4

I need to cache my user credentials in a shell script variable since they are required for multiple requests to a REST-API. It won't be stored in the bash script file itself: user is prompted to enter credentials, and these will be reused along the script execution.

What is the best way to store them so no other non-privileged processes could read those variables?

  • to NOT store them at all. Or make the script ROOT readable only. – LvB Feb 7 '17 at 9:23
  • I should have mentioned, that I am not going to place those passwords inside of the file, but prompt the user to enter like: read -s -p "Password:" password – Thomas R Feb 7 '17 at 9:26
  • @LvB I am not sure whether this is an option. To me, it does not sound like we are not talking about a runtime-cache, but rather, the script will be run periodically.Clarification please, OP? Also OP, are you sure you are talking about a cache? In computing, a cache [...] is a hardware or software component that stores data so future requests for that data can be served faster; the data stored in a cache might be the result of an earlier computation, or the duplicate of data stored elsewhere. (en.wikipedia.org/wiki/Cache_(computing)) – FMaz Feb 7 '17 at 9:40
  • @Krazor the script won't run periodically, only manually. Talking about cache: I just meant to store the credentials in bash variables. – Thomas R Feb 7 '17 at 9:53
  • I edited the question because I too though it was "how to store credentials in plain text files (like bash)", not "how to make bash variable safe and unreadable from other processes" which is way more interesting – Xenos Feb 7 '17 at 10:33
5

Storing credentials in plain text is always a tricky case, it depends on case-by-case. The main rule is: never store the password inside the script.

If the script will run only manually (someone executing the script), do not store the password on the script, instead, make the script ask the password every time it's executed.

If the script will run automatically:

  • Create a specific user for the purpose you need. ensure the user has the minimum permissions as possible. Ensure the user does not have access to any other file and does not have permission to execute anything else other than the script you need.
  • Create a file containing the password and make the script read from this file. Make sure this password file cannot be read from anyone else.
  • Is passwords the only way to authenticate? Some applications support private/public keys. If you can, use it. Make sure the private key is secure.
  • Keep in mind that the chances of those credentials getting compromised are increased just by the fact you have them stored. Having that in mind, plan mitigation actions, for example, ensure the account has the minimum permissions as possible, ensure the account can only log in from a specific server, implement a log monitoring tool (or a SIEM) to get alerted when this account is used.

There's a very good article on the unix stack exchange about this topic, i do recommend you checking it out before implementing any script with passwords.

  • Wouldn't using keys come with the exact same problem? Also, making the password-file non-readable by other processes won't prevent reading from the file per se, just keep that in mind. – FMaz Feb 7 '17 at 9:53
  • Thank you for the profound answer and the link! I was already considering placing those credentials inside of a file with minimal permissions, in a folder with minimal permissions. Still, this isn't something I really like to do. – Thomas R Feb 7 '17 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.