I know that using a password in the command line is a bad idea because bash commands can be recorded in history.
If I run a command in the chef bash resource though, when I look up the history I don't see any entries.
Does this mean that the Chef bash resource does not record it's history? Is it safe to use a password in the Chef bash resource?
bash -c command
doesn't recordcommand
(and if you prepend bash with a space, none will be logged) Logging history is specific to login (interactive) launch of bash. That said using the bash resource shouold be a last resort and there's usually indication a custom resource using shell_out would be more appropriate. – Tensibai Apr 25 '18 at 15:38/var/log/chef
(or where your chef-client is configured to log to). However on Linux everything that's entered on the command line and/or through environment variables at run-time is accessible to root users and the owner of the process through the /proc filesystem(/proc/$pid/cmdline
,/proc/$pid/environ
for example). – Roland Apr 25 '18 at 17:40