2

I am using the following command on my server to create a seed:

cat /dev/urandom |tr -dc A-Z9|head -c${1:-81} 

If I copy the output and then close the terminal, will the created seed be completely unrestorable? I'm just worried that someone who might gain access to my server at some point will be able to check that output in some kind of history.

2

The data from the random generator goes through several places.

  1. It starts out in the kernel. The random generator in the kernel, like any other random generator, consists of a deterministic random bit generator (DRBG) which is seeded by entropy sources. The DRBG used by Linux has backtracking resistance, which means that even if an attacker manages to find out the state of the RNG at some point (which requires kernel-level access), they can't calculate the previous states, so they can't find previous outputs.

  2. The kernel doesn't keep a copy of the data that it passes to the cat process, or later through the pipes.

  3. Once the cat process has terminated, its memory is released back to the kernel. The released memory is not wiped immediately: Linux only wipes memory before handing it out to a process. (This is because wiping on allocation has better performance than wiping on release.) So it's possible that the data is still sitting around in RAM for a little while after cat terminates. Getting that data would require kernel-level access and some forensic skills to find the right page in memory among probably hundreds of thousands of candidates. The same goes for the other processes (tr, head).

  4. The pipes don't save their memory anywhere. The data is copied directly from process to process.

  5. The data is displayed on the terminal. It may be saved somewhere in the memory of the terminal emulator. It is definitely saved as long as you can scroll back to it, and a copy may remain in the process's memory later depending on how the terminal emulator manages its memory. Finding the data in the memory of the terminal emulator requires access to your account.

  6. The data displayed on the terminal is not stored in a file unless you've gone out of your way to log the session.

  7. The data may also remain in the video memory (not in text form, but in the form of a group of pixels that were displayed at some point). There is no mechanism to wipe the video memory and fragments of images can sometimes remain for a very long time. Examining the video memory requires kernel-level access.

  8. If you use the clipboard to copy the data from the terminal, then you have to worry about where the clipboard data may be stored. A copy may remain in the memory of the X server for a while, just like a copy may remain in the memory of the terminal emulator. Finding that copy requires root-level access and serious forensics skills.

  9. If you have a clipboard manager (perhaps as part of your desktop environment) then you need to worry where it might store a history of clipboard contents.

In summary, the only practical risk is if you use a clipboard manager.

1

Output from a shell command is not stored in the shell history file.

Unless you save the output to a file, or log the complete shell session somehow, the result of that command will not be present on your system at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.