Obscuring network proxy password in plain text files on Linux/UNIX-likes

With the following approach you never have to save your proxy password in plain text. You just have to type in a password interactively as soon as you need http/https/ftp access:

• Use openssl to encrypt your plain text proxy password into a file, with e.g. AES256 encryption:

openssl enc -aes-256-cbc -in pw.txt -out pw.bin

• Use a (different) password for protecting the encoded file
• Remove plain text pw.txt
• Create an alias in e.g. ~/.alias to set your http_proxy/https_proxy/ftp_proxy environment variables (set appropriate values for $USER/proxy/$PORT)

alias myproxy='PW=`openssl aes-256-cbc -d -in pw.bin`; PROXY="http://$USER:$PW@proxy:$PORT"; export http_proxy=$PROXY; export https_proxy=$PROXY; export ftp_proxy=$PROXY'

• you should source this file into your normal shell environment (on some systems this is done automatically)
• type 'myproxy' and enter your openssl password you used for encrypting the file
• done.

Note: the password is available (and readable) inside the users environment for the duration of the shell session. If you want to clean it from the environment after usage you can use another alias:

alias clearproxy='export http_proxy=; export https_proxy=; export ftp_proxy='

I did a modified solution:

edit /etc/bash.bashrc and add following lines:

alias myproxy='read -p "Username: " USER;read -s -p "Password: " PWPROXY="$USER:$PW@proxy.com:80";export http_proxy=http://$PROXY;export Proxy=$http_proxy;export https_proxy=https://$PROXY;export ftp_proxy=ftp://$PROXY'

From next logon enter myproxy and input your user/password combination! Now work with sudo -E

-E, --preserve-env Indicates to the security policy that the user wishes to reserve their existing environment variables.

e.g. sudo -E apt-get update

Remark: proxy settings only valid during shell session

There are lots of ways to obscure a password: you could store the credentials in rot13 format, or BASE64, or use the same password-scrambling algorithm that CVS uses. The real trick though is making your applications aware of the scrambling algorithm.

For the environment variables in ~/.profile you could store them encoded and then decode them before setting the variables, e.g.:

encodedcreds="sbbone:cnffjbeq"creds=`echo "$encodedcreds" | tr n-za-mN-ZA-M a-zA-Z`

That will set creds to foobar:password, which you can then embed in http_proxy etc.

I assume you know this, but it bears repeating: this doesn't add any security. It just protects against inadvertently seeing another user's password.