# passowrd in clear text in pmm-mysql-metrics-42002.service file **URL:** \ **Category:** PMM 2.x\ **Created:** [July 29, 2020, 7:18am UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835 "2020-07-29T07:18:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![aurelfer](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@aurelfer](https://forums.percona.com/u/aurelfer)\ **Post date:** [July 29, 2020, 7:18am UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835/1 "2020-07-29T07:18:30Z")
Hello, During some test of pmm tool, we find a strange behaviour from security point of view. The pmm-mysql-metrics-42002.service file exposes the username and password credentials in plain text to non-privileged users via the DATA\_SOURCE\_NAME Environment variable.WIth a non-privileged user: ```auto systemctl cat pmm-mysql-metrics-42002
...
Environment="DATA_SOURCE_NAME=PERCONA_USER:CLEAR_PASSWORD@unix(/var/run/mysqld/mysqld.sock)/?parseTime=true&time_zone='%%2b00%%3a00'&loc=UTC"
Restart=always
...
``` The password is in clear text for all users. This user asks SUPER privileges to works. Other strange behaviour appear when we activate mysql metric to PMM ```auto pmm-admin add mysql --user USER --password PASSWORD ``` It’s not possible to use prompt to hide the password. Password is appearing in bash history. Is it possible to use a mysql user with Linux authentication (auth\_socket) ? This will solve our password problems. Thank you for your help, Regards, ---
**Author:** ![alexey.palazhchenko](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/alexey.palazhchenko/32/35_2.png) [@alexey.palazhchenko](https://forums.percona.com/u/alexey.palazhchenko)\ **Post date:** [July 29, 2020, 10:09am UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835/2 "2020-07-29T10:09:00Z")
It is possible to use UNIX socket with --socket flag, and MySQL client configuration file with --defaults-file flag. The later one can contain the password and be protected. pmm-admin add mysql also can use my\_print\_defaults tool for using an encrypted password. ---
**Author:** ![aurelfer](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@aurelfer](https://forums.percona.com/u/aurelfer)\ **Post date:** [August 4, 2020, 1:51am UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835/3 "2020-08-04T01:51:19Z")
> alexey.palazhchenko said: It is possible to use UNIX socket with --socket flag, and MySQL client configuration file with --defaults-file flag. The later one can contain the password and be protected. pmm-admin add mysql also can use my\_print\_defaults tool for using an encrypted password. Hello,  Thanks for answer, but I didn't find on documentation or on web example to use my\_print\_defaultstool with pmm-admin add mysql.Do you use like : ``` pmm-adm add mysql --user USER --password `my\_print\_defaults LOGIN\_PATH\_NAME -s | grep password | cut -d "=" -f 2` ``` or there is a simple way ? Thank in advance ---
**Author:** ![aurelfer](https://avatars.discourse-cdn.com/v4/letter/a/919ad9/32.png) [@aurelfer](https://forums.percona.com/u/aurelfer)\ **Post date:** [August 6, 2020, 6:35am UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835/4 "2020-08-06T06:35:09Z")
> aurelfer said: ... > The pmm-mysql-metrics-42002.service file exposes the username and password credentials in plain text to non-privileged users via the DATA\_SOURCE\_NAME Environment variable.WIth a non-privileged user: > ``` systemctl cat pmm-mysql-metrics-42002 > ... > Environment="DATA\_SOURCE\_NAME= **PERCONA\_USER** : **CLEAR\_PASSWORD** @unix(/var/run/mysqld/mysqld.sock)/?parseTime=true&time\_zone='%%2b00%%3a00'&loc=UTC" > Restart=always > ... > ``` The password is in clear text for all users. This user asks SUPER privileges to works.... When we try to secure this point, it's clearly not possible: ``` # ls -lah /etc/systemd/system/pmm-mysql-metrics-42002.service -rw-r--r-- 1 root root 1.5K Aug  4 11:15 /etc/systemd/system/pmm-mysql-metrics-42002.service # chmod 640 /etc/systemd/system/pmm-mysql-metrics-42002.service ``` We start some test to check if this break something on systemctl. When I read Jira (percona), Forum and documentation, I have the feeling it's normal behaviour for Percona's users.For administrator Linux teams, DBA and Security, of my company, it's look like to security failure.  Is-it a normal behavior or do I have to create a Jira ticket ? It was more easier to configure the tool for PostgreSQL databases than MySQL. We use Os authtication on PostgreSQL pg\_hba and create dedicate user on OS and on Postgres. ---
**Author:** ![akamac](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/akamac/32/4107_2.png) [@akamac](https://forums.percona.com/u/akamac)\ **Post date:** [July 29, 2021, 10:34am UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835/5 "2021-07-29T10:34:28Z")
Is it possible to use auth\_socket for pmm-agent user? I cannot get it work: pmm-admin add mysql --password=test --username=pmm-agent --socket=/var/run/mysqld/my sqld.sock --query-source=slowlog --size-slow-logs=200MiB Connection check failed: Error 1698: Access denied for user ‘pmm-agent’@‘localhost’. select user, host, plugin, authentication\_string from mysql.user where user=‘pmm-agent’ ; ±----------±----------±------------±----------------------+ | user | host | plugin | authentication\_string | ±----------±----------±------------±----------------------+ | pmm-agent | localhost | auth\_socket | | ±----------±----------±------------±----------------------+ ---
**Author:** ![akamac](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/akamac/32/4107_2.png) [@akamac](https://forums.percona.com/u/akamac)\ **Post date:** [August 5, 2021, 11:48am UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835/6 "2021-08-05T11:48:18Z")
Never mind, switched the service to run under pmm-agent user and now it works. ---
**Author:** ![elisetta1984](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/elisetta1984/32/5327_2.png) [@elisetta1984](https://forums.percona.com/u/elisetta1984)\ **Post date:** [October 4, 2021, 4:22pm UTC](https://forums.percona.com/t/passowrd-in-clear-text-in-pmm-mysql-metrics-42002-service-file/7835/7 "2021-10-04T16:22:08Z")
Hello. In my system, mysql instance runs under mysql OS user, and pmm client under pmm OS user. I cannot change that. How can I secure mysql SUPER password in this case? Thanks and Regards, Elisa