moparisthebest
/
curl
mirror of https://github.com/moparisthebest/curl
1
0
Fork 0
Code Issues Releases Wiki Activity

curl.1: --user and --proxy-user are hidden from ps output 

Suggested-by: Eric Curtin
Improved-by: Dan Fandrich
Ref: #3680

Closes #3683
This commit is contained in:
Daniel Stenberg 2019-03-14 11:49:35 +01:00
parent 05a131eb77
commit 2af732f364
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
docs/cmdline-opts/proxy-user.d
View File

@ -9,4 +9,10 @@ If you use a Windows SSPI-enabled curl binary and do either Negotiate or NTLM
authentication then you can tell curl to select the user name and password
from your environment by specifying a single colon with this option: "-U :".
On systems where it works, curl will hide the given option argument from
process listings. This is not enough to protect credentials from possibly
getting seen by other users on the same system as they will still be visible
for a brief moment before cleared. Such sensitive data should be retrieved
from a file instead or similar and never used in clear text in a command line.
If this option is used several times, the last one will be used.

6
docs/cmdline-opts/user.d
View File

@ -12,6 +12,12 @@ The user name and passwords are split up on the first colon, which makes it
impossible to use a colon in the user name with this option. The password can,
still.
On systems where it works, curl will hide the given option argument from
process listings. This is not enough to protect credentials from possibly
getting seen by other users on the same system as they will still be visible
for a brief moment before cleared. Such sensitive data should be retrieved
from a file instead or similar and never used in clear text in a command line.
When using Kerberos V5 with a Windows based server you should include the
Windows domain name in the user name, in order for the server to successfully
obtain a Kerberos Ticket. If you don't then the initial authentication