MongoDB Password leaked to Log #848

New Issue

Closed

opened 2024-04-11 06:41:11 +00:00 by marcohald · 3 comments

marcohald commented 2024-04-11 06:41:11 +00:00

Copy Link

What I'm trying to do and why

when configuring the mongodb Backup like this:

mongodb_databases:
    - name: test
      hostname: 127.0.0.1
      port: 27018
      username: mongoadmin
      password: test
      authentication_database: admin

The Password is logged in cleartext

Steps to reproduce

No response

Actual behavior

DEBUG mongodump --host 127.0.0.1 --port 27018 --username mongoadmin --password test --authenticationDatabase admin --db test --archive

Expected behavior

Password should be not logged

Other notes / implementation ideas

maybe like in this answer https://stackoverflow.com/a/63568946/10966928
store the pw in a tempfile and pipe it to mongodump

borgmatic version

1.8.2

borgmatic installation method

Debian package

Borg version

No response

Python version

No response

Database version (if applicable)

No response

Operating system and version

No response

### What I'm trying to do and why when configuring the mongodb Backup like this: ``` mongodb_databases: - name: test hostname: 127.0.0.1 port: 27018 username: mongoadmin password: test authentication_database: admin ``` The Password is logged in cleartext ### Steps to reproduce _No response_ ### Actual behavior DEBUG mongodump --host 127.0.0.1 --port 27018 --username mongoadmin --password test --authenticationDatabase admin --db test --archive ### Expected behavior Password should be not logged ### Other notes / implementation ideas maybe like in this answer https://stackoverflow.com/a/63568946/10966928 store the pw in a tempfile and pipe it to mongodump ### borgmatic version 1.8.2 ### borgmatic installation method Debian package ### Borg version _No response_ ### Python version _No response_ ### Database version (if applicable) _No response_ ### Operating system and version _No response_

witten commented 2024-04-11 14:52:24 +00:00

Owner

Copy Link

Thanks for taking the time to file this! Avoiding the logging of the password makes sense to me, and I like the idea of passing it to mongodump via file instead of command-line. Other borgmatic database hooks pass passwords via environment variable, but that doesn't seem to be an option here.

Thanks for taking the time to file this! Avoiding the logging of the password makes sense to me, and I like the idea of passing it to `mongodump` via file instead of command-line. Other borgmatic database hooks pass passwords via environment variable, but that doesn't seem to be an option here.

witten added the

good first issue

security

labels 2024-04-11 14:53:00 +00:00

witten referenced this issue from a commit 2024-04-16 17:20:47 +00:00

Mask the password when logging a MongoDB dump or restore command (#848).

witten commented 2024-04-16 17:21:45 +00:00

Owner

Copy Link

I couldn't get the temporary password file working, so I ended up just masking the command-line password value as it's logged. Implemented in main and soon to be released.

Thanks again!

I couldn't get the temporary password file working, so I ended up just masking the command-line password value as it's logged. Implemented in main and soon to be released. Thanks again!

witten closed this issue 2024-04-16 17:21:45 +00:00

witten commented 2024-04-16 17:45:30 +00:00

Owner

Copy Link

Released in 1.8.10!

Released in 1.8.10!

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

config-command-line

1.9.14

1.9.13

1.9.12

1.9.11

1.9.10

1.9.9

1.9.8

1.9.7

1.9.6

1.9.5

1.9.4

1.9.3

1.9.2

1.9.1

1.9.0

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

1.7.7

1.7.6

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.6.6

1.6.5

1.6.4

1.6.3

1.6.2

1.6.1

1.6.0

1.5.24

1.5.23

1.5.22

1.5.21

1.5.20

1.5.19

1.5.18

1.5.17

1.5.16

1.5.15

1.5.14

1.5.13

1.5.12

1.5.11

1.5.10

1.5.9

1.5.8

1.5.7

1.5.7.dev0

1.5.6

1.5.5

1.5.4

1.5.3

1.5.2

1.5.1

1.5.0

1.4.22

1.4.21

1.4.20

1.4.19

1.4.18

1.4.17

1.4.16

1.4.15

1.4.14

1.4.13

1.4.12

1.4.11

1.4.10

1.4.9

1.4.8

1.4.7

1.4.6

1.4.5

1.4.4

1.4.3

1.4.2

1.4.1

1.4.0

1.3.26

1.3.25

1.3.24

1.3.23

1.3.22

1.3.21

1.3.20

1.3.19

1.3.18

1.3.17

1.3.16

1.3.15

1.3.14

1.3.13

1.3.12

1.3.11

1.3.10

1.3.9

1.3.8

1.3.7

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3.1

1.3.0

1.2.18

1.2.17

1.2.16

1.2.15

1.2.14

1.2.13

1.2.12

1.2.11

1.2.10

1.2.9

1.2.8

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2.1

1.2.0

1.1.15

1.1.14

1.1.13

1.1.12

1.1.11

1.1.10

1.1.9

1.1.7

1.1.6

1.1.5

1.1.4

1.1.3

1.1.2

1.1.1

1.1.0

1.0.3

1.0.2

1.0.1

1.0.0

0.1.8

0.1.7

0.1.6

0.1.5

0.1.4

0.1.3

0.1.2

0.1.1

0.1.0

0.0.7

0.0.6

0.0.5

0.0.4

0.0.3

0.0.2

Labels

Clear labels

blocked

bug

data loss

design finalized

good first issue

new feature area

question / support

security

waiting for response

No Label

good first issue

security

Milestone

No items

No Milestone

Assignees

Clear assignees

diivi import_bot witten

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: borgmatic-collective/borgmatic#848

No description provided.