Security question: Are NodeJS spawns logged anywhere?

Question

If you run a command in Terminal, say

rsync -avuP [SourcPath] [DestPath]

That command will get logged in, say .bash_history, .zsh_history, .bash_sessions, etc.

So if you make use of something as notoriously insecure as sshpass

say sshpass -P password -p MySecetPassword [Some command requiring std input], that too will be logged.

But what happens when you do the equivalent when spawning a process using Node JS?

passw = functionThatRetrievesPasswordSecurely();
terminalCmd = "sshpass";
terminalArgs = ["-P, "password", "-p", passw, "command", "requiring", "a", "password", "entry"];
spawn = require("child_process").spawn(terminalCmd, terminalArgs);
spawn.stdout.on("data", data => {console.log("stdout, no details"});
spawn.stderr.on("data", data => {console.log("stderr, no details"});
spawn.on("close", data => {console.log("Process complete, no details"});

Are the terminalCmd or terminalArgs logged anywhere?

If so, where?

If not, is this a secure way to make use opf sshpass?

Answer 1

There isn't a node specific history file for execs unless you created one by logging the arguments. There can be lower level OS logging that captures this type of data, like an audit log.

Passing a password on the command line is still considered the least secure way. Try -f to pass a file or -d for a file descriptor instead (or ssh keys should always be the first port of call)

The man page explains...

The -p option should be considered the least secure of all of sshpass's options. All system users can see the password in the command line with a simple "ps" command. Sshpass makes a minimal attempt to hide the password, but such attempts are doomed to create race conditions without actually solving the problem. Users of sshpass are encouraged to use one of the other password passing techniques, which are all more secure.

In particular, people writing programs that are meant to communicate the password programatically are encouraged to use an anonymous pipe and pass the pipe's reading end to sshpass using the -d option.