9

I have a site map generator script placed in this URL

http://www.mydomain.com/admin/sitemapgen/

However this URL is protected with an username and a password in auth_type basic method.

I need to place a cron to access this URL once a week. So I've decided to use the curl command and placed the cron like below.

curl -u username:mypassword http://www.mydomain.com/admin/sitemapgen/

I'm aware that sending a password through http is insecure, however at least I'm trying to hide the password from server/hosting panel users from this curl command.

1) Are there any methods to hide the password in this curl command? I read something about placing a plain text file with the password in server and use it with the -k option. However I'm not in to place the password in a plain text file either.

2) Are there any other commands than curl to use for this specific purpose?

Improve this question
6
  • Why can't you try hashing the password and pass that hash code as password in your curl command?.I don't know what limitations you have but it's just an another way to hide the password.
    – Thushi
    Dec 31, 2014 at 6:26
  • @Thushi this username and password is handling by Apache web server. If I md5 the password, I believe the Apache wouldn't recognize it, would it?
    – inckka
    Dec 31, 2014 at 6:32
  • I don't know about Apache will recognize it or not but I heard something about htpasswd may be you can try that.
    – Thushi
    Dec 31, 2014 at 6:38
  • @Thushi htpasswd is a command to create and store user password. As per my experience, its not helpful for my requirement.
    – inckka
    Dec 31, 2014 at 6:45
  • Comment: You are using plain text http:// thus any cute way of obscuring your password on the command line will only make it easily visible during the network transaction.
    – mdpc
    Dec 31, 2014 at 7:45

1 Answer 1

Reset to default
7

To avoid showing the password on the command where other users can see it with ps, you should not pass the password in the command. It's why many utilities don't support passwords as command line arguments.

Instead store your password in a ~/.netrc file and pass the -n option to curl.

For the details of file syntax, I let you see the man of curl.

Improve this answer
2
  • This answer is useful and I've already tried it and working. However when creating the .netrc file I had to specify the machine name. And according to above my example, I have specified the value as www.mydomain.com My requirement is done. However another security vulnerability occurs. Because I don't want to let some one access the main domain. However after creating .netrc file, now every one can curl -n in the site without any username and password. is there any method to specify the .netrc machine name to www.mydomain.com/admin/sitemapgen/
    – inckka
    Dec 31, 2014 at 12:30
  • 1
    You should make this action using a custom user for the generation
    – alexises
    Dec 31, 2014 at 12:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .