mjhjmtu

I don't know if this question is better off on here, or in the Apple/Mac world... but I do need a decent answer.

I am using Applescript to pull data from fields in a spreadsheet or database, and shove them directly into terminal:

echo "thisismydatastring and my saltbits" | openssl aes-256-cbc -k thisismypassword -base64 

My question: is there a way one could filter thru the log files to catch this plaintext instance of the password?

Is there a better way to prevent hacking?

PS: and for the love of pete, if you're smart (or snarky) enough to offer to edit my writing, at least offer a sane answer to the question.

If you don't want your password in your shell history (or easily trawled from ps) then don't put the password on the command line.

One alternative is to put the password in a file, set the permissions to 600 with chmod and use $(cat passwordfile) in place of the password on the command line.

This is not safe if you don't trust root on your system, or if you think that other users on the system may be capable of acquiring root privileges.

e.g.

• edit /.mysecretpassword and add your password.


• chmod 600 ~/.mysecretpassword


• 
  

  run:

  
  
  

  echo "thisismydatastring and my saltbits" | 
   openssl aes-256-cbc -k "$(cat ~/.mysecretpassword)" -base64
  

  
  

Similarly, if "thisismydatastring and my saltbits" is sensitive, don't put that on the command line either. put it in a file and pipe it into openssl.

openssl has an option to read the password from a file descriptor. This is mostly useful if you write a wrapper script to run openssl.

#!/bin/bash

# use file descriptor 99 for no particular reason. a completely arbitrary choice,
# as long as it's not already in use (probably isn't).
exec 99< ~/.mysecretpassword

openssl aes-256-cbc -base64 -k fd:99 

Save that somewhere in your $PATH, make it executable with chmod (700 is probably best if you are worried about snoopers) and you can pipe or redirect your data into it. It's probably slightly better than the $(cat ...) method because it doesn't name ~/.mysecretpassword on any command line (so that won't be saved in history or visible in ps).

This file-descriptor method is still only security-by-obscurity, so isn't safe against an untrusted root account or users who can gain root.

You can improve the security a bit by using an encrypted filesystem that you mount manually (and type in the pass-phrase manually...and hope nobody's logging your keystrokes) when you need it, and unmount when finished. Applescript implies you're using a Mac - dunno how you'd do this on OS X but on Linux, you'd use FUSE if you didn't have root on the machine.

It's generally considered a bad idea to be doing crypto stuff on a machine that you don't completely control, or that has other (potentially hostile) users on it. (for more secure crypto, don't do it on a machine connected to a network...better yet, use a un-networked machine in a faraday cage in a lead-lined room at the bottom of a 100' deep concrete bunker. transfer the base64 encrypted data by floppy - not a USB device - or via QR code...printed or display the QR on screen and scan with phone)

More simply: if you have any reason to suspect that you can't completely trust the machine you're on, and it is important that the data stays secret, then don't use it for encryption. There's lots of ways to make a mistake, and it only takes one to be completely compromised.

BTW, if you're using bash, you can remove individual lines from the ~/.bash_history before you exit that shell by hitting up-arrow until you see the line you want to remove and then typing Ctrl-U and hitting up-arrow again.

Alternatively, you can clear that shell session's entire history by running history -c before you exit that shell. This will not clear anything already saved into the .bash_history file.

If the password or other sensitive data is already saved to your .bash_history then your only option will be to delete or edit your history file when you login again. NOTE: It may already be backed up or snapshotted - i.e. too late to fix.