I have an expect script on my server which opens a WebDAV connection to another server, expects a username and password, and then sends $arg1 and $arg2 as the username and password respectively.
Example: Running the script:
# ./script.exp username password
This executes the script with username and password as arguments. Specifically, this script is executed with php, which grabs the variables from a database:
<?php exec("expect script.exp $username $password");
The main issue with this is that those parameters can be seen with a ps aux call.
Q) Assuming only I have access to the server and filesystem, would it still be safe even though the password can be seen by listing ps aux?
An pseudo example of my expect script:
//Webdav connection established, target server prompts me for username expect "Enter Username" send "$arg1\r" //Target server accepts username, now prompts me for password expect "Enter Password" send "$arg2\r"
If this is not safe, or if the php exec() is unsafe, what is a better way to execute my script and pass the username and password to it?