bash 将 sudo 密码存储为脚本中的变量 - 安全吗？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/3667432/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Storing sudo password as variable in script - is it safe?
提问by S?awosz
Is storing my password this way safe?
以这种方式存储我的密码安全吗？
echo 'Write sudo password (will not be displayed) and hit enter'
read -s password
I need it to make commands like this:
我需要它来发出这样的命令：
echo $password | sudo -S apt-get install -y foo bar
采纳答案by Dirk Eddelbuettel
No because you can see it via /proc/$PID/cmdline.
不，因为您可以通过/proc/$PID/cmdline.
I suggest not to try to reinvent security tools. The sudoprogram can cache your password.
我建议不要尝试重新发明安全工具。该sudo程序可以缓存您的密码。
回答by fseto
A better approach would be to edit your sudoers file and add your program that don't require password...
更好的方法是编辑您的 sudoers 文件并添加不需要密码的程序...
Do a sudo visudoand add following to enable your admin group to run apt-get w/o password:
%admin ALL = NOPASSWD: /usr/bin/apt-get
执行sudo visudo并添加以下内容以使您的管理员组能够运行 apt-get w/o password：
%admin ALL = NOPASSWD: /usr/bin/apt-get
See sudoers man page for more detail.
有关更多详细信息，请参阅 sudoers 手册页。
回答by Heinzi
echo $password | sudo -S apt-get install -y foo bar
This is a bit dangerous. If the user is already authenticated to sudo, sudo won't request the password again and it will be forwarded to apt-get, with could lead to strange results (for example, if the postinstall script asks a question). I would suggest to use
这有点危险。如果用户已通过 sudo 身份验证，则 sudo 将不会再次请求密码并将其转发到 apt-get，这可能会导致奇怪的结果（例如，如果 postinstall 脚本提出问题）。我建议使用
sudo -k # remove previous sudo timestamp
echo $password | sudo -v -S # create a new one for 15 minutes
sudo apt-get ... # execute the command
instead.
反而。
EDIT: Dirk is correct about the password being visible for a very short time while echois executed. Please see my answer as an extended comment rather than an answer to your question.
编辑：Dirk 关于密码在echo执行时在很短的时间内可见是正确的。请将我的回答视为扩展评论，而不是对您问题的回答。
回答by CSpangled
sudois open source, so you can compile your own version which takes the password as a command line parameter.
sudo是开源的，因此您可以编译自己的版本，该版本将密码作为命令行参数。
