Shell Programming and Scripting

Hello,

for an automated telnet login script I need to store a password on the server. Is there a possibility to store the password in an encrypted form and decrypt it every time the login is performed? Are there any ideas

Love, Sally

It is strongly recommended, if possible in your case, to use ssh instead of telnet. telnet does no encryption at all. ssh also uses a public and private key pair for authentication purposes. So you will not have store a password in a plain file which might be easy to read for others.

There are plenty of threads setting up passwordless ssh/scp connections in this forum (there is a search function) as well are plenty of guides on the internet you can easy find with using your favourite search engine.

If possible do not use telnet - use ssh. Else you might want to use something like expect to control telnet or rsh which is also not encrypted.

I know that passwordless login using ssh is possible.

As ssh is only availible on routers with a crypto-image but not on switches the only way to connect is telnet. I don't want to encrypt the connection, but just the locally stored password used in the script.

I use expect for login to the devices.

Love, Sally

I do not know of any simple solution for that - as the password can be sniffed easily maybe setting correct permissions on the plain file and hiding it somewhere in the filesystem should be sufficient.
There are commands like md5 etc. that can store a password as a hash but I do not know of a simple way to decrypt it. Else it might make no big sense, since everyone who has access to that tool and the crypted file could do that, which reduces it again to having correct permissions on the file and directory.

so storing the file with chmod 600 is may be safe enough?

What is safe enough depends on your needs. Safe is a encrypted connection with keys which seems not possible from what you say. Everything below that is unsafe just in different shades and grades.

chown the file to your user and chmod it to 400. That's not much but better than nothing. Also set appropriate permissions to the directory it resides in.