1

I know that using a password in the command line is a bad idea because bash commands can be recorded in history.

If I run a command in the chef bash resource though, when I look up the history I don't see any entries.

Does this mean that the Chef bash resource does not record it's history? Is it safe to use a password in the Chef bash resource?

| improve this question | |
  • 1
    The same way as doing bash -c command doesn't record command (and if you prepend bash with a space, none will be logged) Logging history is specific to login (interactive) launch of bash. That said using the bash resource shouold be a last resort and there's usually indication a custom resource using shell_out would be more appropriate. – Tensibai Apr 25 '18 at 15:38
  • It's not clear to me which thread vector you have in mind with your question. If you just want to prevent writing the password to disk, you'll also have to set the "sensitive" value inside the resource block or chef will log it in clear text to /var/log/chef (or where your chef-client is configured to log to). However on Linux everything that's entered on the command line and/or through environment variables at run-time is accessible to root users and the owner of the process through the /proc filesystem(/proc/$pid/cmdline, /proc/$pid/environ for example). – Roland Apr 25 '18 at 17:40
  • That is not the only reason; they would also be visible if someone did ps -eF at the appropriate time – Gaius Aug 29 '19 at 5:04
1

In this case, the best way would be to use chef data bags which is specifically known for this. A great documentation is given at https://docs.chef.io/data_bags.html

Also, As Roland pointed above in the comment, make sure to use sensitive true in your bash resource to avoid any such information printed on screen or going to the logs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.