Question: I'm concerned about security of database passwords in sqoop batches (no interactive input).

In the old days, for a sqoop batch, the only thing you could do was to pass it on the command line using `--password`, but then the password was easy to read with a simple `ps` command.

Now we have that `--password-file` option, but it requires to store the password unencrypted on the disk and that's not really a "secure" practice, nor is it very convenient to have individual files for individual parameters.

I was thinking of storing the encrypted password in a configuration file, and dynamically decrypt it, store it in a temporary file, setting the rights (using a chmod command), calling sqoop, and then deleting the file... But I may miss a less cumbersome way ? How do you deal with it ?

Answer: 
@abeaamase has the best answer at this time in his stackoverflow 23916985 response from 3/2015 found [here](https://stackoverflow.com/questions/23916985/sqoop-and-password-encryption-using-password-file-option). Essentially, we should upgrade to sqoop > 1.4.5 and use a java keystore (JKES), org.apache.sqoop.util.password.CryptoFileLoader, or a loader defined in our own class. 

The provided CryptoFileLoader has the disadvantage of presuming the crypto passphrase and salt will be provided as -D parameters to drive system properties (which are open to snooping via ps) or in plain text in the configuration XML. 

I initially discovered these parameters in [this](http://ingest.tips/2015/03/12/managing-passwords-sqoop/) blog from 3/2015 having missed it earlier (it lacks a heading but you'll find it if you look at step 3 part 2). 

Surprisingly, it is not the recommended practice, and does not appear in the sqoop 1.4.5 docs.
Before the availibilty of the `--password-file` option, I made a patch for sqoop to read the password from in input stream in a non interactive way when using the `-P` command.

That way, I could unencrypt the password from a configuration file, and call sqoop with that password using a stdin pipe, without using a file or a command line where the plain password could be seen.

Edit file `src/java/org/apache/sqoop/SqoopOptions.java`

Replace the `securePasswordEntry` function code by 

```
private String securePasswordEntry() {
try {
  return new String(System.console().readPassword("Enter password: "));
}
// PATCH Bouygues Telecom - read password from pipe if launched in non-interactive mode
catch (NullPointerException e) {    
    try {
        final java.io.BufferedReader reader = new java.io.BufferedReader(
                            new java.io.InputStreamReader(System.in));
        return reader.readLine();
    }
    catch (java.io.IOException excep) {      
        LOG.error("It seems that you have launched a Sqoop metastore job via");
        LOG.error("Oozie with sqoop.metastore.client.record.password disabled.");
        LOG.error("But this configuration is not supported because Sqoop can't");
        LOG.error("prompt the user to enter the password while being executed");
        LOG.error("as Oozie tasks. Please enable sqoop.metastore.client.record");
        LOG.error(".password in sqoop-site.xml, or provide the password");
        LOG.error("explicitly using --password in the command tag of the Oozie");
        LOG.error("workflow file.");
    }
    return null;
  }
}

```

What is cumbersome is to have to re-patch every new release of Sqoop... I should maybe submit a jira (with a low confidence that my patch will be taken into account), or move to the --password-file option the way you wanted to.