Re: remote unlocking via ssh: interactive vs passphrase piping
On 2026-07-06 15:15:09 -0400, Greg Wooledge wrote:
> In your bug report, you mention that you didn't want to use
> "echo -n <passphrase>" on a multi-user system. Presumably, this is
> because you want to avoid having the passphrase visible in "ps" or
> similar process listings. But echo is a shell builtin, in both bash
> and dash. Because it's a shell builtin, it will not be visible as a
> process.
Indeed, but I'm wondering whether I can be sure as this is a machine
where I am not the admin. This needs to remain true for at least
10 years, for any /bin/sh that could be used.
Using "tr -d '\n' < file" is probably better.
> That said, "printf %s" is superior to "echo -n", because "echo -n" will
> potentially interpret some of the characters in its argument. "printf %s"
> is guaranteed not to do so. And printf is also a shell builtin, in both
> bash and dash, so it's also safe from being listed as a processm, just
> like echo.
I suppose that for a passphrase (thus without control characters),
"echo -n" and "printf %s" are equivalent.
[...]
> Shell variables are stored as C strings, in which the NUL byte marks
> the end of the string.
This is a choice of implementation (zsh does not do that, for instance).
That said, NUL bytes in variables are not portable.
--
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
Reply to: