Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #194947

Re: encryption

Show all headers | View raw

On 04/21/18 12:10, Brian wrote:
> On Sat 21 Apr 2018 at 13:54:03 -0500, David Wright wrote:
> 
>> On Sat 21 Apr 2018 at 19:14:06 (+0100), Brian wrote:
>>> On Sat 21 Apr 2018 at 11:36:05 -0500, David Wright wrote:
>>>
>>>> On Fri 20 Apr 2018 at 20:38:48 (+0100), Brian wrote:
>>>>> T have a script. It contains an important password.
>>>>
>>>> If you   cat /usr/local/bin/myscript   do you see your important
>>>> password on the screen?
>>>
>>> With the unencrypted file - yes. With the encrypted file -no.
>>>>
>>>>> I have encrypted the script with
>>>>>
>>>>>    scrypt [enc] -t 10 /usr/local/bin/myscript
>>>>>
>>>>> I can, of course, decrypt it with
>>>>>
>>>>>    scrypt dec /usr/local/bin/myscript
>>>>>
>>>>> and then execute the script.
>>>>>
>>>>> The two last steps have been combined into
>>>>>
>>>>>    DECRYPT=$(scrypt dec /usr/local/bin/myscript) && eval "$DECRYPT"
>>>>>
>>>>> Should I have any more concerns with this command than I have with the
>>>>> two-step process?
>>>>
>>>> If so, then won't the password be revealed by ps while eval is
>>>> evaluating it?
>>>
>>> I do not know the most efficacious way to see the ps output in real time
>>> as eval runs. With a bit of trial and error (scrypt is slow enough to
>>> switch to another console and use ps) I captured
>>>
>>> 23266 pts/7    R+     0:00 mpw -q -F     -M                                       -t     railcard
>>>
>>> in its output. mpw is the basic command executed by myscript. Switches
>>> are shown but not parameters. -M is the very important one. The gap
>>> would be occupied by the passphrase.
>>>
>>> Is it possible that ps output does not show parameters to switches?
>>
>> Not AFAIK. Here, I can see lines in the list such as:
> 
> Then I do not understand why paramters are not shown. 

Probably because you did not provide the -f option to ps(1).


When discussing console commands, it is best to cut and paste complete 
console sessions into your post -- prompts, commands entered, and all 
output produced.  Redact sensitive information as needed.


> Maybe they come
> later in the output? I can forsee a few sleepness nights trying to
> figure this out. :)

Type:

$ man ps


See the section 'OUTPUT FORMAT CONTROL'


> At this juncture it appears I should have no worries about ps revealing
> the secret.

Incorrect.  If a password is passed via a command-line option, 'ps -f' 
will reveal the password.


ccrypt(1) provides the -E (--envvar) option for providing the name of an 
environment variable containing the keyword to prevent this vulnerability:

https://manpages.debian.org/stretch/ccrypt/ccrypt.1.en.html

https://packages.debian.org/search?suite=all&section=all&arch=any&searchon=names&keywords=ccrypt


David

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

encryption Brian <ad44@cityscape.co.uk> - 2018-04-20 21:40 +0200
  Re: encryption Greg Wooledge <wooledg@eeg.ccf.org> - 2018-04-20 22:00 +0200
  Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 02:10 +0200
    Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 17:30 +0200
      Re: encryption john doe <johndoe65534@mail.com> - 2018-04-21 17:40 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:00 +0200
          Re: encryption john doe <johndoe65534@mail.com> - 2018-04-22 08:30 +0200
            Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-22 20:30 +0200
      Re: encryption Glenn English <ghe2001@gmail.com> - 2018-04-21 19:00 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:30 +0200
      Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 21:50 +0200
        Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 18:20 +0200
          Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 18:50 +0200
            Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-23 10:50 +0200
              Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-23 13:20 +0200
                Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-24 20:50 +0200
  Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-21 18:40 +0200
    Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 20:20 +0200
      Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-21 21:00 +0200
        Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-21 21:20 +0200
          Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 23:30 +0200
          Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 04:30 +0200
            Re: encryption Curt <curty@free.fr> - 2018-04-22 11:20 +0200
              Re: encryption Reco <recoverym4n@gmail.com> - 2018-04-22 11:50 +0200
                Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 19:10 +0200
      Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:50 +0200
    Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-21 22:10 +0200
      Re: encryption David Wright <deblis@lionunicorn.co.uk> - 2018-04-22 04:00 +0200
        Re: encryption Brian <ad44@cityscape.co.uk> - 2018-04-22 17:40 +0200
          Re: encryption Richard Hector <richard@walnut.gen.nz> - 2018-04-23 08:00 +0200
            Re: encryption Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-04-23 09:00 +0200
        Re: encryption David Christensen <dpchrist@holgerdanske.com> - 2018-04-22 20:10 +0200

csiph-web