Uploaded image for project: 'MongoDB Database Tools'
  1. MongoDB Database Tools
  2. TOOLS-2447

Improve processlist output

XMLWordPrintableJSON

    • Type: Icon: Epic Epic
    • Resolution: Fixed
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • 1
    • 0
    • Hide

      Engineer(s): Evgeni Dobranov
      Reviewer(s): Huan Li, Tim Fogarty

      2020-12-10: On track for Dec 18 (6 calendar weeks)
      Cost in Eng Weeks: Cost in Eng Weeks: 4 Original | 4 To Date | 6 Est Final

      • Code review discussion ongoing for both tickets in this epic.

      2020-11-29: Target date set to Dec 18 (6 calendar weeks)
      Cost in Eng Weeks: Cost in Eng Weeks: 4 Original | 3.5 To Date | 6 Est Final

      • Both tickets in this epic are in code review.

      2020-11-13: Target date TBD
      Cost in Eng Weeks: Cost in Eng Weeks: 4 Original | 2 To Date | 6 Est Final

      • We’ll update the target end date when more progress has been made on finalizing the design, which is almost complete.
      • During design, we determined that we should unbundle some non-critical items that were tacked on while scoping, since they would have a significant impact on time to deliver.
      Show
      Engineer(s): Evgeni Dobranov Reviewer(s): Huan Li, Tim Fogarty 2020-12-10: On track for Dec 18 (6 calendar weeks) Cost in Eng Weeks: Cost in Eng Weeks: 4 Original | 4 To Date | 6 Est Final Code review discussion ongoing for both tickets in this epic. 2020-11-29: Target date set to Dec 18 (6 calendar weeks) Cost in Eng Weeks: Cost in Eng Weeks: 4 Original | 3.5 To Date | 6 Est Final Both tickets in this epic are in code review. 2020-11-13: Target date TBD Cost in Eng Weeks: Cost in Eng Weeks: 4 Original | 2 To Date | 6 Est Final We’ll update the target end date when more progress has been made on finalizing the design, which is almost complete. During design, we determined that we should unbundle some non-critical items that were tacked on while scoping, since they would have a significant impact on time to deliver.

      Summary

      The scope for this project aims to determine what action, if any, is needed to prevent or mitigate the visibility of password arguments in ps output.

      Motivation

      Currently, there are two ways to provide a password to the tools. One is on the command line via the --password flag, and the other is via stdin (when --password="" or --username is set without --password). When the password is provided on the command line, it is visible in the output of ps (or, more generally, to anyone with access to the process table).

      Over the years, this behavior has been discussed in the context of the tools (TOOLS-1020), the server (SECURITY-26), and other products like the BI Connector (BI-846). The discussion resurfaced recently.

      Past discussions and product decisions do not clearly indicate the correct course of action for the tools. For example, the mongo shell overwrites passwords in the command-line with “x” characters, while the tools have elected not to do the same in the past, citing security concerns. The BI Connector has also elected not to obscure command-line passwords, as it is possible for users to provide passwords via other means.

            Assignee:
            evgeni.dobranov@mongodb.com Evgeni Dobranov
            Reporter:
            ryan.chipman@mongodb.com Ryan Chipman
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: