Private key in bash history a security issue?

Question

Assume I generate a Private key for a hidden service. Assume I receive it in base64 encoding (this can happen for example by using shallot and posting the results to stdout). Assume I install tor and the hidden service as root, but tor runs with another user (ie. debian-tor).

Is there a good way to deploy the key to the server, without leaving is base64 encoded in the bash history? It would stay in the history if I do it like this:

echo base64encodedsecretkeyxxxxxxxxxxxxxx | base64 --decode > /var/lib/tor/hidden-service-pk-file

And would it be a security issue if it is in the bash history of root?

My assumption is: to retrieve the code from the bash history someone would have to

• log in as root OR
• put the hard drive into another computer, where root access is available

Either way the private key would be accessible (even if it is not in the bash history).

Background of my question: I want to describe to someone else, how to properly set up a hidden service - I don't want to do the procedure for him though. So I'm looking for a way to describe how to deploy the key correctly.

Answer 1

Bash doesn't write the history to disk until it exits (or until you call something like history -w), so you can run history -c in bash to clear the current in-process history after you've run the echo command. In bash you can also start your command with a space character " ", which tells bash to not include the command in the history.

You might also want to be careful that your command doesn't expose your key through tools like top. For example if you were to run the command tor --help, other users would be able to see that you ran tor with the --help flag. In this case, bash has a built-in echo command (it doesn't call /usr/bin/echo), so I don't think echo base64encodedsecretkey would show up in a process list, but it's something to keep in mind, especially if you were using something other than echo, or a different shell.

My assumption is: to retrieve the code from the bash history someone would have to

• log in as root OR
• put the hard drive into another computer, where root access is available

Either way the private key would be accessible (even if it is not in the bash history).

Right, if you ran the command as root, then the bash history should only be readable by root (assuming you have your permissions set correctly, which should be the default), or anything running with root permissions (docker, etc). And if the user can run their own OS, then they can read any file, including the bash history of root or the private key directly.