
|---|---|---|
| committer | Nirbhay Choubey <nirbhay@mariadb.com> | 2015-09-09 22:29:03 -0400 |
| commit | 86ee30cea95b4a3c8b34398e75e4fc62d0501616 (patch) | |
| tree | 62b43cc16417537c889584356b48ae50030ba46a /scripts/wsrep_sst_mysqldump.sh | |
| parent | 197e9d2559907b97905f7d1536b481bba2e9ffe3 (diff) | |
| download | mariadb-git-86ee30cea95b4a3c8b34398e75e4fc62d0501616.tar.gz | |
Refs codership/mysql-wsrep#141: this commit
1. Passes wsrep_sst_auth_value to SST scripts via WSREP_SST_OPT_AUTH envronmental variable, so it never appears on the command line
2. In mysqldump and xtrabackup* SST scripts which rely on MySQL authentication, instead of passing password on the command line, SST script sets MYSQL_PWD environment variable, so that password also never appears on the mysqldump/innobackupex command line.
Diffstat (limited to 'scripts/wsrep_sst_mysqldump.sh')
| -rw-r--r-- | scripts/wsrep_sst_mysqldump.sh | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/scripts/wsrep_sst_mysqldump.sh b/scripts/wsrep_sst_mysqldump.sh index 9a061f89e43..7a5695851d4 100644 --- a/scripts/wsrep_sst_mysqldump.sh +++ b/scripts/wsrep_sst_mysqldump.sh @@ -76,6 +76,17 @@ fi # word, it is arguably more secure than passing password on the command line. [ -n "$WSREP_SST_OPT_PSWD" ] && export MYSQL_PWD="$WSREP_SST_OPT_PSWD" +# Refs https://github.com/codership/mysql-wsrep/issues/141 +# Passing password in MYSQL_PWD environment variable is considered +# "extremely insecure" by MySQL Guidelines for Password Security +# (https://dev.mysql.com/doc/refman/5.6/en/password-security-user.html) +# that is even less secure than passing it on a command line! It is doubtful: +# the whole command line is easily observable by any unprivileged user via ps, +# whereas (at least on Linux) unprivileged user can't see process environment +# that he does not own. So while it may be not secure in the NSA sense of the +# word, it is arguably more secure than passing password on the command line. +[ -n "$WSREP_SST_OPT_PSWD" ] && export MYSQL_PWD="$WSREP_SST_OPT_PSWD" + STOP_WSREP="SET wsrep_on=OFF;" # mysqldump cannot restore CSV tables, fix this issue |