Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there any way to put the password typed by user into a file (either in Unix or in expect).

read -s -p "enter password" input 
echo $input > file

Is the above code safe?

I want to use that file as an input for password in my expect script

Because I have tried this and I could see the password shown on the screen just for a sec with this expect code.

set timeout 30
stty -echo
send_user -- "Password for $username :"
expect_user -re "(.*)\n"
set timeout .000000001
set timeout 30
send_user "\n"
set timeout 30
set password $expect_out(1,string)
send -- "$password\r"
share|improve this question
2  
No, there is not. –  Ulrich Dangel Mar 12 '13 at 7:58
    
ok hmm...........-) –  munish Mar 12 '13 at 9:23
    
At the very least, use the mktemp program to create a temporary directory with a random name and set it to unreadable for anyone but the owner before putting the file in there. –  Shadur Mar 13 '13 at 8:09
add comment

1 Answer 1

up vote 2 down vote accepted

Whoever can read the file will get the password. That includes root, the user owning the file (or somebody impersonating them), and (depending on permissions) the users in the group or even everybody. Anyone who has a few minutes alone with the machine can reboot it with a LiveCD/LiveUSB and get at the file. And a long list of other possibilities. It is not safe. Perhaps enough for casual use, but not for anything serious. And consider that "I don't think it is critical" isn't enough, need to think any possible chain of uses of the privileges granted, other sites using the same password (or one constructed the same way), ...

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.