Shell Programming and Scripting

thank you. to mr. corona, i apologize if my post was offensive. my intent was to merely point out that i've been through enough impossible situations to know things can be possible if only thought of in a slightly different way. that's all.

and mr. alister, thank you for your insight. much appreciated!

How can you produce a random number and then know it, even as the script witer?
Anyhow - you may consider a different approach: Use a pass phrase that only you know and compute its checksum; use that as your number.

There are ways that would work, but you haven't wanted them. You're doing the opposite of what you think, clinging to one notion, not being creative.

Running them on a system you control and they don't; that would keep it safe.

Denying them access to the file, only allowing it to be run through sudo. That would keep it safe from anything but root.

Encrypting it with a ssl key, so it could only be run with a password, that would keep it safe from anyone that didn't know the password. (But not from anyone that did.) Note that they don't necessarily have to be the ones to punch in the password; you could type the password into ssh-agent, to keep it around for multiple later uses. Or the program could keep itself resident after being run once. Still difficult to perfectly protect from root but conceptually a lot harder to break.

Some sort of hardware-based crypto where the processor itself doesn't have access to the program, would also work.

But having a program containing its own instructions and key for decrypting itself into plaintext running itself on an 'enemy' machine cannot be made secure.

this could work! thank you!

---------- Post updated at 06:24 PM ---------- Previous update was at 06:19 PM ----------

thank you very much. when i asked the question, i was only going off my limited knowledge on this. and i'm very open to any ideas, as you put forth, that may be available.

the people who will be running the code will mostly have root access. so that kinda limits the options of things i can do. i'm very curios about what you said here:

"Some sort of hardware-based crypto where the processor itself doesn't have access to the program, would also work."

i will look into that. thanks again!!!

Basically means installing a gadget in their computer to run the program instead of running it natively. A black box they can't dissect -- unlike code running on their machine, which they can dissect at their leisure. Probably not what you had in mind.

Perhaps insulating it inside a virtual machine instead of a physical one, as well.

And what's to stop them from watching the script as it extracts this obfuscated number from itself? You can't stop root from being root.

If all you want is a random number for use in a shell script, both ksh and bash will give you a "random" number whenever you expand $RANDOM.

But, as has already been stated several times, trying to obfuscate a shell script by encrypting it and decrypting it when it is executed won't fool anyone who is willing to spend a little time to figure out how it works.