1

I know that using a password in the command line is a bad idea because bash commands can be recorded in history.

If I run a command in the chef bash resource though, when I look up the history I don't see any entries.

Does this mean that the Chef bash resource does not record it's history? Is it safe to use a password in the Chef bash resource?

|improve this question
  • 1
    The same way as doing bash -c command doesn't record command (and if you prepend bash with a space, none will be logged) Logging history is specific to login (interactive) launch of bash. That said using the bash resource shouold be a last resort and there's usually indication a custom resource using shell_out would be more appropriate. – Tensibai♦ Apr 25 '18 at 15:38
  • It's not clear to me which thread vector you have in mind with your question. If you just want to prevent writing the password to disk, you'll also have to set the "sensitive" value inside the resource block or chef will log it in clear text to /var/log/chef (or where your chef-client is configured to log to). However on Linux everything that's entered on the command line and/or through environment variables at run-time is accessible to root users and the owner of the process through the /proc filesystem(/proc/$pid/cmdline, /proc/$pid/environ for example). – Roland Apr 25 '18 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.