Stop using --password for sending database passwords to MongoDB #1013

New issue

Closed

opened 2025-03-01 17:13:39 +00:00 by witten · 4 comments

witten commented

2025-03-01 17:13:39 +00:00

Owner

What I'd like to do and why

Providing passwords to MongoDB via command-line (specifically --password, which borgmatic uses today) is not great from a security perspective. That's because the full command-line shows up via tools like ps.

So as part of this ticket, modify the borgmatic MongoDB hook to pass the configured password to the database client command via a more secure mechanism.

Other notes / implementation ideas

#1009 changed the MariaDB/MySQL hooks to use an anonymous pipe instead of an environment variable for transmitting the database password. A similar approach could work for MongoDB. It might go something like this:

Remove the use of --password. The idea is that MongoDB will then expect the password on stdin, which we can provide as follows.
Add the use of < /def/fd/[file descriptor number] shell redirection where [file descriptor number] is the file descriptor of an anonymous pipe created for this purpose.
Populate the anonymous pipe with the database password.

### What I'd like to do and why Providing passwords to MongoDB via command-line (specifically `--password`, which borgmatic uses today) is not great from a security perspective. That's because the full command-line shows up via tools like `ps`. So as part of this ticket, modify the borgmatic MongoDB hook to pass the configured password to the database client command via a more secure mechanism. ### Other notes / implementation ideas #1009 changed the MariaDB/MySQL hooks to use an anonymous pipe instead of an environment variable for transmitting the database password. A similar approach could work for MongoDB. It might go something like this: * Remove the use of `--password`. The idea is that MongoDB will then expect the password on stdin, which we can provide as follows. * Add the use of `< /def/fd/[file descriptor number]` shell redirection where `[file descriptor number]` is the file descriptor of an anonymous pipe created for this purpose. * Populate the anonymous pipe with the database password.

witten commented

2025-03-01 17:18:27 +00:00

Author

Owner

This approach works for dumping, but it doesn't work for restore because stdin is already used by the streaming extract process and therefore isn't available for sending the password to mongorestore. Closing wontfix for now, but I'll reopen if anyone thinks of a better approach.

This approach works for dumping, but it doesn't work for restore because stdin is already used by the streaming extract process and therefore isn't available for sending the password to `mongorestore`. Closing wontfix for now, but I'll reopen if anyone thinks of a better approach.

witten closed this issue

2025-03-01 17:18:27 +00:00

witten commented

2025-03-01 17:40:24 +00:00

Author

Owner

Well, that didn't take long! The better approach is to use --config /dev/fd/[file descriptor number], populating that anonymous pipe with password: thepassword.

Well, that didn't take long! The better approach is to use `--config /dev/fd/[file descriptor number]`, populating that anonymous pipe with `password: thepassword`.

witten reopened this issue

2025-03-01 17:40:24 +00:00

witten referenced this issue from a commit

2025-03-01 18:04:23 +00:00

Send database passwords to MongoDB via anonymous pipe (#1013).

witten commented

2025-03-01 18:04:31 +00:00

Author

Owner

Implemented in main and will be part of the next release!

witten closed this issue

2025-03-01 18:04:31 +00:00