6 ms·

> openssl pkcs8 -topk8 -v2 des3 \ > -in test_rsa_key.old -passin 'pass:super secret passphrase' \ > -out test_rsa_key -passout 'pass:super secret passp

> openssl pkcs8 -topk8 -v2 des3 \ > -in test_rsa_key.old -passin 'pass:super secret passphrase' \ > -out test_rsa_key -passout 'pass:super secret passphrase' Is there a way to do this without including the password on the command line? Because somehow I don't think having your private key's password in your .bash_history will improve the security of your key. [edit] Oh I see, just don't specify and it'll ask. I get that he's doing this with a sample key, but you just know someone's going to scan through this and do that command on their real key.

X-Istence 13y ago
He did in the last example that shows how to do this on an actual file ...
rammark 13y ago
If you put 'histcontrol=ignorespace' or 'histcontrol=ignoredups' in your ~/.bashrc file it will not record commands that begin with a space [1]. I believe that 'ignoreboth' is the default on many Linux distros. [1]: http://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol http://www.linuxjournal.com/content/using-bash-history-more-...
- joosters 13y ago
  You still shouldn't enter these kinds of commands on a multi-user machine, because anyone running 'ps' will see the commandline arguments.
makr17 13y ago
$ export HISTFILE=/dev/null
- Nux 13y ago
  You want: unset HISTFILE
  - yew 13y ago
    Don't do that in your .bash_profile unless you run login shells on all of your terminals! Setting HISTFILE propagates that setting to child shells - unsetting HISFILE does not.
  - dsl 13y ago
    Undefined = Default
jlgaddis 13y ago
Leave out -passin and -passout. Provide your current passphrase at the first prompt ("Enter passphrase for <infile>:") and your new passphrase at the second and third prompts ("Enter Encryption Password:" and "Verifying - Enter Encryption Password:"). You may use the same or a different passphrase on your new key.
vacri 13y ago
To avoid a command showing up in history, start the whole command with a space and the line won't be recorded to history. Or if that horse has already bolted, you can use the 'history' command to find the line number and then delete it. Of course, most things that require passwords will request that you manually enter one if you leave the arg off.
stormbrew 13y ago
To clarify, my point is that a blog post about improving your security should not have an easily cut-and-pasteable reference for substantially decreasing your security, even if it's intended to be used on a dummy file.

X-Istence 13y ago

He did in the last example that shows how to do this on an actual file ...

rammark 13y ago

If you put 'histcontrol=ignorespace' or 'histcontrol=ignoredups' in your ~/.bashrc file it will not record commands that begin with a space [1]. I believe that 'ignoreboth' is the default on many Linux distros. [1]: http://www.linuxjournal.com/content/using-bash-history-more-efficiently-histcontrol http://www.linuxjournal.com/content/using-bash-history-more-...

joosters 13y ago
You still shouldn't enter these kinds of commands on a multi-user machine, because anyone running 'ps' will see the commandline arguments.

makr17 13y ago

$ export HISTFILE=/dev/null

Nux 13y ago
You want: unset HISTFILE
- yew 13y ago
  Don't do that in your .bash_profile unless you run login shells on all of your terminals! Setting HISTFILE propagates that setting to child shells - unsetting HISFILE does not.
- dsl 13y ago
  Undefined = Default

jlgaddis 13y ago

Leave out -passin and -passout. Provide your current passphrase at the first prompt ("Enter passphrase for <infile>:") and your new passphrase at the second and third prompts ("Enter Encryption Password:" and "Verifying - Enter Encryption Password:"). You may use the same or a different passphrase on your new key.

vacri 13y ago

To avoid a command showing up in history, start the whole command with a space and the line won't be recorded to history. Or if that horse has already bolted, you can use the 'history' command to find the line number and then delete it. Of course, most things that require passwords will request that you manually enter one if you leave the arg off.

stormbrew 13y ago

To clarify, my point is that a blog post about improving your security should not have an easily cut-and-pasteable reference for substantially decreasing your security, even if it's intended to be used on a dummy file.