I'm running a software daemon that requires for certain actions to enter a passphrase to unlock some features which looks for example like that:
$ darkcoind masternode start <mypassphrase>
Now I got some security concerns on my headless debian server.
Whenever I search my bash history for example with Ctrl+R
I can see this super strong password. Now I imagine my server is compromized and some intruder has shell access and can simply Ctrl+R
to find my passphrase in the history.
Is there a way to enter the passphrase without it to be shown in bash history, ps
, /proc
or anywhere else?
Update 1: Passing no password to the daemon throws an error. This is no option.
Update 2: Don't tell me to delete the software or other helpful hints like hanging the developers. I know this is not a best-practice example but this software is based on bitcoin and all bitcoin based clients are some kind of json rpc server which listens to these commands and its a known security issue still being discussed (a, b, c).
Update 3: The daemon is already started and running with the command
$ darkcoind -daemon
Doing ps
shows only the startup command.
$ ps aux | grep darkcoin
user 12337 0.0 0.0 10916 1084 pts/4 S+ 09:19 0:00 grep darkcoin
user 21626 0.6 0.3 1849716 130292 ? SLl May02 6:48 darkcoind -daemon
So passing the commands with the passphrase does not show up in ps
or /proc
at all.
$ darkcoind masternode start <mypassphrase>
$ ps aux | grep darkcoin
user 12929 0.0 0.0 10916 1088 pts/4 S+ 09:23 0:00 grep darkcoin
user 21626 0.6 0.3 1849716 130292 ? SLl May02 6:49 darkcoind -daemon
This leaves the question where does the history show up? Only in .bash_history
?