I would like to set up a couple of bash scripts to encrypt and decrypt a master text file containing passwords for banking, work, etc. for the purpose of editing it and displaying the entries when I need to look something up. I would prefer to use as few third-party sources as possible, and have a possible solution (?) using just a standard terminal:
- text editor of choice
My question is, can anyone provide a reason why this is not a good idea, from a security point of view? By that I mean I would like to avoid losing those passwords to casual hacking attempts (I give up if the NSA comes a-knocking).
Let me explain in more detail. I have 3 bash scripts listed below, in which
$PFILE is a path variable pointing to the directory containing of the password file, and
passfile.enc is the encrypted file (the names of the victims have been changed to protect their identity).
mypasswds.open: opens a predetermined password file encrypted using AES 256-bit encryption via
openssl. It opens the file externally in, e.g.,
gedit, so I can easily modify the entries save the updated file.
#!/bin/bash openssl aes-256-cbc -d -in $PFILE/passfile.enc -out $PFILE/passfile.tmp gedit $PFILE/passfile.tmp &
mypasswds.close: closes, i.e., re-encrypts the file once I am done editing it, and removes the decrypted text file.
#!/bin/bash openssl aes-256-cbc -in $PFILE/passfile.tmp -out $PFILE/passfile.enc shred --remove $PFILE/passfile.tmp
mypasswds.display: writes the output of
passfile.encto the terminal window, and then immediately removes the decrypted file. The idea would be to look at the terminal output to recall the password, and then close it immediately after.
#!/bin/bash openssl aes-256-cbc -d -in $PFILE/passfile.enc -out $PFILE/passfile.tmp cat $PFILE/passfile.tmp shred --remove $PFILE/passfile.tmp
For example, if I want to add a new password entry to the file, I run
mypasswds.open and enter my (randomly-generated and painstakingly memorized) master password. The text file opens in, for example,
gedit and I update it. I then save and close the editor, and run
mypasswds.close to re-encrypt and remove the temporary, unencrypted file.
If I just want to look something up, I run
mypasswds.display, look at the output to the terminal to refresh my memory, and immediately close the terminal window.
Questions / doubts that come to mind:
- Does terminal output get stored somewhere upon closing the terminal window? Or is gone forever?
shred --removea secure option for completely destroying the temporary text file?
- If someone were to obtain the encrypted file, is it possible to decipher, and with what amount of effort?
If this whole idea is for the birds (why?), that is valuable information too!
Thanks in advance.