Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am writing a script which would be potentially dangerous if run in the wrong way. As a safety feature, I want the script to require the user to re-enter their password first, much as sudo does.

So how do I do this? In other words how do I

a) input the password without echoing it,

b) verify the password, and

c) (for bonus points) do this without leaving the plaintext password lying around in memory for some clever chap to scrape out of /proc or something like that?

This is in bash but any other standard Linux shell variant would be ok if that's easier.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Try:

su $USER -c true

And then test the return value in $?. For example:

echo "Really delete everything? Enter your password to confirm:"
su $USER -c true && rm -rf $HOME

The true is there solely as a no-op.

To suppress the output from su you can redirect stderr:

echo -n "Enter password for $USER:"
su $USER -c true 2>/dev/null  && echo -e "\nsuccess" || echo -e "\nfailure"

You cannot omit the -c [command] parameter as this will create a new interactive instance of bash (whether you group it in subshells or not):

$ ((su $USER ) && echo ok) ; echo "exit status:$?"
Password: 
$ echo $SHLVL 
2
$ exit
ok
exit status:0
$ echo $SHLVL 
1

So the example in the comments below:

((su $USER >/dev/null 2>&1) && echo ok) || echo no

did not display anything (unless su authentication failed) because with a correct password you are now working in a nested shell (with all screen output redirected). Press CTRL-D (to exit the shell) and you will see "ok" echoed.

share|improve this answer
2  
Great solution! You may want to redirect the output of su to /dev/null to prevent "su: Authentication failure" output in case of a wrong password. –  Tim Sep 20 '13 at 13:25
1  
@Tim Like so: su $USER -c "echo -n" >/dev/null 2>&1 (&>/dev/null will do both redirections in at least bash and zsh, but it's not standard) –  Blacklight Shining Sep 20 '13 at 13:26
    
Testing it now, seems like -c "echo -n" is redundant. Is my ubuntu abnormal in that regard? –  spraff Sep 20 '13 at 13:27
1  
@spraff The -c flag to su tells it to execute a single command. Otherwise, it would log the user in again, which is redundant. –  Blacklight Shining Sep 20 '13 at 13:29
    
Thanks. Quick follow-up: my test is ((su $USER >/dev/null 2>&1) && echo ok) || echo no which prints "no" when the password is wrong and prints NOTHING when the password is right. Why is this, do you know? –  spraff Sep 20 '13 at 13:32

IMO the best practice here is to require admin privileges to run the script by changing the file permissions / ownership. That way you use the default implementation instead of having to re-invent the wheel by building a custom password checking feature (in other words, you require the user to either be logged in as root, be in the sudoers list and use sudo or use su to become root).

Right click on the script, click on Properties and then on the Permissions tab to change permissions / ownership. Or use chmod / chown to do so (see the man pages for more info). Do all this as root.

share|improve this answer
1  
If someone is already tunning a root shell that won't work. I don't want admin privileges, I want to reverify the password. Overlapping but not equivalent problems. –  spraff Sep 20 '13 at 13:08
    
-1: doesn't answer the question, mostly irrelevant (see @spraff's comment) –  Blacklight Shining Sep 20 '13 at 13:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.