Skip to content

remote-backup.sh: find a way to protect duplicity against ps #739

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
0pdd opened this issue Dec 3, 2017 · 3 comments
Open

remote-backup.sh: find a way to protect duplicity against ps #739

0pdd opened this issue Dec 3, 2017 · 3 comments
Labels
area/security environment/prod Issue affects only production environment techdebt

Comments

@0pdd
Copy link

0pdd commented Dec 3, 2017 •
edited by php-coder
Loading

The puzzle 705-eb60edc9 (from #705) in vagrant/provisioning/roles/mystamps-backup/tasks/main.yml (lines 64-64) has to be resolved: "remote-backup.sh: find a way to protect duplicity against ps"

The puzzle was created by Slava Semushin on 03-Dec-17.

Tech debt for: 57e4cc1 (#705)
0pdd referenced this issue Dec 3, 2017
@php-coder
Rework backup to remote host to reduce possibility to see a password …
57e4cc1 
…in a plain text.

Fix #705
@php-coder php-coder changed the title main.yml:64-64: remote-backup.sh: find a way to... remote-backup.sh: find a way to protect duplicity against ps Dec 3, 2017
@php-coder php-coder added techdebt environment/prod Issue affects only production environment area/security labels Dec 3, 2017
@php-coder
Copy link
Owner

It seems like gpg-agent may help: https://wiki.archlinux.org/index.php/Duplicity

@php-coder php-coder mentioned this issue Sep 29, 2019
Open
@php-coder
Copy link
Owner

This might get even worse: when we use su/sudo the command could that is executed is logged to system journals and might appear in some reports. Given that the command contains login and password, this might lead to a security issue.

@php-coder
Copy link
Owner

Another way to see the credential is to inspect /prod/{PID}/cmdline file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/security environment/prod Issue affects only production environment techdebt
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@php-coder @0pdd