Generating random passwords with shell on server deployment

Question

I'm trying to generate random and secure passwords to my various configuration files and settings on the fly when I run my automated deployment script. I want them to be generated, shown to the user, used as part of the deployment and then discarded.

This is what I was going with:

# FUNCTION TO GENERATE A RANDOM STRING
function randpass() {
  [ "$2" == "0" ] && CHAR="[:alnum:]" || CHAR="[:graph:]"
    cat /dev/urandom | tr -cd "$CHAR" | head -c ${1:-32}
    echo
}

$NOW = $(date +"%m-%d-%Y") || echo ="Time = $now"
$APPKEY = randpass(20) || echo "Secret key = $APPKEY"
read -p "Copied down?" -n1 -s

1. Is this a bad approach?
2. Is this secure?
3. Will the passwords be stored as variables after deployment has finished?

I'm new to shell and linux administration so any help is appreciated.

James

Answer 1

1) Yes, use something like pwgen that allows for customization of passwords (such as which character sets to include, length, total number of generated passwords etc).

2) YMMV

3) since you are not exporting them, no.

Answer 2

I'm using this approach:

PASSWORD=$(strings /dev/urandom | grep -o '[[:alnum:]]' | head -n 12 | tr -d '\n'; echo)

From my point of view generated passwords are reasonably secure, but I'm not a crypto-expert.

Variables are only stored in the context of the script, as long as you do not use "source" to execute it . If you do, you can use "unset PASSWORD" to delete the content of the variable.

*pwgen is of course fine, but you might face a situation where you simply cannot install/use it, I did this quite often.