LinuxSA Mailing list archives

  From: David Newall <davidn@rebel.net.au>
  To  : Andrew Reid <andrew.reid@plug.cx>
  Date: Tue, 19 Jun 2001 15:38:23 +0930 (CST)

Re: Backup using FTP

> ncftpput allows you to specify usernames/passwords on the command line
> making it a good solution for a CRON-based backup script.

but a bad idea for security.  Anybody with shell access can view the
command line arguments using ps.  Even if the program changes it's
arguments after starting (which can only be done on some flavours of
unix) they are still there for all to see for some period of time; you
just have to win a race, which isn't that hard to do if you're prepared
to cheat a little.

Better to put passwords in files, that way at least they have to break
the system security.

-- 
LinuxSA WWW: http://www.linuxsa.org.au/  IRC: #linuxsa on irc.linux.org.au
To unsubscribe from the LinuxSA list:
  mail linuxsa-request@linuxsa.org.au with "unsubscribe" as the subject