Keeping Passwords Secure shell>  mysql -u francis -pfrank  db_name shell>  mysql -u francis -p  db_name Enter password: ******** [client] password= password shell>  chmod 600 .my.cnf shell>  mysql --defaults-file=/home/francis/mysql-opts 1173 On Unix, the  mysql  client writes a record of executed statements to a history file (see Section 4.5.1.3, “mysql Client Logging” ). By default, this file is named  .mysql_history  and is created in your home directory. Passwords can be written as plain text in SQL statements such as  CREATE USER  and  ALTER USER , so if you use these statements, they are logged in the history file. To keep this file safe, use a restrictive access mode, the same way as described earlier for the  .my.cnf  file. If your command interpreter maintains a history, any file in which the commands are saved contains MySQL passwords entered on the command line. For example,  bash  uses  ~/.bash_history . Any such file should have a restrictive access mode. Section 4.2.2.2, “Using Option Files” , discusses option files in more detail. To name from the command line a specific option file containing the password, use the  --defaults- file= file_name  option, where  file_name  is the full path name to the file. For example: To keep the password safe, the file should not be accessible to anyone but yourself. To ensure this, set the file access mode to  400  or  600 . For example: It is more secure to enter your password this way than to specify it on the command line because it is not visible to other users. However, this method of entering a password is suitable only for programs that you run interactively. If you want to invoke a client from a script that runs noninteractively, there is no opportunity to enter the password from the keyboard. On some systems, you may even find that the first line of your script is read and interpreted (incorrectly) as your password. The  *  characters indicate where you enter your password. The password is not displayed as you enter it. •Store your password in an option file. For example, on Unix, you can list your password in the  [client] section of the  .my.cnf  file in your home directory: •Use the  --password  or  -p  option on the command line with no password value specified. In this case, the client program solicits the password interactively: This is convenient  but insecure . On some systems, your password becomes visible to system status programs such as  ps  that may be invoked by other users to display command lines. MySQL clients typically overwrite the command-line password argument with zeros during their initialization sequence. However, there is still a brief interval during which the value is visible. Also, on some systems this overwriting strategy is ineffective and the password remains visible to  ps . (SystemV Unix systems and perhaps others are subject to this problem.) If your operating environment is set up to display your current command in the title bar of your terminal window, the password remains visible as long as the command is running, even if the command has scrolled out of view in the window content area. Warning