Shared accounts are an unpleasant fact of life for many Linux sysops engineers. This can be a problem when the at-home feeling of a shared account makes you forget that you're not logged into your own shell and you carelessly make a curl call with an inline password or use a command with a --password switch. Let's leverage an obscure bash environment variable and a little bit of go to redact credentials out of our shared shell history.
We need a tool that recognizes commands that accept passwords or tokens in-line and replaces sensitive fields with placeholder text. For the sake of execution speed we'll try using the go language to produce a compiled binary so our shell isn't bogged down too much.
package main
import (
"bufio"
"fmt"
"os"
"regexp"
"strings"
)
func curl_u(cmdline string)(after string) {
curl := regexp.MustCompile(`:\w+?\S+\b`)
after = curl.ReplaceAllString(cmdline, ":REDACTED ")
return
}
func https_creds(cmdline string)(after string) {
pattern := regexp.MustCompile(`https://(\S+?):\S+?@`)
after = pattern.ReplaceAllString(cmdline, "https://REDACTED:REDACTED@")
return
}
func header_creds(cmdline string)(after string) {
pattern := regexp.MustCompile(`(-H|--header)\s.*?(token|auth.*?)\s\S+?\s`)
after = pattern.ReplaceAllString(cmdline, "-H AUTH_HEADER_REDACTED ")
return
}
func main() {
reader := bufio.NewReader(os.Stdin)
for {
text, _ := reader.ReadString('\n')
if (text == "") {
break
}
newtext := ""
for _, word := range(strings.Fields(text)[1:]) { // Remove history line number
newtext = newtext + " " + word //
}
// Redact credential patterns
//
text = newtext
text = curl_u(text)
text = https_creds(text)
text = header_creds(text)
fmt.Println(text)
}
As you can see this command only covers a few use-cases that I found to be common in my own history sessions:
1021 curl -v -H "Authorization: token 3067a4993bd73e857b72d716055bc137283b3a83" https://api.github.com/user
1022 curl https://lbonanomi:3067a4993bd73e857b72d716055bc137283b3a83@api.github.com/user
1023 curl -u :3067a4993bd73e857b72d716055bc137283b3a83 https://api.github.com/user
Dumping history and filtering through the go code above we get this much less juicy result:
curl -v -H AUTH_HEADER_REDACTED https://api.github.com/user
curl https://REDACTED:REDACTED@api.github.com/user
curl -u :REDACTED https://api.github.com/user
Pushing history through this command after every execution is going to be a hassle, so let's tweak our .bashrc to run this after every line of input. The bash variable $PROMPT_COMMAND is evaluated every time a user hits the enter key right before the shell returns a command prompt. While its most frequent use is (probably) to change the prompt variable $PS1 it can do anything we want, including executing a shell function like this:
function sterilize_history() {
history | $HOME/revisionist > sterile && history -r sterile && rm sterile
}
export PROMPT_COMMAND="sterilize_history"
I'm sure a more experienced go programmer will find multitude faults with the code in this article. A gently-worded issue at my nascent go repository would be very-welcome.
This idea was originally explored with a coreutils bash function.
Top comments (0)