Question

Let’s say I have written a Perl script called “foo.pl” that takes in a password argument via the -p switch.

However, while it is running, anyone can do a ps and see the entire command-line string, including the password:

$ ps a |grep 'foo\.pl'
32310 pts/4    S+     0:00 /usr/bin/perl -w ./foo.pl -p password
32313 pts/5    S+     0:00 grep foo.pl

What is the easiest/simplest way to hide the password and replace it with something like xxxxxx?

Answer 1

Ask for the password from inside the script, so you don’t have to pass it as an argument.

---

Update

Apparently this work for me, simulating a mysql behaviour:

#!/usr/bin/perl
($0 = "$0 @ARGV") =~ s/--password=\K\S+/x/;
<STDIN>;

$ ./s --user=me --password=secret
^Z
$ ps
  PID TTY           TIME CMD
 1637 ttys000    0:00.12 -bash
 2013 ttys000    0:00.00 ./s --user=me --password=x

Under MacOS 10.6