I have a site map generator script placed in this URL


However this URL is protected with an username and a password in auth_type basic method.

I need to place a cron to access this URL once a week. So I've decided to use the curl command and placed the cron like below.

curl -u username:mypassword http://www.mydomain.com/admin/sitemapgen/

I'm aware that sending a password through http is insecure, however at least I'm trying to hide the password from server/hosting panel users from this curl command.

1) Are there any methods to hide the password in this curl command? I read something about placing a plain text file with the password in server and use it with the -k option. However I'm not in to place the password in a plain text file either.

2) Are there any other commands than curl to use for this specific purpose?

  • Why can't you try hashing the password and pass that hash code as password in your curl command?.I don't know what limitations you have but it's just an another way to hide the password. – Thushi Dec 31 '14 at 6:26
  • @Thushi this username and password is handling by Apache web server. If I md5 the password, I believe the Apache wouldn't recognize it, would it? – inckka Dec 31 '14 at 6:32
  • I don't know about Apache will recognize it or not but I heard something about htpasswd may be you can try that. – Thushi Dec 31 '14 at 6:38
  • @Thushi htpasswd is a command to create and store user password. As per my experience, its not helpful for my requirement. – inckka Dec 31 '14 at 6:45
  • Comment: You are using plain text http:// thus any cute way of obscuring your password on the command line will only make it easily visible during the network transaction. – mdpc Dec 31 '14 at 7:45

To avoid showing the password on the command where other users can see it with ps, you should not pass the password in the command. It's why many utilities don't support passwords as command line arguments.

Instead store your password in a ~/.netrc file and pass the -n option to curl.

For the details of file syntax, I let you see the man of curl.

|improve this answer|||||
  • This answer is useful and I've already tried it and working. However when creating the .netrc file I had to specify the machine name. And according to above my example, I have specified the value as www.mydomain.com My requirement is done. However another security vulnerability occurs. Because I don't want to let some one access the main domain. However after creating .netrc file, now every one can curl -n in the site without any username and password. is there any method to specify the .netrc machine name to www.mydomain.com/admin/sitemapgen/ – inckka Dec 31 '14 at 12:30
  • 1
    You should make this action using a custom user for the generation – alexises Dec 31 '14 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.