Question

I wrote a shell script to hook into a password protected database. A couple of others want to use the same shell script to share the database access, but I don’t want to expose the password that is being used. Is there a way to lock the script so that no one can read it and only execute it? It’d also be ideal for them to enter their sudo password to run the script

Answer 1

Is there a way to lock the script so that no one can read it and only
execute it? It’d also be ideal for them to enter their sudo password
to run the script

Sure. Let’s say the script containing the credentials is /usr/local/bin/myscript. Make this file owned by a privileged user. Let’s say we have a user named “credentials”:

# chown credentials /usr/local/bin/myscript
# chmod 700 /usr/local/bin/myscript

Now only the credentials user can read and execute this script.

Create another script /usr/local/bin/mywrapper that looks like this:

#!/bin/sh
exec sudo -u credentials /usr/local/bin/myscript

And create the appropriate /etc/sudoers entry:

auser   ALL=(credentials) /usr/local/bin/myscript

So now, user auser runs “mywrapper”. This in turn uses sudo to call the real script, which will prompt auser for their password.

I think this does everything you want. We use a mechanism very much like this at my office to protect credentials (in our case, ssh private keys).