Bug #47589 Chassis should refuse configfile readable to everyone
Submitted: 24 Sep 2009 9:39 Modified: 7 Feb 2010 16:49
Reporter: Thomas Nielsen Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Proxy: Core Severity:S3 (Non-critical)
Version:0.8.0 OS:Any
Assigned to: Michael Schuster CPU Architecture:Any

[24 Sep 2009 9:39] Thomas Nielsen 
Description:
The proxy chassis currently accepts starting with config files that are readable to everyone. This is a security issue since the file contains the users plaintext password.

How to repeat:
* Create your default config file, i.e myproxycfg.ini
* chmod 777 myproxycfg.ini
* ./bin/mysql-proxy --defaults-file=/path/to/myproxycfg.ini

... which starts fine. Ideally this should result in an error exit and sensible user error message.

* chmod 600 myproxycfg.ini
* ./bin/mysql-proxy --defaults-file=/path/to/myproxycfg.ini

starts fine - as expected.

Suggested fix:
* on startup, check permissions for config file, and exit with error if incorrect permissions set.
[24 Sep 2009 9:45] Sveta Smirnova 
Thank you for the report.

Verified as described.
[13 Jan 2010 18:25] Enterprise Tools JIRA Robot 
Keith Russell writes: 
Patch available in build.
[2 Feb 2010 19:34] Enterprise Tools JIRA Robot 
Diego Medina writes: 
Verified fixed on 0.8.0
[7 Feb 2010 16:49] MC Brown 
A note has been added to the 0.8.0 changelog, the documentation already mentioned this requirement: 

        MySQL Proxy would load a configuration file with unsafe                                       
        permissions, which could allow password information to be                                     
        exposed through the configuration file. MySQL Proxy now                                       
        refuses to load a file with unsafe permissions.