dnsdist: warn about -k in /proc/x/cmdline

diff --git a/pdns/dnsdist.cc b/pdns/dnsdist.cc
index dd116a43883e34be2b3766bc3fae6752d28d20a1..3434f4c182ee6ab9580821b3f7b1f14bcb128c71 100644 (file)
--- a/pdns/dnsdist.cc
+++ b/pdns/dnsdist.cc
@@ -2011,7 +2011,8 @@ static void usage()
 #ifdef HAVE_LIBSODIUM
   cout<<"-k,--setkey KEY       Use KEY for encrypted communication to dnsdist. This\n";
   cout<<"                      is similar to setting setKey in the configuration file.\n";
-  cout<<"                      NOTE: this will leak this key in your shell's history!\n";
+  cout<<"                      NOTE: this will leak this key in your shell's history\n";
+  cout<<"                      and in the systems running process list.\n";
 #endif
   cout<<"--check-config        Validate the configuration file and exit. The exit-code\n";
   cout<<"                      reflects the validation, 0 is OK, 1 means an error.\n";

diff --git a/pdns/dnsdistdist/docs/manpages/dnsdist.1.rst b/pdns/dnsdistdist/docs/manpages/dnsdist.1.rst
index fab321ff7edec6e9ac7d4012ff53c9eed1662f14..41f734323887de55a85d299bf8b021fe36f5251f 100644 (file)
--- a/pdns/dnsdistdist/docs/manpages/dnsdist.1.rst
+++ b/pdns/dnsdistdist/docs/manpages/dnsdist.1.rst
@@ -56,8 +56,9 @@ Options
 -k <key>, --setkey <key>               When operating as a client(**-c**, **--client**), use *key* as
                                        shared secret to connect to dnsdist. This should be the same key
                                        that is used on the server (set with **setKey()**). Note that this
-                                       will leak the key into your shell's history. Only available when
-                                       dnsdist is compiled with libsodium support.
+                                       will leak the key into your shell's history and into the systems
+                                       running process list. Only available when dnsdist is compiled with
+                                       libsodium support.
 -e, --execute <command>                Connect to dnsdist and execute *command*.
 -h, --help                             Display a helpful message and exit.
 -l, --local <address>                  Bind to *address*, Supply as many addresses (using multiple