I must connect to ftp to get some files occasionally. To do this I made a script. The problem is that the user is generic and all of my work uses this user in the local host, and the remote machine. I must connect it with my personal user so they can see my password in the script There is some way to avoid these?

  • Do you want to store the password in a separate file? Or to type it each time you run the script? Or to store the password in a keyring (which one)? – Gilles Mar 1 '15 at 22:02

If the script is run only when you are logged in, you could set the password in an environment variable that is read when the script is run - set it once per session instead of hard-coding it or prompting for it. For example:

# log in to your session
[user@host]  export pass=1234abc
[user@host] my-ftp.sh

Note the extra space in front of the export command - this is an option in most shells (such as Bash or Zsh) that will prevent the command being recorded in the shells history. This would allow you to read the password from the environment variable ${pass} within the script; but not have the password recorded in a file on the shared host.

Otherwise, short of prompting for the password every time the script is run, there's no real way to keep it secured for a shared user - everything that you have access to non-interactively as the shared user, so to will your colleagues. You could try saving the password in a file that is to be read in at runtime, but the shared user would still need access to the file and at most it would be security through obscurity (which isn't security at all).

  • I don't understand you. If I put in an environment variable they can see in the profile or in the script since they use the same user – user650034 Mar 1 '15 at 8:42
  • @user104906 I meant to set the environment variable manually when you log in - if the script is to be run only while you are logged in, you could set it once each time and have the script read that. If the script is automated (such as through cron), or to be run by other users, then this wouldn't be an option. – wraeth Mar 1 '15 at 8:46
  • Ahhh ok. So I log in and then for example I do pass=1234456 and in the script I call to $pass no?. Maybe with putty I can load these variable automatically – user650034 Mar 1 '15 at 8:49
  • @user104906 Correct. I'm not sure about putty, but you may be able to set it as part of the ssh session. Alternatively, you could simply ` export pass=1234abc` before running the script. An important note is to have a space as the first part of the command - most shells (such as Bash and Ash) will not record a command in history if it is prefixed with a space. – wraeth Mar 1 '15 at 8:54
  • Thanks the trick of the space doesn't works for me since I use ksh. Could you help me to charge the variable as part of ssh session – user650034 Mar 1 '15 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.