Re^2: mod_perl2 interactive startup

> Why don't you just check to see if the variable where you put the password has been filled in yet, and skip the terminal if you already have it?

Because the mod_perl app restarts completely, so at least in the perl (as far as I know), no variables or structures persist.
Is it possible to store stuff in the apache object?

>Incidentally, it's not really more secure to enter the password this way than to just keep it in a file that only the web server startup user can read.

I disagree. If the startup user account gets compromised its very easy to read a file and get a password. I believe the bar is a lot higher to extract data from a running program.
How would you go about retrieving a password from a running program?

Comment on Re^2: mod_perl2 interactive startup

Replies are listed 'Best First'.
Re^3: mod_perl2 interactive startup by perrin (Chancellor) on Aug 18, 2009 at 13:36 UTC
The perl interpreter is not reset. If you put something in a global, it will still be there during the restart.	[reply]
Re^4: mod_perl2 interactive startup by amino (Initiate) on Aug 18, 2009 at 18:59 UTC
How do you do that? I tried saving data in a global in the startup.pl and in a package global but when the restart happens they are uninitialized. My tests and this line, "During the restart, Perl is completely destroyed and started again." from here leave me at a loss to how to do that.	[reply]
Re^5: mod_perl2 interactive startup by perrin (Chancellor) on Aug 19, 2009 at 14:10 UTC
I thought it worked to use $My::Variable, but maybe I'm remembering it wrong.	[reply]
Re^3: mod_perl2 interactive startup by Anonymous Monk on Aug 18, 2009 at 05:38 UTC
I believe the bar is a lot higher to extract data from a running program. It is just as trivial. Cleartext Passwords in Linux Memory	[reply]
Re^4: mod_perl2 interactive startup by amino (Initiate) on Aug 18, 2009 at 14:01 UTC
It is just as trivial. Cleartext Passwords in Linux Memory "...that data from memory can be recovered with physical access to systems in a very short period of time." from the abstract of the paper that appears in the first few search results. That leads me to believe it is not as trivial b/c an intruder needs physical access.	[reply]
Re^5: mod_perl2 interactive startup by Anonymous Monk on Aug 18, 2009 at 14:49 UTC
That leads me to believe it is not as trivial b/c an intruder needs physical access. It doesn't say that. Quickly overwriting passwords in memory would minimize the risk of capture via physical access, cold boot techniques, swap space forensics or simple, live, privileged memory captures.	[reply]
Re^6: mod_perl2 interactive startup by d_m (Initiate) on Aug 18, 2009 at 21:29 UTC


Come for the quick hacks, stay for the epiphanies.
	PerlMonks