Code-server: Setting password with command line parameter makes it visible in ps aux

Created on 19 Mar 2019 · 5Comments · Source: cdr/code-server

code-server version: 1.32.0-275-linux-x64
OS Version: Ubuntu 18.04

Description

Setting password with command line parameter makes it visible in ps aux

Steps to Reproduce

./code-server --password=supersecret $CODE_SERVER_ROOT
ps aux

Possible solution

Seems that there's some possible ways to hide it mentioned here

bug

Source

kykc

👍4

Most helpful comment

We can probably keep it in here because it's related.

NGTmeaty on 19 Mar 2019

👍3

All 5 comments

cc @kylecarbs @code-asher

coadler on 19 Mar 2019

Maybe it's also a good idea not to output password into code-server stdout when it's been explicitly set by startup parameter. Should I create a separate issue for that?

kykc on 19 Mar 2019

We can probably keep it in here because it's related.

NGTmeaty on 19 Mar 2019

👍3

UPDATE: I have a PR for this https://github.com/codercom/code-server/pull/365

MichaelDesantis on 27 Mar 2019

The recommended way now to set a password is by using the PASSWORD environment variable, which will prevent the password from displaying in the process listing.

https://github.com/codercom/code-server/commit/a3ac4567e39133e736e7e74365f10e9b97861621 also makes it so the password is only logged when it was generated.