# Crazy question: Storing an encrypted user password

**URL:** <https://www.ruby-forum.com/t/crazy-question-storing-an-encrypted-user-password/139792>\
**Category:** Rails\
**Created:** [June 7, 2008, 1:36am UTC](https://www.ruby-forum.com/t/crazy-question-storing-an-encrypted-user-password/139792 "2008-06-07T01:36:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![darth\_ivan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/22d042/32.png) [@darth\_ivan](https://www.ruby-forum.com/u/darth_ivan)\
**Post date:** [June 7, 2008, 1:36am UTC](https://www.ruby-forum.com/t/crazy-question-storing-an-encrypted-user-password/139792/1 "2008-06-07T01:36:49Z")

</div>

Hi,

I’m no expert at all on security, but today I was pondering an  
interesting idea about storing passwords for use across a network  
connection.

Here’s the scenario:

You have an application you want to deploy via Capistrano and there are  
some commands to be run with sudo, but you don’t want to provide the  
password each time you do that, so…

What if you store a password encrypted with the sudoer’s public key on  
your application (say config/deploy/user.pw), and when you need to  
provide a password you do something like:

run “sudo ls” do |channel, stream, data|  
if data =~ /^Password:/  
# decrypt user.pw using user’s private key  
channel.send\_data “#{decrypted\_password}\n”  
end  
end

Of course this would work only if the private key doesn’t have a  
passphrase…

So, security-wise, what do you think of this approach?

Regards,  
Ivan V.

---

<div class="post-metadata">

**Author:** ![darth\_ivan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/22d042/32.png) [@darth\_ivan](https://www.ruby-forum.com/u/darth_ivan)\
**Post date:** [June 9, 2008, 8:35am UTC](https://www.ruby-forum.com/t/crazy-question-storing-an-encrypted-user-password/139792/2 "2008-06-09T08:35:04Z")

</div>

On Jun 6, 7:36 pm, “Ivan V.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> password each time you do that, so…  
> In my experience, I only have to provide the password upon logging  
> into the remote machine… the sudo password is the same and I don’t  
> get prompts after that.

---

<div class="post-metadata">

**Author:** ![darth\_ivan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/22d042/32.png) [@darth\_ivan](https://www.ruby-forum.com/u/darth_ivan)\
**Post date:** [June 9, 2008, 5:44pm UTC](https://www.ruby-forum.com/t/crazy-question-storing-an-encrypted-user-password/139792/3 "2008-06-09T17:44:29Z")

</div>

On Sun, Jun 8, 2008 at 11:34 PM, jemminger [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > Of course this would work only if the private key doesn’t have a  
> > passphrase…
> > 
> > So, security-wise, what do you think of this approach?

Depends on your threat model. The problem here is that anyone who is  
able to gain access to the private key file now has the user’s  
password. Generally speaking, this is considered bad and is why  
passwords on Unix/Windows systems aren’t encrypted- they’re hashed so  
the plain text password is unrecoverable. Honestly, this just changes  
what file you have to protect (the private key instead of your script  
with the password embedded).

You’re probably better off prompting for the password, caching it and  
re-using it multiple times. Alternatively, you can edit the  
/etc/sudoers file to give your user access to the necessary commands  
without prompting for a password (and to prompt for any other  
command).

–  
Aaron T.  
[http://synfin.net/](http://synfin.net/)  
[http://tcpreplay.synfin.net/](http://tcpreplay.synfin.net/) - Pcap editing and replay tools for Unix &  
Windows  
They that can give up essential liberty to obtain a little temporary  
safety deserve neither liberty nor safety. – Benjamin Franklin

---

<div class="post-metadata">

**Author:** ![darth\_ivan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/22d042/32.png) [@darth\_ivan](https://www.ruby-forum.com/u/darth_ivan)\
**Post date:** [June 11, 2008, 7:24pm UTC](https://www.ruby-forum.com/t/crazy-question-storing-an-encrypted-user-password/139792/4 "2008-06-11T19:24:23Z")

</div>

Thanks for your input. I’ve reconsidered this approach now, but it  
seemed like a fun idea at the time 🙂

- Ivan V.

Aaron T. wrote:

> On Sun, Jun 8, 2008 at 11:34 PM, jemminger [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > > Of course this would work only if the private key doesn’t have a  
> > > passphrase…
> > > 
> > > So, security-wise, what do you think of this approach?
> 
> Depends on your threat model. The problem here is that anyone who is  
> able to gain access to the private key file now has the user’s  
> password. Generally speaking, this is considered bad and is why  
> passwords on Unix/Windows systems aren’t encrypted- they’re hashed so  
> the plain text password is unrecoverable. Honestly, this just changes  
> what file you have to protect (the private key instead of your script  
> with the password embedded).
> 
> You’re probably better off prompting for the password, caching it and  
> re-using it multiple times. Alternatively, you can edit the  
> /etc/sudoers file to give your user access to the necessary commands  
> without prompting for a password (and to prompt for any other  
> command).
> 
> –  
> Aaron T.  
> [http://synfin.net/](http://synfin.net/)  
> [http://tcpreplay.synfin.net/](http://tcpreplay.synfin.net/) - Pcap editing and replay tools for Unix &  
> Windows  
> They that can give up essential liberty to obtain a little temporary  
> safety deserve neither liberty nor safety. – Benjamin Franklin