3

I am managing a few dedicated game servers on a Ubuntu server 14.04 machine. These games are downloaded and updated by the SteamCMD tool, which for some games, requires login from the command line arguments, which are plain readable text.

I created a few scripts to automate the processes of updating the servers every time the machine restarts, which are run by the user's cron.

Anyway, long story short: I need to find a way to securely store a password in a executable script. I'm thinking of storing just the encrypted password and somehow decrypt it before plugging it to the steamcmd arguments, and of course set user permissions to let just the owner user read it (or even just execute, is it possible?). Any advice on that?

  • Is a valid method to ask the password when the program runs? – Helio Apr 28 '15 at 17:42
  • Not really, this should be 100% automated. This script is run twice per day, every 12h, so asking for the password is out of question. – Bruno Finger Apr 28 '15 at 19:36
  • Who are you protecting the password from? Does the user enter the password once per session/login, or is it forever stored in the script? Is it separate from the login passphrase, or encrypted with the login passphrase? Look into the kernel's key management facility i.e. keyctl, or maybe a keyfile stored encrypted &/or ramdisk/tmpfs – Xen2050 Apr 29 '15 at 11:41
1
  1. For highest security, you would want to store the password in only one place, that is your mind. But this is not a option as you want to completely automate the process and this method will require you to enter the password everytime.

  2. You might have a look at hashing encrypting technology like gpg. But even here, you will need to remember and enter a passphrase, so bad option.

  3. You might think that you will store the password in encrypted text file and hard-code the passphrase. But that isn't going to make any change.

The best midway solution would be,

  • Save the password in a simple or encrypted text file. Make the file readable only by root user. Otherwise, just hard-code it into the program.
  • Make the program readable and executable only by root user.
  • If possible, deny all access to the computer by other users or guests.
  • Encrypt your partition, so even an attempt to reset root password won't help to read your files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.