Java 1.5 Command Line Password Masking

Question

All,

Our server is running Java 1.5 and I am having difficulty trying to mask user input from the command line. I am executing a jar file (java -jar my.jar) and am working through command line prompts via printlns. I cannot use Java Console.

Thanks

Answer 1

Here is an interesting article: http://java.sun.com/developer/technicalArticles/Security/pwordmask/

edit now that I re-read that, I think their command-line "solution" is really stupid. What we've got in our application is an auxiliary program to do that, one that understands how to mask input according to the OS (Linux, Windows, whatever). The Java code listens for commands on a socket, and the front-end password reader gets the password and anything else needed, then sends commands to the Java code.

Answer 2

The best approach would be to use Java 6's Console readPassword() method. Since you mentioned that you are using Java 5, that is not an option. A lot of Java 6 utilities have been backported to Java 5. I have not found anyone who has done it for this class though.

This site has a good article on how to do it using Java 5. http://www.devdaily.com/java/edu/pj/pj010005/. Basically they wrap System.in with an InputStreamReader and read a line.

Answer 3

On a Unix system? You could try running the system program stty with argument -echo before reading the program and the program stty echo afterwards.

ProcessBuilder pb = new ProcessBuilder("stty", "-echo");
pb.start().waitFor();
// Read the password here
pb = new ProcessBuilder("stty", "echo");
pb.start().waitFor();

Note that I have not tried this! Some stty programs are happy with it and some aren't (those that aren't need their stdin to come from /dev/tty to work right...)