Best practice to read password, containing special characters like $!@`', into Bash script

Question

I am trying to read a password from stdin into a variable in a Bash script. This variable should then be expanded into an ssh-command and transmitted to the server. There, the password should arrive in correctly escaped manner, so it can be used as input for another command. (In this case to change the login-password of my pihole).

Currently I have something like:

read -rs -p "Password: `echo $'\n> '`" newpass
ssh root@gate "pihole -a -p \"${newpass}\""

But also tried:

ssh root@gate "pihole -a -p ""'""${newpass}""'"
ssh root@gate 'pihole -a -p '"${newpass}"
ssh root@gate 'pihole -a -p '"${newpass}"''
ssh root@gate "pihole -a -p \'${newpass}\'"
ssh root@gate 'pihole -a -p ''\''"${newpass}"'\''

Even with printf:

IFS= read -rs -p "Password: `echo $'\n> '`" newpass
command=$(printf 'pihole -a -p %s\n' "$newpass")

or

IFS= read -rs -p "Password: `echo $'\n> '`" newpass
command=$(printf 'pihole -a -p '\''%s'\''\n' "$newpass")

and many more. But with this password: a$#5!6k?h'v;z' they all fail. And there isn't even a back-tick in it, yet...

My question to all you Bash Gurus out there is:

What is the correct way to parse a password into a variable, where the user may enter literally any character?

This includes:

$ 
!
` (backtick)
' (single quote)
"
;
#
@
\
/
~
\n

and so on...

I have read all the related questions here and in other forums, but couldn't find a solution for this use case.

I know, that there will be people who suggest to use Python or C or something else, but still I'm interested in Bash's capabilities.

However, if it definitely isn't possible to accomplish with Bash, then I'm also interested in ideas on how you would do this (cleanly and securely) with other tools.

Thanks in advance

Answer 1

Several possible solutions.

• Have pihole ask for the password directly instead of using your own prompt.

  ssh -t user@host pihole -a -p
  

• Run your own read prompt on the target side:

  ssh -t user@host 'read -rsp "Password: " newpass && pihole -a -p "$newpass"'
  

• Pass it through a pipe:

  echo "$newpass" | ssh user@host 'read -r newpass && pihole -a -p "$newpass"'
  

• Quote the password you read before passing it:

  read -rsp "Password: " newpass
  qnewpass=$(printf "%q" "$newpass")
  ssh user@host pihole -a -p "$qnewpass"
  

• Encode the password and decode it on the other side:

  newpass_base64=$(printf "%s" "$newpass" | base64)
  ssh user@host "pihole -a -p \$(echo $newpass_base64 | base64 -d)"
  

• Don't use special characters at all, XKCD style. ;-)

Answer 2

$ echo "$pw"
$!@`',

$ echo "${pw@Q}"
'$!@`'\'','

That should do it. I do not know, though, in which version of bash this was introduced. This works, too, and may have been available earlier:

$ printf %q "$pw"
\$\!@\`\'\,
# or, avoiding the command substitution
$ printf -v pw_ql1 %q "$pw"
$ echo "$pw_ql1"