Re: remote unlocking via ssh: interactive vs passphrase piping
On Mon, Jul 06, 2026 at 14:55:57 -0400, Jeffrey Walton wrote:
> On Mon, Jul 6, 2026 at 11:52 AM Vincent Lefevre <vincent@vinc17.net> wrote:
> > I've eventually found the issue. This is due to the newline character
> > after the passphrase, which cryptroot-unlock doesn't remove! I could
> > confirm with "echo -n <passphrase> | ssh ...", which works.
> >
> > I've reported the bug:
> >
> > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141580
> >
> > (I thought I had tried with "printf %s <passphrase>" earlier,
> > but I may have made a mistake in my test.)
In your bug report, you mention that you didn't want to use
"echo -n <passphrase>" on a multi-user system. Presumably, this is
because you want to avoid having the passphrase visible in "ps" or
similar process listings. But echo is a shell builtin, in both bash
and dash. Because it's a shell builtin, it will not be visible as a
process.
That said, "printf %s" is superior to "echo -n", because "echo -n" will
potentially interpret some of the characters in its argument. "printf %s"
is guaranteed not to do so. And printf is also a shell builtin, in both
bash and dash, so it's also safe from being listed as a processm, just
like echo.
> It feels like something like IFS=$'\n\0' should be used somewhere, but
> I guess not.
This is not possible in shells. Shell variables are stored as C strings,
in which the NUL byte marks the end of the string. It's simply impossible
to include a NUL byte as a meaningful character in a string in a shell,
even in special variables like IFS. If you execute IFS=$'\n\0' you will
get exactly the same result as if you'd used IFS=$'\n'.
There are tricks you can use in shells to handle streams of NUL-delimited
data. The three most common are:
* You can call tools like "xargs -0", "sort -z" and so on.
* Bash has had "read -d" forever (since version 2.04), which lets read
a single string terminated by a specific delimiter. It lets you pass
the empty string '' as the delimiter, to signify the NUL byte.
* Bash 4.4 and above also have "readarray -d", which lets you populate
a shell array variable with elements read from a stream with a chosen
delimiter. As with "read -d", you can pass '' as the delimiter to
indicate a NUL-delimited input stream.
Reply to: