[v2.24.0] 'forseti_db' should get from the yaml file and not from the flags

[unrealmind]

This is because when I run ps -ef | grep forseti in the server, it is displaying the plain text of forseti_db's credential.

Forseti Version:

git checkout tags/v2.24.0

Example:
Started Forseti service in background:

nohup forseti_server \
   --endpoint "localhost:50051" \
   --forseti_db "mysql+pymysql://root:forseti_user:<PASSWORD>@x.x.x.x.x:3306/forseti_security" \
   --services scanner model inventory explain notifier \
   --config_file_path "/xx/xx/forseti-security/configs/server/forseti_conf_server.yaml" \
   --log_level=debug \
   --enable_console_log &

ps -ef | grep forseti

Output:

/usr/bin/python3 /usr/local/bin/forseti_server --endpoint localhost:50051 --forseti_db mysql+pymysql://forseti_user:@x.x.x.x:3306/forseti_security --service

Tried to echo'd the $CONFIG_FLAGS the file and exported it but no avail.

export CONFIG_FLAGS="--endpoint localhost:50051 --forseti_db mysql+pymysql://forseti_user:@x.x.x.x:3306/forseti_security --services scanner model inventory explain notifier --config_file_path /xx/xx/forseti-security/configs/server/forseti_conf_server.yaml --log_level=debug --enable_console_log"

Appreciate if someone could advise on this.
Thank you.

[auto-comment]

Thank you for opening an issue. Our team's interrupts engineer will review your issue shortly.

Issue Resolution:

• [Interrupts Engineer] Triage / apply categorization labels
• [Interrupts Engineer] Verify / Reproduce the reported issue
• [Forseti Engineer] Perform root cause analysis
• Forseti Engineer] Add tasks and next steps to resolve this issue.

[gkowalski-google]

Hi @unrealmind, sorry for the delay. I'm sorry, can you help provide some more info on what the issue is? Is the problem that anybody with access to the VM can see the password in plaintext from the command line?

[unrealmind]

Hello @gkowalski-google

Sorry for the late response. Yes. Anyone who have access into the VM can see the password in plaintext.

Just run ps -ef | grep forseti and you can see it.

[blueandgold]

I will add this to our sprint planning.