Password Security

This topic is relevant to the client using a password for mTLS. The password argument does not exist for the server.

Specifying a Password Argument

When you supply a password as a command-line argument, that argument is visible to casual observers. For example, command-line arguments appear in the output of the UNIX ps command.

-p password or --password password

Optional. Required for communication with a secure FTL server.

The repository authenticates itself to the FTL server using this password. The password can be supplied using one of the following forms:

  • env:environment_var_name
  • file:password_file_path
  • pass:password

Form

You can supply password arguments in any of the following forms. Choose exactly one form.

env:environment_var

You must set an environment variable in the environment accessible to the Schema Repository process. The value of that variable is the password string. You must ensure that only authorized personnel have access to that shell, where the environment variable is set.

file:file_path

You must create a text file that contains only the password itself, store that file on a file system accessible to the Schema Repository process, and ensure the security of that file in such a manner to prevent unauthorized users from viewing its contents.

pass:password

Warning: With the pass form, the password remains in the process command line, which is visible to any system user using the command to display running process information. Do not use this form for production deployments.