Not in the process list
Passing a database password to a service as an environment variable keeps it out of the process list - the full command line shows only the program and its argument, with no secret in sight. It does not keep it out of the process itself. Every running process exposes its environment as a file in /proc, and reading that file prints every variable the process was started with, including the password. The file is mode 400, readable by the user the process runs as and by root, which sounds restrictive until you remember that is exactly the account an attacker occupies after compromising that service. Environment variables are fine for configuration and poor for secrets; prefer a file with tight permissions, or a secret store the process reads at startup.
The command line is clean. The password is still there.
You pass a database password to a service as an environment variable, because that is what the documentation told you to do. It never appears in the process list.
Find the process. Its full command line is visible to everyone on the machine, and it shows only the program and its argument. No secret.
But every process keeps its environment in a file next to it. Reading that file prints the variables it was started with, including the one holding the password.
That file is readable by the user the process runs as, and by root. If the service is your web application, anyone who gets into your web application can read it too. The process list was never the place to look.
Check what your services were started with, then stop passing secrets that way.
#linux#security#selfhosted#devops#sysadmin
❯ Check what your services were started with.