Question

I have a bash script which uses a text file containing a list of logins:

LOGINLIST=/home/user/logins.txt
while read line
do
echo $line
done < $LOGINLIST

I’d rather not store the list of logins as plain text, but I don’t want to have to manually decrypt it every time time I run the script. (Having the script prompt for a password would be OK.)

One way I could do this would be to include a line in the script where e.g openssl decrypts the file before it gets read. Unfortunately, if the script stalled (perhaps one of the sites it’s logging in to isn’t responding) this would leave the file unprotected for an indeterminate period of time.

So I’d rather keep the plaintext in memory only.

This post on LinuxQuestions ( http://www.linuxquestions.org/questions/programming-9/can-we-hide-the-code-of-a-shell-script-370328/#post1887648 ) suggests that sending the plaintext to a FIFO might do the trick, but that’s wholly unfamiliar territory for me. Is there a better / simpler way? How do I wipe the memory when the script is done?

…and is there a way to edit the encrypted login list while also keeping the plaintext in memory?

Answer 1

You can do that with openssl and process substitution without changing the structure of your code.

To encrypt the file, use something like:

openssl blowfish -in plaint_text_file -out encrytped_file

(Choose the cipher you want, it will prompt you for a password.)

Then you can use the encrypted file with:

LOGINLIST=/path/to/encrypted/file
while read line
do
  echo $line
done < <(openssl blowfish -d -in $LOGINLIST)

This will prompt you for the password. No temporary file generated.

(Careful with the spaces in the last command, it really is < <(.)