Alex Rivera | Logout

Obscuring network proxy password in plain text files on Linux/UNIX-likes

Asked 2008-08-20T21:56:21.033
13

Typically in a large network a computer needs to operate behind an authenticated proxy - any connections to the outside world require a username/password which is often the password a user uses to log into email, workstation etc.

This means having to put the network password in the apt.conf file as well as typically the http_proxy, ftp_proxy and https_proxy environment variables defined in ~/.profile

I realise that with apt.conf that you could set chmod 600 (which it isn't by default on Ubuntu/Debian!) but on our system there are people who need root priveleges .

I also realise that it is technically impossible to secure a password from someone who has root access, however I was wondering if there was a way of obscuring the password to prevent accidental discovery. Windows operates with users as admins yet somehow stores network passwords (probably stored deep in the registry obscured in some way) so that in typical use you won't stumble across it in plain text

I only ask since the other day, I entirely by accident discovered somebody elses password in this way when comparing configuration files across systems.

@monjardin - Public key authentication is not an alternative on this network I'm afraid. Plus I doubt it is supported amongst the majority of commandline tools.

@Neall - I don't mind the other users having web access, they can use my credentials to access the web, I just don't want them to happen across my password in plain text.

linux security unix proxy apt
Edit
Report

2 Answers

3

There are lots of ways to obscure a password: you could store the credentials in rot13 format, or BASE64, or use the same password-scrambling algorithm that CVS uses. The real trick though is making your applications aware of the scrambling algorithm.

For the environment variables in ~/.profile you could store them encoded and then decode them before setting the variables, e.g.:

encodedcreds="sbbone:cnffjbeq"
creds=`echo "$encodedcreds" | tr n-za-mN-ZA-M a-zA-Z`

That will set creds to foobar:password, which you can then embed in http_proxy etc.

I assume you know this, but it bears repeating: this doesn't add any security. It just protects against inadvertently seeing another user's password.

answered 2008-08-25T21:06:27.540
0

As long as all three of these things are true, you're out of luck:

  1. Server needs web access
  2. Users need absolute control over server (root)
  3. You don't want users to have server's web access

If you can't remove #2 or #3, your only choice is to remove #1. Set up an internal server that hosts all the software updates. Keep that one locked down from your other users and don't allow other servers to have web access.

Anything else you try to do is just fooling yourself.

answered 2008-08-21T12:26:08.617

Your Answer