I was curious to know if there was a better way of encrypting a password prior to being used in a script. In other words, I have a script that has a password inside of it and would prefer to create a hash of the password and use the hash instead of the actual password so that it if someone were to use "ps" or packet capture the transmission of the script it would be a lot harder to unscramble. Is this not a standard practice?

So for example, I have a function in my script that uses ssh to perform a mysqldump remotely of a mysql database. So what can be added to my script that would use the hash and not use the actual password in the file?

??

Not really, there's usually a more specific way to improve the security, using credentials files rather than directly entering details etc.

In your example, can you not run mysqldump on the client side? I can see you're gzipping the output stream but if you can allow the standard output across the network then there's no need to send the password to the remote node. You could get some improvement by running over an ssh tunnel if you did want real time network compression instead of just saving the disk space.

Many thanks

Excellent point, I was curious. In my mind I was thinking of using the hash instead of the password so if the script gets comprimised then there are looking at a hash instead of the actual password.

regards

well yes, but then that hash has to be understood by the target system. So basically what you'd be doing is turned an encrypted password system into an unencrypted password system, which just happens to use really weird looking passwords.

A very common technique is called a "salted hash."

For example, say your password was secret. So, you generate a random number, say, 123456, and you generate an MD5 hash from the string, 123456:secret:123456, say, and you send it to the host as your authentication token: 123456:the_md5_value.

Notice how the random number (the "salt") is sent in the clear along with the MD5 string, which has been calculated from the (unknown) secret plus the (public) salt. It serves to make the process non-deterministic: you could send the string secret ten million different ways (that is to say, with a different salt-value), and the interceptor would have no way to know that the password being sent was in fact identical; nor to determine what the password is. And yet, there are no "secrets" as to the manner in which the password-string is being concealed. Eve knows exactly how Alice and Bob are masking their password, but can't wedge what it is.