borgmatic-collective/borgmatic
borgmatic-collective
/
borgmatic
14
57
Fork 41
Code Issues 54 Pull Requests 2 Actions Packages Releases 122 Activity

MongoDB Password leaked to Log #848

New Issue
Closed
opened 2024-04-11 06:41:11 +00:00 by marcohald · 3 comments
marcohald commented 2024-04-11 06:41:11 +00:00
Copy Link

What I'm trying to do and why

when configuring the mongodb Backup like this:

mongodb_databases:
    - name: test
      hostname: 127.0.0.1
      port: 27018
      username: mongoadmin
      password: test
      authentication_database: admin

The Password is logged in cleartext

Steps to reproduce

No response

Actual behavior

DEBUG mongodump --host 127.0.0.1 --port 27018 --username mongoadmin --password test --authenticationDatabase admin --db test --archive

Expected behavior

Password should be not logged

Other notes / implementation ideas

maybe like in this answer https://stackoverflow.com/a/63568946/10966928
store the pw in a tempfile and pipe it to mongodump

borgmatic version

1.8.2

borgmatic installation method

Debian package

Borg version

No response

Python version

No response

Database version (if applicable)

No response

Operating system and version

No response

### What I'm trying to do and why when configuring the mongodb Backup like this: ``` mongodb_databases: - name: test hostname: 127.0.0.1 port: 27018 username: mongoadmin password: test authentication_database: admin ``` The Password is logged in cleartext ### Steps to reproduce _No response_ ### Actual behavior DEBUG mongodump --host 127.0.0.1 --port 27018 --username mongoadmin --password test --authenticationDatabase admin --db test --archive ### Expected behavior Password should be not logged ### Other notes / implementation ideas maybe like in this answer https://stackoverflow.com/a/63568946/10966928 store the pw in a tempfile and pipe it to mongodump ### borgmatic version 1.8.2 ### borgmatic installation method Debian package ### Borg version _No response_ ### Python version _No response_ ### Database version (if applicable) _No response_ ### Operating system and version _No response_
witten commented 2024-04-11 14:52:24 +00:00
Owner
Copy Link

Thanks for taking the time to file this! Avoiding the logging of the password makes sense to me, and I like the idea of passing it to mongodump via file instead of command-line. Other borgmatic database hooks pass passwords via environment variable, but that doesn't seem to be an option here.

Thanks for taking the time to file this! Avoiding the logging of the password makes sense to me, and I like the idea of passing it to `mongodump` via file instead of command-line. Other borgmatic database hooks pass passwords via environment variable, but that doesn't seem to be an option here.
witten added the
good first issue
security
 labels 2024-04-11 14:53:00 +00:00
witten commented 2024-04-16 17:21:45 +00:00
Owner
Copy Link

I couldn't get the temporary password file working, so I ended up just masking the command-line password value as it's logged. Implemented in main and soon to be released.

Thanks again!

I couldn't get the temporary password file working, so I ended up just masking the command-line password value as it's logged. Implemented in main and soon to be released. Thanks again!
witten commented 2024-04-16 17:45:30 +00:00
Owner
Copy Link

Released in 1.8.10!

Released in 1.8.10!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
main
spot-check
1.8.11
1.8.10
1.8.9
1.8.8
1.8.7
1.8.6
1.8.5
1.8.4
1.8.3
1.8.2
1.8.1
1.8.0
1.7.15
1.7.14
1.7.13
1.7.12
1.7.11
1.7.10
1.7.9
1.7.8
1.7.7
1.7.6
1.7.5
1.7.4
1.7.3
1.7.2
1.7.1
1.7.0
1.6.6
1.6.5
1.6.4
1.6.3
1.6.2
1.6.1
1.6.0
1.5.24
1.5.23
1.5.22
1.5.21
1.5.20
1.5.19
1.5.18
1.5.17
1.5.16
1.5.15
1.5.14
1.5.13
1.5.12
1.5.11
1.5.10
1.5.9
1.5.8
1.5.7
1.5.7.dev0
1.5.6
1.5.5
1.5.4
1.5.3
1.5.2
1.5.1
1.5.0
1.4.22
1.4.21
1.4.20
1.4.19
1.4.18
1.4.17
1.4.16
1.4.15
1.4.14
1.4.13
1.4.12
1.4.11
1.4.10
1.4.9
1.4.8
1.4.7
1.4.6
1.4.5
1.4.4
1.4.3
1.4.2
1.4.1
1.4.0
1.3.26
1.3.25
1.3.24
1.3.23
1.3.22
1.3.21
1.3.20
1.3.19
1.3.18
1.3.17
1.3.16
1.3.15
1.3.14
1.3.13
1.3.12
1.3.11
1.3.10
1.3.9
1.3.8
1.3.7
1.3.6
1.3.5
1.3.4
1.3.3
1.3.2
1.3.1
1.3.0
1.2.18
1.2.17
1.2.16
1.2.15
1.2.14
1.2.13
1.2.12
1.2.11
1.2.10
1.2.9
1.2.8
1.2.7
1.2.6
1.2.5
1.2.4
1.2.3
1.2.2
1.2.1
1.2.0
1.1.15
1.1.14
1.1.13
1.1.12
1.1.11
1.1.10
1.1.9
1.1.7
1.1.6
1.1.5
1.1.4
1.1.3
1.1.2
1.1.1
1.1.0
1.0.3
1.0.2
1.0.1
1.0.0
0.1.8
0.1.7
0.1.6
0.1.5
0.1.4
0.1.3
0.1.2
0.1.1
0.1.0
0.0.7
0.0.6
0.0.5
0.0.4
0.0.3
0.0.2
Labels
Clear labels   
bug

   
data loss

   
design finalized

   
good first issue

   
new feature area

   
question / support

   
security

   
waiting for response
No Label
bug
data loss
design finalized
good first issue
new feature area
question / support
security
waiting for response
Milestone
Clear milestone
No items
No Milestone
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: borgmatic-collective/borgmatic#848
No description provided.
Delete Branch "%!s(<nil>)"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?