BASH scripting: Hide plain text passwords

sqn · 06-15-2010, 03:49 AM

Hi all,

I was wondering if there is way to hide passwords in bash scripts.
For example: I have to write a script to export a full ldap structure, and I'm using the ldapsearch -y passwordfile, where password file is a plain text file that contains the password. Is there a way to hide the password from that file?

I was thinking to remove the r attribute from the file and before the script is lunched to put the attribute back, but is not a good solution, the same with immutable attribute.

Do you know a better solution?

centosboy · 06-15-2010, 04:10 AM

Quote:

Originally Posted by sqn

Hi all,

I was wondering if there is way to hide passwords in bash scripts.
For example: I have to write a script to export a full ldap structure, and I'm using the ldapsearch -y passwordfile, where password file is a plain text file that contains the password. Is there a way to hide the password from that file?

I was thinking to remove the r attribute from the file and before the script is lunched to put the attribute back, but is not a good solution, the same with immutable attribute.

Do you know a better solution?

why not a solution where the password must be input at a prompt?

sqn · 06-15-2010, 04:16 AM

it's a script that should run from cron, without user intervention

centosboy · 06-15-2010, 05:09 AM

Quote:

Originally Posted by sqn

it's a script that should run from cron, without user intervention

how about inserting an encrypted password into your script?
encrypt with crypt.

Code:

perl -e 'print crypt("password", "salt"),"\n"'

not sure if it would work as i have not tested..

sqn · 06-15-2010, 05:39 AM

the problem is that i need to decrypt it before running ldapsearch and encrypting it again after. Is that possible?

sqn · 06-15-2010, 05:40 AM

I though abou using openssl, but the password of the crypt is still in plain text

centosboy · 06-15-2010, 05:52 AM

Quote:

Originally Posted by sqn

the problem is that i need to decrypt it before running ldapsearch and encrypting it again after. Is that possible?

you shouldnt need to decrypt if ldap was compiled with --enable-crypt

i found many links with a quick google search

http://www.google.co.uk/search?q=lda...ient=firefox-a

sqn · 06-16-2010, 05:55 AM

So i solved the problem using xxd
So i've converted the password in HEX and i use xxd to covert it back to asci

echo AA AA AA AA AA|xxd -r -p >pass.tmp