Hide/encrypt password in bash file to stop accidentally seeing it

Question

Sorry if this has been asked before, I did check but couldn't find anything...

Is there a function in Unix to encrypt and decrypt a password in a batch file so that I can pipe it into some other commands in a bash file?

I realise that doing this provides no real security, it is more to stop someone accidentally seeing the password if they are looking at the script over my shoulder :)

I'm running on Red Hat 5.3.

I have a script which does something similar to this:

serverControl.sh -u admin -p myPassword -c shutdown

and I would like to do something like this:

password = decrypt("fgsfkageaivgea", "aDecryptionKey")
serverControl.sh -u admin -p $password -c shutdown

This doesn't protect the password in any way, but does stop someone from accidentally seeing it over my shoulder.

Answer 1

You should be able to use crypt, mcrypt, or gpg to meet your needs. They all support a number of algorithms. crypt is a bit outdated though.

More info:

• http://manpages.ubuntu.com/manpages/lucid/man1/mcrypt.1.html
• http://mcrypt.sourceforge.net/
• http://linux.about.com/od/commands/l/blcmdl3_crypt.htm
• http://www.cyberciti.biz/tips/linux-how-to-encrypt-and-decrypt-files-with-a-password.html

Answer 2

OpenSSL provides a passwd command that can encrypt but doesn't decrypt as it only does hashes. Many systems have a provide a base64 encoder and decoder. Yet another common option is to use a uuencoder or uudecoder. You could also download something like aesutil so you can use a capable and well-known symmetric encryption routine.

For example:

# use base64 encoding
MYENCPASS="cGFzc3dkCg==" # echo "passwd" | base64
MYPASS=`echo "$MYENCPASS" | base64 --decode`

# using aesutil
SALT=`mkrand 15` # mkrand generates a 15-character random passwd
MYENCPASS="i/b9pkcpQAPy7BzH2JlqHVoJc2mNTBM=" # `echo "passwd" | aes -e -b -B -p $SALT` 
MYPASS=`echo "$MYENCPASS" | aes -d -b -p $SALT`

# and usage
serverControl.sh -u admin -p $MYPASS -c shutdown

Answer 3

• indent it off the edge of your screen (assuming you don't use line wrapping and you have a consistant editor width)

or

• store it in a separate file and read it in.