6/23/2006
MySQL Client Security on the Command Line
The MySQL client allows specifying the database password on the command line using the following parameters:
mysql -utheusername -pthepassword thedatabasename
If you are in a habit of doing this… STOP NOW!
If you are using a shell like Bash, the password is saved in the bash_history file. Should anyone into the server, they can easily get your MySQL password by viewing the history file.
Altering the command line to:
mysql -utheusername -p thedatabasename
Causes MySQL to ask for the password, so that it cannot be stored in the history.
Proper security is layered. Just because one account password is hacked, doesn’t mean you should give away the keys to MySQL too!
Popularity: 14%
March 24th, 2008 at 7:27 pm
good point.
likewise, mysql client logs all commands to $HOME/.mysql_history by default (at least on debian), which exposes all passwords that you set on the mysql shell to all who can read this file.
cheerio!