Re: [Duplicity-talk] duply shows sensitive data in process listing

[edgar . soldin]

cool hack, but still not 100 percent secure. I opt for 
URL_PASSWORD/URL_USERNAME (keeping FTP_PASSWORD for backward 
compatibility, but ftp only as documented) as a short term solution.

Regarding using configuration file I'd suggest a configuration per 
backend url so that different targets are possible. E.g.

duplicity /path1 ftp://myserver.de/backup1
duplicity /path2 ftp://myserver.de/backup2
duplicity /path3 sftp://myotherserver.de/backup3

--.duplicity_rc-->
[global]
attempts=25

# for all ftp://myserver.de/*
[ftp://myserver.de]
user=
pass=

# special settings for this backup
[ftp://myserver.de/backup]
asynchronous_transfer=yes

[sftp://myotherserver.de]
user=
pass=
<--

easier to implement would sure be a --profile .duplicity/mybackup.conf 
option.


.. niceness ede


On 06.01.2010 03:51, Scott Hannahs wrote:
> can't the application immediately copy the argv list to a temporary array and 
> overwrite the command line arguments.  This way they do not show up in the 
> process status command unless one gets a process status in the few milliseconds 
> between launch and command line processing begins.
>
> -sth
>
> On Jan 5, 2010, at 2:52 PM, Kenneth Loafman wrote:
>
> > Yes to both.  I'm thinking something like URL_PASSWORD/URL_USERNAME
> > could be used, but we'd be better off doing away with environment vars
> > anyway, and use something like a .duplicity_rc file for the defaults and
> > credentials.
> >
> > ...Ken
> >
> > address@hidden wrote:
> > > I will modify duply accordingly. Still:
> > >
> > > a) Wouldn't it make sense to do the same for the username?
> > > b) Also, shouldn't the FTP_PASSWORD be made deprecated and a env var
> > > called URL_PASSWORD or BACKEND_PASSWORD be introduced if the variable
> > > works for all backends?
> > >
> > > .. ede
> > >
> > >
> > > On 04.01.2010 13:17, Kenneth Loafman wrote:
> > > > address@hidden wrote:
> > > > > But what about the others? .. ede
> > > >
> > > > All of the protocols except S3 should take the password from the
> > > > environment variable FTP_PASSWORD, however, if the user specifies it in
> > > > the URL, I don't know a way to obscure it from ps and friends.
>
>
> _______________________________________________
> Duplicity-talk mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/duplicity-talk