Yesterday I was tired and working on a friend serveur. The ssh prompt was different and I entered the password from a account while the remote port has hang up on me. So effectively typing “password” straight on my shell.
His password is in my history now. I removed it but that type of thing happen all the time. ( Not that much in a professional settings, password tends to fade away )
Not that it probably would have helped in this situation, but maybe useful for others.
Usually if I have to enter secrets in my shell, I do something like this in order to save the useful stuff to history but hiding the secrets:
- ` export PASSWORD=hunter2` (notice the space before "export")
- `service-cli login username $PASSWORD` (no space before, gets saved to shell history)
HISTCONTROL=ignorespace # bash
setopt hist_ignore_space # zsh
These go into ~/.bashrc or ~/.zshrc, respectively. zsh is really smart about this and always enables you to retrieve the immediate previous line with arrow-up, no matter whether it's got preceding whitespace or not.
- read -s PASSWORD
- service-cli login username $(cat)
At least you probably don't want to use `export` when setting the variable.
The better written ones might accept it in env but that will also stay in history.
But if someone have access to your home they can put keylogger in the .profile/.bashrc so it's not really relevant...
`the-command --password $(read -s;echo $REPLY)`
also you still have the `export REPLY=password` in history.
sure you can source it out of file but, well, that file have same permissions (or looser! if you forgot to change) as your .bash_history file.
`cat password|command` is the safest one (or, well, something 12 factor app clowns hate, a config file)
I will try it because the history tool looks like an interesting take, but the security model is not ok for multi computer use.