I have a file "credential.txt" which contains the password of mysql. I have another script which calls this text file and retrieves the password from it. For security purposes, I don't want to store the password directly. For that I have encrypted the file by using the Triple-DES Cipher encryption:

openssl des3 -salt -in credential.txt -out credential.des3

Reference: https://linuxtidbits.wordpress.com/2009/01/12/encryptingdecrypting-a-file-easily-with-a-couple-bash-scripts/

Now from my shell script, I want to get the encrypted password from credential.des3, and store it in a variable. From the referenced article, it shows how to decrypt the file and store the decrypted password in a different file.

openssl des3 -d -salt -in credential.des3 -out unencrypted-data.file

The thing is I don't want to save the decrypted file on the system. I want to capture the output of decrypting. My shell script is automated to run using cronjobs, so I can't ask the user to specify the password. Is there any way to decrypt the password and store it in a variable like:

var = $(decrypted_pass)

and use it whenever necessary in a shell script.

I have tried the below command, but it not working.

var=$(openssl das3 -salt -in credential.des3)

  • (I edited out the backslashes from the commands, as they're only used in the original document to wrap the commands on two lines) – ilkkachu Mar 7 at 21:56
  • How do you type / enter the password to decrypt the des3 file? I'm assuming you'll be storing and using the decrypted info later, or is entering the password originally the main problem, sending input to the cron script? – Xen2050 Mar 9 at 16:45
  • May I suggest to use another symmetric cipher instead of Triple-DES, as it is known to be weak. Just to give an example: Most recently, this cipher has been officially been removed from the TLS 1.3 spec. An alternative cipher could be AES in GCM mode. – André Gasser Apr 30 at 6:16

You could use

pass=$(openssl des3 -d -salt -in credential.des3)

(with no output file specified)

But the problem here seems to be that you're running the script from cron. While you could arrange to pass some piece of data from cron to the script through an environment variable, there's no easy way to have that password passed to cron without storing it on the filesystem (in a crontab file, most likely).

To avoid the plaintext password from hitting persistent storage, you could arrange to have it stored on a tmpfs filesystem (on Linux). You can mount one with mount -t tmpfs tmpfs /path/to/mount/point, or with the equivalent in fstab. There's also a chance that your system already has /tmp using tmpfs.

Another alternative would be to have the script holding the plaintext password running continuously, and using sleep to do the actual work at the appropriate times. Though in that case, if the script crashed, it wouldn't be restarted automatically (and you'd need to manually input the password to restart it anyway).

Note that in any case, any secrets you have in memory might be written out to swap if you have any. (There's a case to be made for using encrypted swap for that reason.)

  • Thank you for your suggestion. " pass=$(openssl des3 -d -salt -in credential.des3)" worked. But it asks for the password that I used while encrypting the password. Is there any solution on how should I add this password to my shell script? – Rose Mar 7 at 22:19
  • @Rose, openssl has the -pass option to give the password on the command line. But doesn't that defeat the purpose of the encryption in the first place? The encryption password gives access to the encrypted sensitive data, so now you'd need to protect it in the same way. – ilkkachu Mar 7 at 22:27
  • exactly. That defeat the main purpose. Thanks again for suggestions. I will figure it out. – Rose Mar 7 at 22:31
  • +1 for the swap case! – Christian Pagot Apr 19 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.