kiranchauhan91
Posts: 24
Joined: Fri Jan 29, 2016 10:21 am

Suppress logging of command-line for silent installation

Mon Feb 26, 2018 6:44 am

Hi,

We have configured installer to support silent installation. We supply username and password in the command line and that parameters are used by installer internally. We have observed that whole command along with password in plain text is logged in the installer log. Is it possible to not log it? It is a big security risk for our customers.

Regards,
Kiran Chauhan

Sorin
Posts: 663
Joined: Mon May 08, 2017 1:03 pm

Re: Suppress logging of command-line for silent installation

Mon Feb 26, 2018 10:19 am

Hello Kiran,

In order to hide the value of these properties from the log file you could use our "Hide property" feature.

To achieve this, just go to "Install Parameters" page, double click on a property from the "Properties" list and select "Hide property" option.

Best regards,
Sorin
Sorin Stefan - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

kiranchauhan91
Posts: 24
Joined: Fri Jan 29, 2016 10:21 am

Re: Suppress logging of command-line for silent installation

Wed Feb 28, 2018 11:03 am

Hello Sorin,

It helped. Thanks for your help.

Regards,
Kiran Chauhan

Sorin
Posts: 663
Joined: Mon May 08, 2017 1:03 pm

Re: Suppress logging of command-line for silent installation

Wed Feb 28, 2018 1:14 pm

Hello Kiran,

You are welcome.
Just let us know if you have any other questions.

Best regards,
Sorin
Sorin Stefan - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

kiranchauhan91
Posts: 24
Joined: Fri Jan 29, 2016 10:21 am

Re: Suppress logging of command-line for silent installation

Wed Jun 13, 2018 10:04 am

Hi,

We are facing one more issue regarding hidden parameter. They are case sensitive. For ex: We have used PASSWORD as a hidden parameter. When you pass "password", it captures password in logs but only at the beginning of the log. See attached. Log line starts with "Command Line: ..". But, if you use "PASSWORD", it doesn't log password anywhere in the log. As a work around we had to add "PASSWORD", "password", etc. But it is not a good practice to add different combination of name as parameters. Please advice.

P.S We have "advanced installer 11.4.1 build 58484" installed.

Regards,
Kiran Chauhan
Attachments
Password_Plain Text.png
Password_Plain Text.png (108.7KiB)Viewed 14000 times

Daniel
Posts: 8237
Joined: Mon Apr 02, 2012 1:11 pm
Contact:  Website

Re: Suppress logging of command-line for silent installation

Mon Jun 18, 2018 3:16 pm

Hello Kiran,

I am not so sure why this happens. Can you please make sure you have set the "Hide property" option in "Install Parameters" page for your installer property?

Also, if you could isolate the behavior in a test case or small sample this will be great.

All the best,
Daniel
Daniel Radu - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

kiranchauhan91
Posts: 24
Joined: Fri Jan 29, 2016 10:21 am

Re: Suppress logging of command-line for silent installation

Wed Jun 27, 2018 12:35 pm

Hello Daniel,

I have emailed sample project to support. You will be able to reproduce the problem using that project.

Thanks & Regards,
Kiran Chauhan

Daniel
Posts: 8237
Joined: Mon Apr 02, 2012 1:11 pm
Contact:  Website

Re: Suppress logging of command-line for silent installation

Tue Jul 03, 2018 9:45 am

Hello Kiran,

Thank you for your sent files. I tested and replicated the behavior. This happens indeed when building an EXE setup package and you set from command line at install time the hidden property. In this case as a solution you should proceed like this:

1. go to "Install Parameters" page and add a new property configured like this:
  • Name: EXE_CMD_LINE
    Value: Your Value
    Hide property: checked
2. rebuild your setup project and test it again

Important Note: Also, please keep in mind that when setting your PASSWORD property from command line at install time you should not write it with lower cases. Only public property (UPPER CASE WRITTEN) can be set from command line. So you should write the property name as it is with upper case.

All the best,
Daniel
Daniel Radu - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

Daniel
Posts: 8237
Joined: Mon Apr 02, 2012 1:11 pm
Contact:  Website

Re: Suppress logging of command-line for silent installation

Tue Jul 03, 2018 10:02 am

Hello Daniel,

Thank you for your reply.

EXE_CMD_LINE is already added as a hidden parameter in our main installer project. I did not add it in the sample project. So it is not an issue anymore. But, if you see first line in an attachment in my reply on Wed Jun 13, 2018, it logs the password parameter when we specify in lower case. Can we do something about it?

Thanks & Regards,
Kiran Chauhan
Daniel Radu - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

Daniel
Posts: 8237
Joined: Mon Apr 02, 2012 1:11 pm
Contact:  Website

Re: Suppress logging of command-line for silent installation

Thu Jul 05, 2018 8:59 am

Hello Kiran,

I am afraid the only solution to prevent this behavior will be to define a second property (in "Install Parameters" page of your setup project) with the "password" name and set the "Hide property" flag for it too.

However, please keep in mind that (as you already noticed) the property names are case sensitive and the installation process treats the "password" and "PASSWORD" as two different properties. So, there is a mistake to use the lower case property name when you want to set the upper case one.

There is no other safety mechanism to hide a property value other than defining it and using the "Hide property" flag.

Thank you for your understanding.

All the best,
Daniel
Daniel Radu - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

Return to “Common Problems”