{"action":"created","issue":{"url":"https://api.github.com/repos/duplicati/duplicati/issues/2928","repository_url":"https://api.github.com/repos/duplicati/duplicati","labels_url":"https://api.github.com/repos/duplicati/duplicati/issues/2928/labels{/name}","comments_url":"https://api.github.com/repos/duplicati/duplicati/issues/2928/comments","events_url":"https://api.github.com/repos/duplicati/duplicati/issues/2928/events","html_url":"https://github.com/duplicati/duplicati/issues/2928","id":282297304,"number":2928,"title":"Server needs --parameters-file argument","user":{"login":"hydrian","id":988950,"avatar_url":"https://avatars0.githubusercontent.com/u/988950?v=4","gravatar_id":"","url":"https://api.github.com/users/hydrian","html_url":"https://github.com/hydrian","followers_url":"https://api.github.com/users/hydrian/followers","following_url":"https://api.github.com/users/hydrian/following{/other_user}","gists_url":"https://api.github.com/users/hydrian/gists{/gist_id}","starred_url":"https://api.github.com/users/hydrian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hydrian/subscriptions","organizations_url":"https://api.github.com/users/hydrian/orgs","repos_url":"https://api.github.com/users/hydrian/repos","events_url":"https://api.github.com/users/hydrian/events{/privacy}","received_events_url":"https://api.github.com/users/hydrian/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2017-12-15T01:58:57Z","updated_at":"2018-02-12T01:49:22Z","closed_at":"2018-01-28T21:50:50Z","author_association":"NONE","body":"<!-- Thank you for taking the time to submit an issue using this template. By following the instructions and filling out the sections below, you will help the developers get the necessary information to fix your issue. You may remove sections that aren't relevant to your particular case. You can also preview your report before submitting it. -->\r\n<!-- Love Duplicati? Please consider supporting our collective at https://opencollective.com/duplicati/donate. -->\r\n\r\n<!-- Please search to see if an issue has already been created for your report. -->\r\n<!-- Replace the empty checkbox [ ] below with a checked one [x] if you already searched for duplicate bugs. -->\r\n- [ x ] I have searched open and closed issues for duplicates.\r\n\r\n----------------------------------------\r\n\r\n## Environment info\r\n*nix style OSes\r\n- **Duplicati version**: 2.0.2.1-1 (deb)\r\n- **Operating system**: Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Mint 17, Mint 18\r\n- **Backend**: B2 (doesn't matter)\r\n\r\n## Description\r\n<!-- Describe the issue that you are experiencing below. -->\r\nMultiple arguments of the Duplicati.server.exe executable contain sensitive info. Most *nix OSes by default show the process arguments in the process list to all users. This means any logged in user could get sensitive passwords from the process list, namely the --webservice-sslcertificatepassword and the --webservice-password. \r\n\r\nProposed resolution:\r\nAdd the --parameters-file argument to the Duplicati.server.exe executable. This way the senstive information could be saved in a file and subject to filesystem permissions. This also allow for better packaging in *nix platforms. \r\n\r\nMore background can be found at : https://forum.duplicati.com/t/command-line-security/1732\r\n\r\n## Steps to reproduce\r\nN/A\r\n\r\n## Screenshots\r\nN/A\r\n\r\n## Debug log\r\nN/A"},"comment":{"url":"https://api.github.com/repos/duplicati/duplicati/issues/comments/364812271","html_url":"https://github.com/duplicati/duplicati/issues/2928#issuecomment-364812271","issue_url":"https://api.github.com/repos/duplicati/duplicati/issues/2928","id":364812271,"user":{"login":"hydrian","id":988950,"avatar_url":"https://avatars0.githubusercontent.com/u/988950?v=4","gravatar_id":"","url":"https://api.github.com/users/hydrian","html_url":"https://github.com/hydrian","followers_url":"https://api.github.com/users/hydrian/followers","following_url":"https://api.github.com/users/hydrian/following{/other_user}","gists_url":"https://api.github.com/users/hydrian/gists{/gist_id}","starred_url":"https://api.github.com/users/hydrian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hydrian/subscriptions","organizations_url":"https://api.github.com/users/hydrian/orgs","repos_url":"https://api.github.com/users/hydrian/repos","events_url":"https://api.github.com/users/hydrian/events{/privacy}","received_events_url":"https://api.github.com/users/hydrian/received_events","type":"User","site_admin":false},"created_at":"2018-02-12T01:49:22Z","updated_at":"2018-02-12T01:49:22Z","author_association":"NONE","body":"Thanks, @Pectojin \r\n\r\nI'm going to start with the RPM package. I know that packaging format better. Then I'll move on the deb package. "}}
{"actor":{"display_login":"hydrian"}}