zip file issue using password

Question

I have a .txt file and I have a bash script where txt file will be zipped and moved to other sftp server.

I am using

zip -P pass foo.zip foo.txt 

Here in the script the password is visible but I should not save the hard coded password over there . Can any one help me out?

Answer 1

From the zip man page,

-P password
       --password password
              Use  password  to encrypt zipfile entries (if any).  THIS IS INSECURE!  Many multi-user operating systems provide ways for any user to see the current command line of any other user; even
              on stand-alone systems there is always the threat of over-the-shoulder peeking.  Storing the plaintext password as part of a command line in an automated script is even  worse.   Whenever
              possible,  use the non-echoing, interactive prompt to enter passwords.  (And where security is truly important, use strong encryption such as Pretty Good Privacy instead of the relatively
              weak standard encryption provided by zipfile utilities.)

As it is mentioned in the man page, THIS IS HIGHLY INSECURE!

So, you can try the below, From the zip man page again,

--encrypt
              Encrypt the contents of the zip archive using a password which is entered on the terminal in response to a prompt (this will not be echoed; if standard error is not a tty, zip  will  exit
              with an error).  The password prompt is repeated to save the user from typing errors.

The command goes something like,

zip --encrypt foo.zip foo.txt which asks for password on terminal,

Enter password: 
Verify password: 
updating: foo.txt (stored 0%)

WARNING: The encryption used by zip is not really a strong one. It can be cracked easily!