1

I have an expect script on my server which opens a WebDAV connection to another server, expects a username and password, and then sends $arg1 and $arg2 as the username and password respectively.

Example: Running the script:

# ./script.exp username password

This executes the script with username and password as arguments. Specifically, this script is executed with php, which grabs the variables from a database:

<?php
    exec("expect script.exp $username $password");

The main issue with this is that those parameters can be seen with a ps aux call.

Q) Assuming only I have access to the server and filesystem, would it still be safe even though the password can be seen by listing ps aux?

An pseudo example of my expect script:

    //Webdav connection established, target server prompts me for username
    expect "Enter Username" 
    send "$arg1\r" 
    //Target server accepts username, now prompts me for password
    expect "Enter Password"
    send "$arg2\r"

If this is not safe, or if the php exec() is unsafe, what is a better way to execute my script and pass the username and password to it?

  • Are you able to modify the script or is it out of your control? – thexacre Sep 6 '14 at 12:27
0

If someone had access to the filesystem of the server, they could also read the password. If you run a ls -al /proc/<pid-of-another-users-process>/cmdline command, you can see that it can be read by everyone.

There are multiple ways of how to solve this.

The first stdin approach

First, you start a process in php, and then communicate with it through stdin/stdout pipes: tutorial, manual.

The expect script reads from the stdin and stores the username and password into variables:

#!/usr/bin/expect
# Read input to stdin
expect_user -re "(.*)\n"
set username $expect_out(1,string)
expect_user -re "(.*)\n"
set password $expect_out(1,string)
#only for testing purposes:
puts "got $username!"
puts "got $password!"

The second stdin approach

If you run expect in the console, you can see that it accepts its program from stdin. You can invoke a new process expect, and give it an expect script created in your php script, with the password hardcoded, through stdin. It may be possible you need to close the stream to get the code executed. Make sure you make the right escapes to not turn this into a expect code injection vulnerability.

The temporary file approach

You can write the username and the password into a temporary file (filename unique to the current invocation!) and read it from the expect script later. Or you can even generate a temporary expect script with the password hardcoded, but I'd recommend against it, as its too hacky. The file should be only accessible by your current user.

  • Please clarify. stdin isn't slower than other methods. – user10008 Sep 6 '14 at 23:10
  • Does one need to worry about serialization when using stdin with web apps? – suhdo Sep 7 '14 at 4:45
  • No. FastCGI is transparent in this issue. There is a unique stdin per request. – user10008 Sep 7 '14 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.