5

The place where I work forces me to use a proxy to get to the Internet. As we know, setting a proxy is nothing but putting a string like export http_proxy=http://account:password@proxy.com:8080 into a config file such as .bashrc. I tried like this and it worked well.

I'm just thinking if there is another more secure way to do so? In my opinion, writing the password as plaintext into some config file is not secure.

  • Hmmm. Unless you suspect the system administrator (root) to spy on the users, it seems like the simplest way other than prompting you for the password every single time (with a shell script). – Julie Pelletier Feb 13 '18 at 6:22
  • @JuliePelletier Hmm, I think you are right... – Yves Feb 13 '18 at 6:24
  • @JuliePelletier Not just root. Anyone having two seconds on your open shell while you turn around to your tea cup can do a echo $http_proxy. And any script or program you run has access to that environment variable. A small security hole in any software you run will leak your password. At least I'd limit the setting to the startup script of applications like the web browser that really need it. – Philippos Feb 13 '18 at 6:52
  • Do you have an ssh account with a normal user in the proxy server? – Rui F Ribeiro Feb 13 '18 at 7:15
  • 1
    Your own processes can just read /proc/x/environ on many systems, so if you're concerned about protecting against them then you're out of luck. – Michael Homer Feb 13 '18 at 7:58
6

Someone getting the password from your terminal is the least of your problems.

The bigger problem is that using the proxy via a non-encrypted protocol over the network, your login and password can be easily sniffed. BASIC HTTP password authentication encoding is too weak and is deencoded on the fly.

An immediate improvement is tunneling the proxy requests over SSH, using autossh to be always logged in the proxy server.

Over time, the requests to the proxy service should be made over TLS if possible.

As for the terminal, I always have a lock icon on it, and when I have to leave my desk I click the lock icon.

Back to protecting the password on your disk:

protect the password in an encrypted file, with OpenSSL for instance.

Write a login script that fills your http_proxy variable at login time asking you for a password. If you are using Gnome and are able to get the password from Gnome keyring to fill http_proxy is other interesting solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.