Hacker News Reader

Comment by stormbrew | Hacker News Reader

> openssl pkcs8 -topk8 -v2 des3 \

> -in test_rsa_key.old -passin 'pass:super secret passphrase' \

> -out test_rsa_key -passout 'pass:super secret passphrase'

Is there a way to do this without including the password on the command line? Because somehow I don't think having your private key's password in your .bash_history will improve the security of your key.

[edit] Oh I see, just don't specify and it'll ask. I get that he's doing this with a sample key, but you just know someone's going to scan through this and do that command on their real key.

View on HN

If you put 'histcontrol=ignorespace' or 'histcontrol=ignoredups' in your ~/.bashrc file it will not record commands that begin with a space [1]. I believe that 'ignoreboth' is the default on many Linux distros.

[1]: http://www.linuxjournal.com/content/using-bash-history-more-...

You still shouldn't enter these kinds of commands on a multi-user machine, because anyone running 'ps' will see the commandline arguments.

Leave out -passin and -passout.

Provide your current passphrase at the first prompt ("Enter passphrase for <infile>:") and your new passphrase at the second and third prompts ("Enter Encryption Password:" and "Verifying - Enter Encryption Password:"). You may use the same or a different passphrase on your new key.

To avoid a command showing up in history, start the whole command with a space and the line won't be recorded to history. Or if that horse has already bolted, you can use the 'history' command to find the line number and then delete it.

Of course, most things that require passwords will request that you manually enter one if you leave the arg off.

He did in the last example that shows how to do this on an actual file ...

To clarify, my point is that a blog post about improving your security should not have an easily cut-and-pasteable reference for substantially decreasing your security, even if it's intended to be used on a dummy file.

$ export HISTFILE=/dev/null

You want:

unset HISTFILE

Don't do that in your .bash_profile unless you run login shells on all of your terminals!

Setting HISTFILE propagates that setting to child shells - unsetting HISFILE does not.

Undefined = Default

Reply on news.ycombinator.com