Can shell Script be protected

short answer: no
long amswer: there exist tools to convert a schell script into binary code, for example shc

 http://www.datsi.fi.upm.es/~frosal/frosal.html
 http://www.cactus.com/products/cactus/shell-lock.html

You could write two scripts.  Encrypt one of them and have the other one ask for a password, decrypt the second script and then run it...

I've never done this, though -- it is just an idea...

Continuing with my previous idea, create a "wrapper" script whose only purpose is to take a password, decrypt your script and then run it:

#!/bin/sh
# wrapper.sh
# Assumes the password was passed in on the command line

crypt $1 < myscript.esh > temp.sh;
chmod +x temp.sh
(temp.sh)            

# -- end of wrapper


To avoid having the "temp.sh" be somewhere on the disk while it is running, add this line to the top of your script:

if [ "`basename $0`" = "temp.sh" ];  then
  rm $0
fi

I don't know if this will work on all versions of Unix/Linux -- you'll just have to try it and see...  It worked on an HP/UX box that I tried it on.


Finally, encrypt your script (named "myscript.sh" in this example):

crypt key < myscript.sh > myscript.esh

where key is the string needed to decrypt the file...


Then, you just distribute wrapper.sh, myscript.esh and the key...

Then again, I guess if you know the password, you could just decrypt "myscript.esh" :)...   Oh well, so much for that approach.  It was fun to think about, though...

nebeker's suggestion cracked down to the basics:

   crypt key < myscript.sh > myscript.esh

then use ithe encrypted script:

   crypt key < myscript.esh |sh

But how does this hide the script from the user?
You always need the key/password in clear text somewhere, and so you (and the user too) can always see the code.
Useless effort, just wasting performance, somehow ..

Hi, I have done something like this myself. My solution is very much like nebeker's, only my "wrapper" is not a script, but a binary.  The encryptation key is coded into the binary and hence it is impossible to read if you are not able to decompile the binary.

So, Rajiv Indya, if you can write and compile a small program which contains the encryptation key, decrypt the script, copy the decrypted file in a "secret place", put a self-deleting command (rm $0) at the top of it and run it.
The decrypted file will then exist only for fraction of a second.
I am running a number of "secret" scripts this way, it works fine for me.

> The decrypted file will then exist only for fraction of a second.

Nonsense!
The decrypted file exists as long as I want to have it, 'cause I simply use adb, dbx, or whatever, to execute the binary :-))
And as side-effect I can tell you the password, nevertheless how much time and security algorithms you waste.

It's impossible. Dot.
You just can make it more harder to read. That's all.

for tryno

Is there any  way so that I can run the shell script using pipe
like
crypt key < myscript.sh |sh
This way no file will exist on the server.
Also If I  am writting a 'C' code and crypting it within the code using exec command , will the command will be visible with "ps -eaf"

Pl clarify

Hello, as ahoffmann says, running the program thru pipe will make the cryptation key visible with process listing command ps as long as the program is running.  That's exactly the reason why I decided not to do this, but using a temporary decrypted file instead.
I decided that the risk is smaller using a temp file for a very short time.
I admit that I was not aware of the debugging tools mentioned by ahoffmann.  That means, if the people you want to protect against are competent enough, they will manage to crack the key anyway.  Nevertheless, if we talk about protection against "average" users, the method may still be of interest.

No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:

Answered by ahoffmann

Please leave any comments here within the next seven days.

PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!

liddler
EE Cleanup Volunteer