Stop using environment variables for sending database passwords to MariaDB/MySQL #1009

New issue

Closed

opened 2025-02-25 22:27:47 +00:00 by witten · 3 comments

witten commented

2025-02-25 22:27:47 +00:00

Owner

What I'd like to do and why

Providing passwords to MariaDB/MySQL via environment variable (e.g. MYSQL_PWD, which borgmatic uses today) is considered insecure. That's likely because the password can potentially be spied upon by child processes or, with root access, by looking at OS-level process metadata.

So as part of this ticket, modify the borgmatic MariaDB and MySQL hooks to pass the configured password to the database client command via a more secure mechanism.

Other notes / implementation ideas

One idea is to use the mariadb/mysql --defaults-extra-file flag to pass in a temporary file path that contains something like:

[client]
user=someusername
password=thepassword

However, this would have to be done very carefully to avoid potentially leaking the password via that file, say if the permissions aren't sufficiently restrictive or an attacker puts something at the file path before borgmatic writes to it.

Ideally, we could instead give the password to mariadb/mysql via an anonymous pipe like we do with the Borg encryption passphase, but that doesn't appear possible in this case.

A related alternative might be to pass a named pipe containing the password to --defaults-extra-file, but it's unclear that that's any more secure than a standard file for this use case.

### What I'd like to do and why Providing passwords to MariaDB/MySQL via environment variable (e.g. `MYSQL_PWD`, which borgmatic uses today) is [considered insecure](https://mariadb.com/kb/en/mariadb-environment-variables/). That's likely because the password can potentially be spied upon by child processes or, with root access, by looking at OS-level process metadata. So as part of this ticket, modify the borgmatic MariaDB and MySQL hooks to pass the configured password to the database client command via a more secure mechanism. ### Other notes / implementation ideas One idea is to use the `mariadb`/`mysql` `--defaults-extra-file` flag to pass in a temporary file path that contains something like: ```ini [client] user=someusername password=thepassword ``` However, this would have to be done very carefully to avoid potentially leaking the password via that file, say if the permissions aren't sufficiently restrictive or an attacker puts something at the file path before borgmatic writes to it. Ideally, we could instead give the password to `mariadb`/`mysql` via an anonymous pipe like we do with the Borg encryption passphase, but that doesn't appear possible in this case. A related alternative might be to pass a *named* pipe containing the password to `--defaults-extra-file`, but it's unclear that that's any more secure than a standard file for this use case.

👍 1

witten referenced this issue

2025-02-25 22:28:45 +00:00

WARNING: option --ssl-verify-server-cert is disabled, because of an insecure passwordless login. #1006

witten commented

2025-02-26 00:46:50 +00:00

Author

Owner

I actually managed to get a prototype working with an anonymous pipe!

$ ipython
...
In [1]: import os

In [2]: import subprocess

In [3]: import shlex

In [4]: read_file_descriptor, write_file_descriptor = os.pipe()
   ...: os.write(write_file_descriptor, '[client]\nuser=test\npassword=pass'.encode('utf-8'))
   ...: os.close(write_file_descriptor)

In [5]: subprocess.check_call(shlex.split("mariadb --defaults-extra-file=/dev/stdin --skip-ssl --host localhost --protocol tcp --skip-column-names
   ...:  --execute 'show schemas'"), stdin=read_file_descriptor)
information_schema
test
Out[5]: 0

I actually managed to get a prototype working with an anonymous pipe! ```python $ ipython ... In [1]: import os In [2]: import subprocess In [3]: import shlex In [4]: read_file_descriptor, write_file_descriptor = os.pipe() ...: os.write(write_file_descriptor, '[client]\nuser=test\npassword=pass'.encode('utf-8')) ...: os.close(write_file_descriptor) In [5]: subprocess.check_call(shlex.split("mariadb --defaults-extra-file=/dev/stdin --skip-ssl --host localhost --protocol tcp --skip-column-names ...: --execute 'show schemas'"), stdin=read_file_descriptor) information_schema test Out[5]: 0 ```

witten referenced this issue from a commit

2025-02-27 18:16:30 +00:00

Send MariaDB passwords via anonymous pipe instead of environment variable (#1009)

witten referenced this issue

2025-02-27 18:19:59 +00:00

Send MariaDB passwords via anonymous pipe instead of environment variable (#1009) #1011

witten referenced this issue from a commit

2025-02-27 18:43:28 +00:00

Send MySQL passwords via anonymous pipe instead of environment variable (#1009).

witten referenced this issue from a commit

2025-02-28 16:37:41 +00:00

Get existing unit tests passing (#1009).