<p>In this case, the best way would be to use chef <code>data bags</code> which is specifically known for this.
A great documentation is given at <a href="https://docs.chef.io/data_bags.html" rel="nofollow noreferrer">https://docs.chef.io/data_bags.html</a></p>

<p>Also, As Roland pointed above in the comment, make sure to use <code>sensitive true</code> in your bash resource to avoid any such information printed on screen or going to the logs.</p>

CC BY-SA 4.0
2019-08-28T23:38:48.277Z
2019-08-28T23:38:48.277Z
Samit
<p>I know that using a password in the command line is a bad idea because bash commands can be recorded in history.</p>

<p>If I run a command in the chef bash resource though, when I look up the history I don't see any entries.</p>

<p>Does this mean that the Chef bash resource does not record it's history? Is it safe to use a password in the Chef bash resource?</p>

CC BY-SA 3.0
2018-04-25T15:38:29.603Z
The same way as doing `bash -c command` doesn't record `command` (and if you prepend bash with a space, none will be logged) Logging history is specific to login (interactive) launch of bash. That said using the bash resource shouold be a last resort and there's usually indication a custom resource using shell_out would be more appropriate.
Tensibai
CC BY-SA 3.0
2018-04-25T17:40:33.403Z
It's not clear to me which thread vector you have in mind with your question. If you just want to prevent writing the password to disk, you'll also have to set the "sensitive" value inside the resource block or chef will log it in clear text to `/var/log/chef` (or where your chef-client is configured to log to).

However on Linux everything that's entered on the command line and/or through environment variables at run-time is accessible to root users and the owner of the process through the /proc filesystem(`/proc/$pid/cmdline`, `/proc/$pid/environ` for example).
Roland
CC BY-SA 4.0
2019-08-29T05:04:10.767Z
That is not the only reason; they would also be visible if someone did ps -eF at the appropriate time
Gaius
<security><chef>
Does the Chef bash resource create history entries?
David Eugene Pratt
# Does the Chef bash resource create history entries?

(Asked by: username_0 on 2018-04-25)

I know that using a password in the command line is a bad idea because bash commands can be recorded in history.

If I run a command in the chef bash resource though, when I look up the history I don't see any entries.

Does this mean that the Chef bash resource does not record it's history? Is it safe to use a password in the Chef bash resource?

**Tags:** security, chef

> **Comments:**
> **username_1**: The same way as doing `bash -c command` doesn't record `command` (and if you prepend bash with a space, none will be logged) Logging history is specific to login (interactive) launch of bash. That said using the bash resource shouold be a last resort and there's usually indication a custom resource using shell_out would be more appropriate.  
> **username_2**: It's not clear to me which thread vector you have in mind with your question. If you just want to prevent writing the password to disk, you'll also have to set the "sensitive" value inside the resource block or chef will log it in clear text to `/var/log/chef` (or where your chef-client is configured to log to).  However on Linux everything that's entered on the command line and/or through environment variables at run-time is accessible to root users and the owner of the process through the /proc filesystem(`/proc/$pid/cmdline`, `/proc/$pid/environ` for example).  
> **username_3**: That is not the only reason; they would also be visible if someone did ps -eF at the appropriate time  

---

## 1 answers

### Answer by username_4 on 2019-08-28. Score: 1 | Accepted answer

In this case, the best way would be to use chef `data bags` which is specifically known for this.
A great documentation is given at <https://docs.chef.io/data_bags.html>

Also, As username_2 pointed above in the comment, make sure to use `sensitive true` in your bash resource to avoid any such information printed on screen or going to the logs.


---

