Assume I generate a Private key for a hidden service. Assume I receive it in base64 encoding (this can happen for example by using shallot and posting the results to stdout). Assume I install tor and the hidden service as root, but tor runs with another user (ie. debian-tor).
Is there a good way to deploy the key to the server, without leaving is base64 encoded in the bash history? It would stay in the history if I do it like this:
echo base64encodedsecretkeyxxxxxxxxxxxxxx | base64 --decode > /var/lib/tor/hidden-service-pk-file
And would it be a security issue if it is in the bash history of root?
My assumption is: to retrieve the code from the bash history someone would have to
- log in as root OR
- put the hard drive into another computer, where root access is available
Either way the private key would be accessible (even if it is not in the bash history).
Background of my question: I want to describe to someone else, how to properly set up a hidden service - I don't want to do the procedure for him though. So I'm looking for a way to describe how to deploy the key correctly.