Console history may leak user info
SuperYoko opened this issue · 8 comments
version:
./bin/nebula-console -v
nebula-console version Git: 3ce5151, Build Time: 2021-08-20T07:22:02+0000After a user log in as root and create a user called user9 with ******
root@yk-nebula:/usr/local/nebula# ./bin/nebula-console -addr 127.0.0.1 -port 9669 -u root -p ******
2021/09/28 09:08:28 [INFO] connection pool is initialized successfully
Welcome to Nebula Graph!
(root@nebula) [(none)]> create user user9 with password "*******"
Execution succeeded (time spent 6779/7846 us)
Tue, 28 Sep 2021 09:09:24 CST
(root@nebula) [(none)]> exit
Another user may login in with same environment as other user and find root's history (even with password).
root@yk-nebula:/usr/local/nebula# ./bin/nebula-console -addr 127.0.0.1 -port 9669 -u us001 -p ******
2021/09/28 09:10:38 [INFO] connection pool is initialized successfully
Welcome to Nebula Graph!
(us001@nebula) [(none)]> create user user9 with password "*******"
[ERROR (-1008)]: PermissionError: No permission to write user.
Tue, 28 Sep 2021 09:10:57 CST
Yes, it may leak user info.
What's the behavior of other shells?
Yes, it may leak user info. What's the behavior of other shells?
Other shells? Do you mean that nebula-console behave different in different shell?
Does it rely on any function of shells?
I'll try zsh and on windows powershell/cmd and give a report if you think it's necessary.
Yes, I wonder what the behaviour of zsh,bash and other database's console
Yes, I wonder what the behaviour of zsh,bash and other database's console
Tested, zsh's behavior is the same as bash's.
Yes, it may leak user info. What's the behavior of other shells?
Other shells? Do you mean that nebula-console behave different in different shell? Does it rely on any function of shells?
I'll try
zshand on windowspowershell/cmdand give a report if you think it's necessary.
Sorry, I didn't make it clear. Actually, I want to know what is the difference between nebula-console and other databases console or other shells in recording historical commands that contain passwords.
- nebula-console;
- other database's console: MySQL, neo4j's console;
- linux shell: bash, zsh;
- other database's console: MySQL, neo4j's console;
Get it.
- "nebula-console" will show history (include command with password) to any user loged in.
- Mysql will filter out user create command. Maybe we should consider more command that may leak info(username, password, table/graph name, etc.)
- Both linux shell will only show history of current users' past login, most password is asked after command and will not record, some inline password will leak from current user's history, while users can manually remove it.
Neo4j not deployed now, will try that later.
As we save the history in file, user can read the password in file directly.
same behavior with mycli.