Hiding Passwords in Scripts

Sometimes you need to pass a password or even just a string on the command line which you would rather obscure. For example:

serverControl.sh -u admin -p $MYPASS -c shutdown

Note anything below is not the ideal way of dealing with passwords you should probably use SSH keys if possible instead.

Sometimes you really do not have a better option and this might be your only option. Still it is a weak solution though to store passwords. I simplified but you probably don”t want to use obvious variable names or files either.

Very simple base64 encoding:

1
cGFzc3dkCg==
2
$ echo "cGFzc3dkCg==" | base64 --decode
3
passwd
4

5
# Use in script as follow or better use a file to store the string:
6
MYENCPASS="cGFzc3dkCg=="
7
MYPASS=`echo "$MYENCPASS" | base64 --decode`

Using aesutil:

I saw someone mention aesutil on the Internet but it appears like few modern Linux distros comes with aesutil tools though.

1
$ SALT=`mkrand 15` passwd
2

3
$ `echo "passwd" | aes -e -b -B -p $SALT`
4
i/b9pkcpQAPy7BzH2JlqHVoJc2mNTBM=
5

6
# Use in script as follow or use a file to store the string:
7
MYENCPASS="i/b9pkcpQAPy7BzH2JlqHVoJc2mNTBM="
8
MYPASS=`echo "$MYENCPASS" | aes -d -b -p $SALT`

Or maybe openssl is an option:

This is still very lame as you still have to use a password for the opensssl command. I just named it garbageKey but you are probably better off making it more obscure.

1
$ echo 'mySecretPassword' | openssl enc -base64 -e -aes-256-cbc -nosalt  -pass pass:garbageKey
2
yQA4stTBI8njgNgdmttwjlcFrywQD4XEIgK8HzqEOxI=
3
$ echo 'yQA4stTBI8njgNgdmttwjlcFrywQD4XEIgK8HzqEOxI=' | openssl enc -base64 -d -aes-256-cbc -nosalt -pass pass:garbageKey
4
mySecretPassword
5

6
# Use a hidden file
7
$ echo 'mySecretPassword' | openssl enc -base64 -e -aes-256-cbc -nosalt  -pass pass:garbageKey > .hidden.lck
8
$ cat .hidden.lck
9
yQA4stTBI8njgNgdmttwjlcFrywQD4XEIgK8HzqEOxI=
10

11
# In a script
12
$ MYENCPASS=`cat .hidden.lck | openssl enc -base64 -d -aes-256-cbc -nosalt -pass pass:garbageKey`
13
$ echo $MYENCPASS
14
mySecretPassword

As you can see in the last example I used a hidden file also instead of keeping the encryption string in the file.