如何使用 Bash“读取”命令安全读取？

How to secure read with the Bash "read" command?

提问by Daniel

You know there is a built-in Bash command called read. What if I want to do this in my scripts:

你知道有一个内置的 Bash 命令叫做read. 如果我想在我的脚本中执行此操作怎么办：

read PASSWROD

When it prompts me to input, all my input is visible. Is there an alternative command that can make the input invisible.

当它提示我输入时，我的所有输入都是可见的。是否有替代命令可以使输入不可见。

回答by Jonathan Leffler

Time to learn how to manual bash (in the bashmanual, that is; this is from the Bash 4.1 edition). The relevant option is -s.

是时候学习如何手动使用 bash（在bash手册中，也就是说；这是来自 Bash 4.1 版本）。相关选项是-s。

read

read [-ers] [-a aname] [-d delim] [-i text] [-n nchars] [-N nchars] [-p prompt]

[-t timeout] [-u fd] [name ...]

One line is read from the standard input, or from the file descriptor fd supplied as an argument to the -uoption, and the first word is assigned to the first name, the second word to the second name, and so on, with leftover words and their intervening separators assigned to the last name. If there are fewer words read from the input stream than names, the remaining names are assigned empty values. The characters in the value of the IFS variable are used to split the line into words. The backslash character \may be used to remove any special meaning for the next character read and for line continuation. If no names are supplied, the line read is assigned to the variable REPLY. The return code is zero, unless end-of-file is encountered, read times out (in which case the return code is greater than 128), or an invalid file descriptor is supplied as the argument to -u.

Options, if supplied, have the following meanings:

-a anameThe words are assigned to sequential indices of the array variable aname, starting at 0. All elements are removed from aname before the assignment. Other name arguments are ignored.

-d delimThe first character of delim is used to terminate the input line, rather than newline.

-eReadline (see Chapter 8 [Command Line Editing], page 93) is used to obtain the line. Readline uses the current (or default, if line editing was not previously active) editing settings.

-i textIf Readline is being used to read the line, text is placed into the editing buffer before editing begins.

-n ncharsread returns after reading nchars characters rather than waiting for a complete line of input, but honor a delimiter if fewer than nchars characters are read before the delimiter.

-N ncharsread returns after reading exactly nchars characters rather than waiting for a complete line of input, unless EOF is encountered or read times out. Delimiter characters encountered in the input are not treated specially and do not cause read to return until nchars characters are read.

-p promptDisplay prompt, without a trailing newline, before attempting to read any input. The prompt is displayed only if input is coming from a terminal.

-rIf this option is given, backslash does not act as an escape character. The backslash is considered to be part of the line. In particular, a backslash-newline pair may not be used as a line continuation.

-sSilent mode. If input is coming from a terminal, characters are not echoed.

-t timeoutCause read to time out and return failure if a complete line of input is not read within timeout seconds. timeout may be a decimal number with a fractional portion following the decimal point. This option is only effective if read is reading input from a terminal, pipe, or other special file; it has no effect when reading from regular files. If timeout is 0, read returns success if input is available on the specified file descriptor, failure otherwise. The exit status is greater than 128 if the timeout is exceeded.

-u fdRead input from file descriptor fd.

读

read [-ers] [-a aname] [-d delim] [-i text] [-n nchars] [-N nchars] [-p prompt]

[-t timeout] [-u fd] [name ...]

从标准输入中读取一行，或者从作为-u选项参数提供的文件描述符 fd 中读取，第一个单词分配给第一个名称，第二个单词分配给第二个名称，依此类推，剩余的单词和分配给姓氏的中间分隔符。如果从输入流中读取的单词少于名称，则剩余的名称将被分配空值。IFS 变量值中的字符用于将行拆分为单词。反斜杠字符\可用于删除下一个字符读取和行继续的任何特殊含义。如果未提供名称，则将读取的行分配给变量 REPLY。返回码为零，除非遇到文件结束、读取超时（在这种情况下返回码大于 128）或提供无效的文件描述符作为 的参数-u。

选项（如果提供）具有以下含义：

-a aname这些词被分配给数组变量 aname 的顺序索引，从 0 开始。在分配之前从 aname 中删除所有元素。其他名称参数将被忽略。

-d delimdelim 的第一个字符用于终止输入行，而不是换行符。

-eReadline（参见第 8 章 [命令行编辑]，第 93 页）用于获取行。Readline 使用当前（或默认，如果行编辑以前未处于活动状态）编辑设置。

-i text如果使用 Readline 读取该行，则在开始编辑之前将文本放入编辑缓冲区。

-n ncharsread 在读取 nchars 个字符后返回，而不是等待完整的输入行，但如果在分隔符之前读取的字符少于 nchars 个字符，则使用分隔符。

-N ncharsread 在完全读取 nchars 个字符后返回，而不是等待完整的输入行，除非遇到 EOF 或读取超时。输入中遇到的分隔符不会被特殊处理，并且在读取 nchars 个字符之前不会导致 read 返回。

-p prompt在尝试读取任何输入之前显示提示，没有尾随换行符。仅当输入来自终端时才显示提示。

-r如果给出此选项，反斜杠不会充当转义字符。反斜杠被认为是行的一部分。特别是，反斜杠-换行符对不能用作换行符。

-s静音模式。如果输入来自终端，则不回显字符。

-t timeout如果在超时秒内未读取完整的输入行，则会导致读取超时并返回失败。timeout 可以是一个十进制数，小数点后面有小数部分。此选项仅在 read 从终端、管道或其他特殊文件读取输入时有效；从常规文件中读取时它不起作用。如果 timeout 为 0，如果输入在指定的文件描述符上可用，则 read 返回成功，否则返回失败。如果超时，则退出状态大于 128。

-u fd从文件描述符 fd 读取输入。

---

---

Hence, with the typo fixed, you need:

因此，在修正错字后，您需要：

read -s -p "Password: " PASSWORD

You may want to add an echoimmediately after it since the newline isn't echoed either (though it is not included in the password).

您可能想echo在它之后立即添加一个，因为换行符也没有回显（尽管它不包含在密码中）。

回答by squiguy

You can use these few lines:

您可以使用以下几行：

stty -echo
read -p "Password: " passw; echo
stty echo

This will turn echoon and off between password reading.

这将echo在密码读取之间打开和关闭。

回答by John3136

You can use terminal settings to turn echo off:

您可以使用终端设置关闭回声：

#!/bin/bash
# Disable echo
stty -echo

#Prompt and read password
printf "Password: "
read PASSWORD

# Turn echo back on
stty echo
printf "\n"

回答by Jay

read -s -p "Password: " passw 

works on bash

在 bash 上工作