Pipe Password to Application When Asked

Question

The following should be done in a bash script:

curl --digest --user schmijos https://bitbucket.org/u/p/get/tip.zip -o tip.zip

How can I automatically submit a password to curl when it asks for it? Since I don't want to see the password in any logfile, I won't do the following:

curl --digest --user schmijos:$password https://bitbucket.org/u/p/get/tip.zip -o tip.zip

Solution 1

Use empty:

With the password safely stored (it's a way of saying...)

$ echo password > pwd-file

Start process with empty. (You would omit -L log in the real case.)

$ empty -f -i fifo1 -o fifo2 -L log curl -u user http://example.com

Send the contents of pwd-file to empty's input pipe, which the process sees as both its stdin and /dev/tty.

$ empty -s -c -o fifo1 < pwd-file

This is what happened in the pseudo terminal:

$ cat log
<<<Enter host password for user 'user':>>>password
<<<

Solution 2

Curl can read passwords from ~/.netrc. Add a line like this to ~/.netrc:

machine bitbucket.org login schmijos password swordfish

and run

curl --netrc --digest --user schmijos https://bitbucket.org/u/p/get/tip.zip -o tip

Comments

[schmijos]

~/.netrc does not store encrypted passwords. Alternatives like crypt have to be used.

[schmijos]

+1 - This seems to be a solid solution. But I would appreciate if the tools were built-in or available in a standard linux environment.

[Gilles 'SO- stop being evil']

@JosuaSchmid If you encrypt the password, you'll have to enter the decryption password. You can put .netrc on an encrypted filesystem, that's an orthogonal concern. Did you want to get a password prompt if necessary? I didn't get that impression from your question.

[schmijos]

You are right. I don't want the password to be stored (in any insecure way).

[Gilles 'SO- stop being evil']

@JosuaSchmid Define insecure. If you don't want the password stored at all, why aren't you typing it when Curl prompts you to?

[schmijos]

The script should be executed in background.

[jayhendren]

You can also use --netrc-file and process substitution (<(...)) to avoid a file with the contents of the password.