1

I have some scripts for backing up data. Some of them need root access, so I use them with sudo. However, sometimes I get confused, e.g. for the mySQL backup, which also needs a mySQL root password.

I have now implemented a workaround in a bash script like this

echo "Please enter root password"
sudo echo "Ok"
sudo mysqldump --all-databases --opt -u root -p  > ~/backup.dump

The idea behind this is: the sudo password will be cached. If it is entered in the beginning, it will not be prompted during the mySQL backup, so it cannot be confused with the mySQL root password any more.

Is this approach safe to use or is there anything wrong with it?

  • is the sudo password the same for mysql and Ubuntu? Because mine isn't... – Alvar Oct 22 '14 at 21:20
  • No, it isn't the same, so when I mix them up, the script will fail. (But there are more steps in the script, so I'd not like to restart from the beginning) – Thomas Weller Oct 22 '14 at 21:20
  • I would say the script is probably safe. IF you ignore the fact that the sudo passwords are written in plain text. How did you solve it? I want to create similar scripts myself. – Alvar Oct 23 '14 at 6:45
  • @Alvar Note that there is no password written in plain text. By doing sudo echo "Ok" I am just guaranteeing that the sudo password is asked for at a particular point in time. – Thomas Weller Oct 23 '14 at 19:16
  • so it's a semi auto script? I still don't really get your question, you got a script, it's working and you want to know if it's safe without posting the whole script. It sounds safe, but I would have just written the sudo password in the script and then put sudo only access to it. Problem solved. – Alvar Oct 23 '14 at 22:42
3

Yes,

that approach is as save as any normal use of sudo.

When you use sudo, the password is cached, in the default configuration.
And you use a dummy command to put the password into that standard cache, by a command doing nothing, as root - which is certainly not dangerous.

sudoonly

Because your example uses mysqldump, which also uses a password, I'd like to make clear that the above is unrelated to the mysql password, it's only relevant to the sudo on the example line sudo mysqldump ....

Especially, does not solve the problem of giving a password to mysqldump etc in a script, without having it show up on the command line in ps, top or any process manager GUI to all users on the system.


Supplemental information:

Set timeout

The timeout of the sudo password cache is 15 minutes by default, and can be changed by setting timestamp_timeout in sudoers. Using sudo visudo, add a line like

Defaults    timestamp_timeout=30

to /etc/sudoers. (Set timestamp_timeout to 0 to disable the cache.)

  • 1
    Alternatively, if you want to have sudo last for longer without changing the default, there are some other options here. – Sparhawk Oct 26 '14 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.