I would like to know if there is a safe way to only be queried for a password once in a custom bash script, and then save it somehow to be used for later needs. At the end of the script it should be shredded in some way so it won't be recoverable from memory or in any other way.

  • What exactly do you want to do? If you have to run several lines of your script as another user, you could simply call sudo and it would remember the password. If you're trying to authenticate to a database or similar it would be more complicated. Just tell us what you want to do. – Andreas Wiese Apr 18 '14 at 19:53
  • It is for access to a custom application which I need to do multiple times during the script, each time entering the password. I don't want to enter the password every time the script needs me to, and I don't want to save the password to an environmental variable or anything like that, unless it can be done in a safe way. I guess my use case is similar to authenticating to a database. – user3207230 Apr 18 '14 at 20:00

Use a gpg-agent and provide your password as:

__password=$(gpg --decrypt /path/to/password.gpg)

in your script.

Of course, you need to previously encrypt it:

$ echo "correct_horse_battery_staple" > password
$ gpg --encrypt password
  • 1
    I'd suggest not to assign the password to a variable (you won't either, otherwise you hadn't suggested gpg-agent): variables in the environment of a process can be easily retrieved from outside the script. – Andreas Wiese Apr 18 '14 at 20:13
  • 1
    @AndreasWiese 1. This is a shell variable, not an environment variable. 2. Environment variables cannot be retrieved by other users on Linux or most other modern unices. – Gilles Apr 18 '14 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.