topic Re: how to store passwd in shell scripts in Operating System - HP-UX

how to store passwd in shell scripts

David Greenberg_3 — Mon, 12 Jan 2004 08:03:46 GMT

I need to create some shell scripts that will have FTP username and password info. I know this is not secure, but I dont know what alternatives there are for me. I'm ready to explain the security risks to my users, but want to have some options besides:
1. "You have to type the passwd each time you run the script", and 2.
"The password is in a world readable file, say goodbye to all security."

Do I have any other options?

TIA

Re: how to store passwd in shell scripts

G. Vrijhoeven — Mon, 12 Jan 2004 08:08:26 GMT

Hi Tia,

The alternative is called scp.
check:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=350906

Gideon

Re: how to store passwd in shell scripts

Sanjay Kumar Suri — Mon, 12 Jan 2004 08:09:22 GMT

Check the thread.
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=350906
sks

Re: how to store passwd in shell scripts

Vijaya Kumar_3 — Mon, 12 Jan 2004 08:17:40 GMT

To pass user names and passwords to FTP program, there is a way using .netrc file. This file should exist with file permission 600 in your home directory.
Syntax:

machine login password

When you use ftp command, this will check this file and authnticated.

Also, you can go for exchanging public keys in SCP.

-Thanks
Vijay

Re: how to store passwd in shell scripts

Elmar P. Kolkman — Mon, 12 Jan 2004 08:22:15 GMT

Try not to do it with passwords in scripts or .netrc files. If a user can login to the server and the file is readable... but you know the risks.

If you don't want to install additional software, you could use rcp. You don't need passwords, just the correct .rhosts file on the remote machine.

If you can install additional software, or have it already installed, install ssh and use scp or sftp. The above thread contains a configuration document in SEP's response.

Re: how to store passwd in shell scripts

Geoff Wild — Mon, 12 Jan 2004 08:51:32 GMT

You can use .netrc - just make sure the file is 400 and owned by root.

Rgds...Geoff

Re: how to store passwd in shell scripts

Mic V. — Sun, 18 Jan 2004 23:56:35 GMT

I've successfully used mail to transfer information between systems. I write a program (generally Perl) to "catch" the data on the target system and use an alias in /etc/mail/aliases:

myalias: |/usr/local/bin/myprogram

to strip the headers and do something with the data that was sent to it.

The advantages IMO are that it's audited (look at /var/adm/syslog/mail.log) and seems more reliable (it queues when a host is down instead of going into the bit bucket). A disadvantage is that by default it's plain text, but so is FTP. :)

Mic

Re: how to store passwd in shell scripts

Elmar P. Kolkman — Mon, 19 Jan 2004 01:42:17 GMT

Geoff, sorry to disagree, but the .netrc should not be owned by root, but by the user running ftp and be located in his/her homedirectory... And some FTP servers also request a homedirectory not writable by others.

As for the mail variant: you can use any encryption algorithm on the data transferred you like. There are no passwords in it, only the send-script and receive-script (or better, program) need to know how to en- and decrypt the data. So it might be a good solution. And if you configure the receive script as mail-filter in your aliases file, the mail is processed the moment it comes in, so you don't have to schedule and poll for new mail...

Re: how to store passwd in shell scripts

David Greenberg_3 — Wed, 21 Jan 2004 10:18:39 GMT

Hello and Thanks for your ideas.
There were more passwords involved than I mentioned in my original message. I have decided to secure the script with SUDO.

Thank you for all your help.

Re: how to store passwd in shell scripts

Donny Jekels — Wed, 21 Jan 2004 11:33:50 GMT

use ssl encrytpion. or shoot your programmer.

Re: how to store passwd in shell scripts

Steven Sim Kok Leong — Wed, 21 Jan 2004 12:05:50 GMT

Hi,

My personal preference for the solution is using scp with public key trust setup. But just to add on to above ideas and thinking out of the box, there is also shc (shell compiler) you can use to obfuscate cleartext to a certain extent. the downside is that it reduces efficiency of the script because the generated binary file is much larger.

shc is primarily for those shell script writers who want to "hide" their code.

Hope this helps. Regards.

Steven Sim Kok Leong