views:

76

answers:

2

I have a simple Bash script automating tasks which require password-based authentication. Currently I store the credentials in plain text:

$ cat ~/.myconfig
username=foo
password=bar

Obviously that's bad - so I wonder whether there's a simple way to encrypt/decrypt the password using my public/private key pair. Using Yet Another Password for the encryption wouldn't gain much, so I want it to happen pretty much automatically.

I've done some research (around here and elsewhere), but am way out of my depth on this one...

A: 

If you simply want to hide the password then store its SHA1 hash. The compare the hash of the entered password with your stored hash.

Visage
And change file permissions `chmod go-rw myconfig` against dictionary attacks.
Eike
'Automated' means there is no entered password. There's nobody to enter it.
GregS
GregS is right - if I automate entering the actual password by requiring the user to enter another password, there's not much point in storing the actual password in the first place.
AnC
+1  A: 

To automate your task means providing the password; it won't make a difference is you encrypt/obfuscate the password, you'll need to provide the decrypting too.
The only way around this dilemma is an agent-like program, as for example ssh-agent, which stores your passwords for you.

(edit: corrected link)

pavel
ssh-agent sounds like what I'm looking for - however, I can't quite figure out how exactly I should employ it. a) Assuming I load the encrypted password from the file, how do I then decrypt it? b) What do I use to encrypt the password in the first place? (I expect this to be a separate, manual step.)
AnC
ssh-agent was given as an example for how it could be implemented. However, this is a specific solution for ssh-related connections. For your specific situation something similar could be created, but the how depends on your application.
pavel
I guess I was thinking of a keyring/keychain manager to determine and access the respective keypair - but there might not be a portable solution for that. (My application is just a Bash script dispatching some commands - think HTTP basic auth with curl.)
AnC