Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I have a bash script, which executes a Java file. This Java file connects to an online service, and it requires that as one of the parameters I give it my password for the service. I feel uncomfortable typing my password out in the bash file, for anybody to see. Is there any way for me to "hide" the password in the bash file, encrypt it or something?

share|improve this question

3 Answers

up vote 4 down vote accepted

Use chmod to make the script only readable by yourself.

chmod go-rwx myscript

If the script is supposed to be public, then there is no good way to protect it – the password would still have to be decrypted before being given to the Java program, and if the script can do it, anyone can do it.

If it is to be run by several users, but on a machine you control, then you can keep it protected (chmod) and configure sudo to allow running only that particular script. (For more complicated stuff, some kind of splitting into client and server could be done, but it's not necessary yet.) Beware though, that the whole command line of your Java app will be visible in ps -f as long as it's running.

share|improve this answer
I have a cron job running the script, so does Cron have it's own user? – Lenny K Sep 1 '11 at 23:58
If the cron job's in your personal crontab, then it runs with your own user account. – grawity Sep 2 '11 at 0:12
Ok, cool. thanks. Also, in chmod, what is the go- for? – Lenny K Sep 2 '11 at 0:20
1  
It removes (therefore -) rwx permissions for the group (g) and others (o), i.e., everyone except the owner. – Ben Kraft Sep 2 '11 at 0:26
Owner would be "u", user. ugo=a, or all. – Daniel Beck♦ Sep 2 '11 at 5:19
up vote 1 down vote

Instead of including the text of the password in the script, include it in another file and use I/O redirection operators or pipes to get it to the Java command. You can then assign more restrictive permissions to the file containing the password, or put it on a removeable medium, etc.

share|improve this answer
Thanks for your suggestion. Since I am the only one using the script, @grawity's answer will do. I'll keep your suggestion in mind for the future though, thanks for the help. – Lenny K Sep 2 '11 at 0:34
up vote 1 down vote

Since you mention that

one of the parameters

to the java program is the password, you might be interested in knowing that all command-line parameters on most unix systems are published for anyone on the system to read. You might be locking the window while leaving the barn door wide open.

For a demonstration, try:

ps aux | less -S

You should be able to use the arrow-keys to browse to the right and see the full command-lines of all processes executing on your system.

share|improve this answer
WOW. Thanks! So, it there any way to protect my password? – Lenny K Sep 2 '11 at 12:16
Wait, after running my script that executes the java, I do not see my password (or the Java file at all) come up on the list...I even redirected output to a file and searched the file for it, but I still couldn't see it. – Lenny K Sep 2 '11 at 12:33
@Lenny: after being the key word -- ps only lists currently running processes. If the Java program exits after one second, then your password is exposed for one second. However, we're talking about cron here, which runs all jobs at the exact same time. If your script is set to run hourly, another user could add a hourly job to capture the process list... – grawity Sep 2 '11 at 13:36
OH...so is there any way for me to prevent that from happening? – Lenny K Sep 2 '11 at 14:36
Ok, I see what you are saying. I set a cron job to download the report, and a cron job to run the command you mentioned above (redirecting output to text file), at the same time. I got the file with the processes, but it doesn't show the Java being executed - only the bash script. Was the timing off, or does it not show up? – Lenny K Sep 2 '11 at 16:21
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.