I'm new to this community. Currently im working on a project which involves handling user password in shell script.
Following steps describe my password consumption flow:
- Get password from user through interactive shell command inside shell script (
read -s -p "Please enter your password:" paswd)
- Get a unique key from user (
read -s -p "Please enter pass phrase to protect the password:" passkey
- Use the key to encrypt the user password (
openssl aes-256-cbc -in /tmp/$tmpfile1 -a -salt -pass pass:$passkey -md sha256)
- Now store the encrypted password in an environment variable (
setenv USERAUTHPASS "U2FsdGVkX18TmO0EvKp4eiKuh1pA6qeffTef2k5Byh0=")
- Inside another program consume this environment variable by asking the user to pass the unique key and decrypting the password in the environment variable
My approach feels naive because i just add one layer of abstraction from using the actual password itself in plain text.
Please pardon my ignorance in this subject matter, and please advice me on the best approaches to tackle my requirement.