I have a script that a member of our L1 team will run on a linux server (ssh'ed in - non root) that will take in their password and pass it to kinit via an embedded expect script (which ultimately talks to our authentication Kerberos KDCs) for the sake of running a ready for business check.
A consideration was to use getpass2 python but that's not available inhouse. A possible solution exists via a shell script using:
read -s -p "Password for $USER: " PASS
I've read through this blog. The author claims
Between the prompt and the shell execution, the password is in cleartext .
Are there steps to take to mitigate this?
I realize the password is in cleartext in RAM as well - but this is a separate issue for now.