Re: username/password is displayed in Linux process list

We use CruiseControl as well. To get around this, we use an account that has only read rights to the repository. We also cache those credentials on the box where the build happens. The idea is that if someone can log onto the computer, it assumed they also have rights to build. This allows us to not display that information in logs and screen consoles.

Not sure if you setup is like ours, but hope this helps,

Johnathan

>>> On Mon, Jan 29, 2007 at 1:22 PM, in message
<3A5B915AA10F9F4E9A77699659CDF3B5019ED1C8@patron.docusignhq.com>, "Dang Nguyen"
<dang@docusign.com> wrote:
> I use CruiseControl (continuous build system) to run hourly and nightly
> builds. Part of its task is to delete the local working copy and
> checkout the latest from SVN. I've noticed that when the checkout
> occurs, the username and password that I pass on the command line is
> displayed in plain text if I look at the process list (i.e., ps - ef).
> This is obviously a real security problem. Has this been reported
> before? The username and password should be masked, as I've seen other
> applications do.
>
> I am running svn 1.3.2 on a Redhat Linux 4 Enterprise Edition server.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Received on Mon Jan 29 20:33:05 2007