1

I have a bash script, which executes a Java file. This Java file connects to an online service, and it requires that as one of the parameters I give it my password for the service. I feel uncomfortable typing my password out in the bash file, for anybody to see. Is there any way for me to "hide" the password in the bash file, encrypt it or something?

3 Answers 3

4

Use chmod to make the script only readable by yourself.

chmod go-rwx myscript

If the script is supposed to be public, then there is no good way to protect it – the password would still have to be decrypted before being given to the Java program, and if the script can do it, anyone can do it.


If it is to be run by several users, but on a machine you control, then you can keep it protected (chmod) and configure sudo to allow running only that particular script. (For more complicated stuff, some kind of splitting into client and server could be done, but it's not necessary yet.) Beware though, that the whole command line of your Java app will be visible in ps -f as long as it's running.

5
  • I have a cron job running the script, so does Cron have it's own user?
    – Lenny K
    Sep 1, 2011 at 23:58
  • If the cron job's in your personal crontab, then it runs with your own user account. Sep 2, 2011 at 0:12
  • Ok, cool. thanks. Also, in chmod, what is the go- for?
    – Lenny K
    Sep 2, 2011 at 0:20
  • 1
    It removes (therefore -) rwx permissions for the group (g) and others (o), i.e., everyone except the owner.
    – Ben Kraft
    Sep 2, 2011 at 0:26
  • Owner would be "u", user. ugo=a, or all.
    – Daniel Beck
    Sep 2, 2011 at 5:19
1

Instead of including the text of the password in the script, include it in another file and use I/O redirection operators or pipes to get it to the Java command. You can then assign more restrictive permissions to the file containing the password, or put it on a removeable medium, etc.

1
  • Thanks for your suggestion. Since I am the only one using the script, @grawity's answer will do. I'll keep your suggestion in mind for the future though, thanks for the help.
    – Lenny K
    Sep 2, 2011 at 0:34
1

Since you mention that

one of the parameters

to the java program is the password, you might be interested in knowing that all command-line parameters on most unix systems are published for anyone on the system to read. You might be locking the window while leaving the barn door wide open.

For a demonstration, try:

ps aux | less -S

You should be able to use the arrow-keys to browse to the right and see the full command-lines of all processes executing on your system.

6
  • WOW. Thanks! So, it there any way to protect my password?
    – Lenny K
    Sep 2, 2011 at 12:16
  • Wait, after running my script that executes the java, I do not see my password (or the Java file at all) come up on the list...I even redirected output to a file and searched the file for it, but I still couldn't see it.
    – Lenny K
    Sep 2, 2011 at 12:33
  • @Lenny: after being the key word -- ps only lists currently running processes. If the Java program exits after one second, then your password is exposed for one second. However, we're talking about cron here, which runs all jobs at the exact same time. If your script is set to run hourly, another user could add a hourly job to capture the process list... Sep 2, 2011 at 13:36
  • OH...so is there any way for me to prevent that from happening?
    – Lenny K
    Sep 2, 2011 at 14:36
  • Ok, I see what you are saying. I set a cron job to download the report, and a cron job to run the command you mentioned above (redirecting output to text file), at the same time. I got the file with the processes, but it doesn't show the Java being executed - only the bash script. Was the timing off, or does it not show up?
    – Lenny K
    Sep 2, 2011 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .