General: Best way to deal with cleartext password? Specific: Cygwin/email/bash

Question

I'm setting up Cygwin, and one of the packages I'm using is 'email' for, what else, sending e-mail from a script.

I've "improved" one of my concerns about email's configuration, by copying /etc/email/email.conf to a directory within my home directory, rather than editing that default config file with my settings (i.e. user name and password, primarily.) However, it still gives me the heebie-jeebies to type my cleartext SMTP password into a text file, even if it's ~/my-email.conf.

The email command has the -i (or -smtp-pass) parameter, to which I could attach the password inside the calling script, but that's not really any better because it's still cleartext in a text file.

Also, the email command does allow for setting smtp-auth='LOGIN', and it will prompt for the password, but I would prefer (require?) prompt-less operation of the script, so that I can automate it later.

What's the best way to address this issue of having to store a cleartext password in a config file (or script)? This is Cygwin, so is it best to simply address this from the Windows side, and ensure the Security permissions on that file are restricted to just me? (i.e. remove the default read access granted to the "Users" group, et al) Or is there a more common/appropriate way of dealing with this?

Answer 1

There are a couple different ways of dealing with this.

1. You can hash the stored password or use part of the hash of the stored password as your password. This won't actually protect the password in any way, since the script itself will likely have the method to unhash the password embedded, but it'll prevent the clear-text password from being present in a file. You can use sha1sum, md5sum or even crypt.

2. You can use script to call your email program with the password sent as an argument. The script itself can contain your password, although you can hash this value or even use sqlite3 to store it. If you're not worried about having to run the script in the background unattended, then it should be relatively easy to have a script query you for a password then send that to the email command.

3. You can use expect to respond to the prompting done if you use smtp-auth='LOGIN'. Expect is a package you can install on cygwin. There is a question on stackoverflow on how to make expect prompt for a password. This is more of a solution if you need the script to be able to send the password while unattended.

For a simple expect snippet for sending password to something like ssh-add

set timeout -1
spawn ssh-add
match_max 1000000
expect "Enter passphrase for "
send -- "$password\r"

Answer 2

On Debian systems I would use ecryptfs to create an encrypted folder in my homedir (this is indeed what I do) and then symlink to that file.

You probably can't find software to do that, but truecrypt will let you have an encrypted partition that you could make quite small and store such files in. Newer NTFS supper symlinks now, so you should be able to do this just fine.