Make shell script contents difficult to read

Question

I am setting up an escape-room-esque experience for a group of 11 and 12 year olds. As part of the activity, I'm going to set up an old Mac (likely running Snow Leopard) with a specially-created user account. The desktop will contain an interactive, executable .command shell script that asks the kids to input a series of "passwords" to obtain the code to a safe.

I'm a little concerned that some enterprising child will realize they can open the script in a text editor and just read all the passwords. Making the account boot directly to a console might help, but I'd rather not do that, and there's still a risk someone will know the nano command.

How can I make this script as difficult to read as possible?

Answer 1

Option 1: use the shell script compiler to turn the script into a binary executable. The binary will still contain the script (in highly obscured form), but unlike a regular script, you can set the file permissions so the account the kids are using doesn't have read access to it (just execute).

Option 2: Encrypt the safe code using the "passwords", store the encrypted code in the script, and use what the kids enter to decrypt it. Here's an encryption process you could use with three passwords, "sekrit1", "hunter2", and "p4ssw0rd3":

$ echo '12 left, 25 right, 9 left' | openssl enc -aes256 -base64 -pass "pass:sekrit1|hunter2|p4ssw0rd3"
U2FsdGVkX18IFQAaSjEv2AJJ16z6wjROjcHiqHWGvji3MEsmcHwPgu3MQeh2O+c1

Then in the script:

read -p "Enter the first password: " pass1
read -p "Enter the second password: " pass2
read -p "Enter the third password: " pass3
encrypted="U2FsdGVkX18IFQAaSjEv2AJJ16z6wjROjcHiqHWGvji3MEsmcHwPgu3MQeh2O+c1"
if result=$(echo "$encrypted" | openssl enc -d -aes256 -base64 -pass "pass:$pass1|$pass2|$pass3" 2>/dev/null); then
    echo "The safe combination is $result"
else
    echo "At least one password is wrong!"
fi

If you want to give the kids password-by-password feedback, you could add checking the hashes of the passwords as they're entered:

$ echo "sekrit1" | shasum
b19fb68c28bff07cf8fcc7c53ab48c5d6f41e993  -

In script:

read -p "Enter the first password: " pass1
if [ "$(echo "$pass1" | shasum)" = "b19fb68c28bff07cf8fcc7c53ab48c5d6f41e993  -" ]; then
        echo "Correct so far..."
else
        echo "Wrong!"
        exit
fi
...etc

BTW, this isn't a really secure way to store passwords; proper secure password hashes are designed to be slow and use "salt". But this should be secure enough for some kids.

Answer 2

You could use Platypus to wrap the script up in an app which would be hard to read.

_{Disclaimer: I'm a satisfied user of Platypus and have no financial or other connections with Sveinbjorn.org.}

Answer 3

I have ultimately decided to go with this node program which obfuscates bash scripts: https://www.npmjs.com/package/bash-obfuscate. I used pkg to turn the program into a static binary executable I will be able to run on any Mac computer. While the obfuscation isn't perfect, it should be more than enough for my young audience.

---

Gordon Davisson's answer is strong and will likely work for others who come across this question. However, I have some concerns for my specific use case. I plan to modify these "passwords" shortly before running the activity, so they can be tuned to my environment and audience. I need this process to be quick and not prone to errors. Thus:

1. SHC, which compiles shell scripts to binary executables, requires that a proper dev environment with gcc be installed on the machine. I am not sure what machine I will be using when I set this up, so I want to avoid this requirement.

2. Modifying the script to use encrypted passwords—and encrypting the output that gets displayed once all passwords are entered—would be a manual process, and one I'd have to redo when I change the passwords. And I'd need to retest the encrypted script after every change, to make sure I didn't mess anything up.