0

I am trying to write a script which is saving the credentials to a .netrc file and then it is reading from the file in order to pass them to a curl command and saves the returned cookie file for future use. I am interested if this is secure way to pass the username and password and if there is a man in the middle attack would they be able to sniff the credentials if the server which I am trying to reach is over HTTP.

#!/bin/bash

IP="192.168.0.1"
user="Administrator"
pass="Password1234"

function credentials {
    mkdir "${HOME}"/.netrc
    rm "${HOME}"/.netrc/credentials.txt
    touch "${HOME}"/.netrc/credentials.txt
    { echo "machine ${IP}"; echo "login ${user}"; echo "password ${pass}"; } >> "${HOME}"/.netrc/credentials.txt
    chmod 600 "${HOME}"/.netrc/credentials.txt
}

function cookie {
    curl -v -c cookie.txt -n "${HOME}"/.netrc/credentials.txt http://"${IP}"/setup.php
}

credentials
cookie

I have checked and the credentials.txt file is properly saved in the corresponding directory and the credentials have the right permissions, but when I try to run the cookie function, I got the following error: Couldn't find host 192.168.0.1 in the .netrc file; using defaults. Why curl is not able to fetch the configured username and password from the credentials.txt file?

4

As I understand the man page (of curl), the option -n just enable looking for a .netrc file, but it does not expect the file path of this file. This is the option --netrc-file. From the man-page:

--netrc-file
   This option is similar to --netrc, except that you provide the 
   path (absolute or relative) to the netrc file that Curl should use. 
   You can  only  specify one netrc file per invocation. If several 
   --netrc-file options are provided, only the last one will be used.       
   (Added in 7.21.5)

   This option overrides any use of --netrc as they are mutually 
   exclusive.  It will also abide by --netrc-optional if specified.
  • yes, this seems to be the problem, I was thinking that -n and --netrc-file are the same like --verbose and -v but apparently they are not. Thanks for the hint! – Georgе Stoyanov Mar 5 '18 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.