2

I am writing a bash script that needs to authenticate a Linux box with active directory. I would like to make it so no user input is required. The problem is I have to put the password in the script, or better, in a config file. But what are the disadvantages of using a config file? Or what are things I really have to look out for?

Or is there a better way to do something like this?

EDIT: first I used the password like this: command 'password' but it was visible in when running ps -ef | grep command so now I removed the password as argument, and I ran it like this:

command <<EOF
$PASSWORD
EOF

I did not see it when running ps -ef | grep command but is it a safe way?

  • 2
    No matter how you cut it, writing down a password in cleartext is not "a safe way". That said, I don't know of a way to accomplish what you're doing otherwise but that's only because I'm not familiar with Active Directory. You should look into whether it supports public key authentication instead of password authentication. – Joseph R. Aug 10 '15 at 6:54
  • public key authentication is not an option.. is there a way to encrypt the password and then use it? – mpmv15 Aug 10 '15 at 7:45
  • I sure hope not. *nix stores user passwords in encrypted form but you can't use an encrypted password to authenticate. This is for security reasons: if this weren't the case and the password file were stolen in any way, the attacker would gain immediate access to all user accounts. It should be the same with any reasonably-designed authentication mechanism. – Joseph R. Aug 10 '15 at 7:59
  • look into LDAP/kerberos, here's a (ubuntu.com) post using winbind and samba. This serverfault post suggests no external software for some distros. – gwillie Aug 10 '15 at 8:21
3
  1. you might screw up permissions in your config file

  2. you might check your config file into source control

  3. you might be working on an open source project so cannot put passwords in source control

Answer: use an env var

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.