I am setting up an escape-room-esque experience for a group of 11 and 12 year olds. As part of the activity, I'm going to set up an old Mac (likely running Snow Leopard) with a specially-created user account. The desktop will contain an interactive, executable .command shell script that asks the kids to input a series of "passwords" to obtain the code to a safe.

I'm a little concerned that some enterprising child will realize they can open the script in a text editor and just read all the passwords. Making the account boot directly to a console might help, but I'd rather not do that, and there's still a risk someone will know the nano command.

How can I make this script as difficult to read as possible?


Option 1: use the shell script compiler to turn the script into a binary executable. The binary will still contain the script (in highly obscured form), but unlike a regular script, you can set the file permissions so the account the kids are using doesn't have read access to it (just execute).

Option 2: Encrypt the safe code using the "passwords", store the encrypted code in the script, and use what the kids enter to decrypt it. Here's an encryption process you could use with three passwords, "sekrit1", "hunter2", and "p4ssw0rd3":

$ echo '12 left, 25 right, 9 left' | openssl enc -aes256 -base64 -pass "pass:sekrit1|hunter2|p4ssw0rd3"

Then in the script:

read -p "Enter the first password: " pass1
read -p "Enter the second password: " pass2
read -p "Enter the third password: " pass3
if result=$(echo "$encrypted" | openssl enc -d -aes256 -base64 -pass "pass:$pass1|$pass2|$pass3" 2>/dev/null); then
    echo "The safe combination is $result"
    echo "At least one password is wrong!"

If you want to give the kids password-by-password feedback, you could add checking the hashes of the passwords as they're entered:

$ echo "sekrit1" | shasum
b19fb68c28bff07cf8fcc7c53ab48c5d6f41e993  -

In script:

read -p "Enter the first password: " pass1
if [ "$(echo "$pass1" | shasum)" = "b19fb68c28bff07cf8fcc7c53ab48c5d6f41e993  -" ]; then
        echo "Correct so far..."
        echo "Wrong!"

BTW, this isn't a really secure way to store passwords; proper secure password hashes are designed to be slow and use "salt". But this should be secure enough for some kids.

  • Thanks! The shasum bit is great, although I think I'll need to use that compiler... even if the password answers aren't visible, the output at the end of the script is. Jan 10 '19 at 1:19
  • 1
    @Wowfunhappy If you encrypt all of the final output (with openssl enc), you should be able to avoid that problem. Note that it's entirely possible to encrypt multiple strings (bits of output, prompts, etc) with the same password(s). If it's the actual program logic that needs to be hidden, that's more complicated. Jan 10 '19 at 1:25

You could use Platypus to wrap the script up in an app which would be hard to read.

Disclaimer: I'm a satisfied user of Platypus and have no financial or other connections with Sveinbjorn.org.

  • Unfortunately, this does not appear to work with an interactive script. The kids won't be able to input the passwords! Jan 9 '19 at 20:10
  • Dang. From Sveinbjorn.org: User interaction with CocoaDialog -- Platypus apps may be able to use CocoaDialog to construct scripts that prompt for user input with dialogs. As of writing, the CocoaDialog project seems to be dead. CocoaDialog is available at github but it may not work. Sorry for the seemingly dead end.
    – IconDaemon
    Jan 10 '19 at 10:43

I have ultimately decided to go with this node program which obfuscates bash scripts: https://www.npmjs.com/package/bash-obfuscate. I used pkg to turn the program into a static binary executable I will be able to run on any Mac computer. While the obfuscation isn't perfect, it should be more than enough for my young audience.

Gordon Davisson's answer is strong and will likely work for others who come across this question. However, I have some concerns for my specific use case. I plan to modify these "passwords" shortly before running the activity, so they can be tuned to my environment and audience. I need this process to be quick and not prone to errors. Thus:

  1. SHC, which compiles shell scripts to binary executables, requires that a proper dev environment with gcc be installed on the machine. I am not sure what machine I will be using when I set this up, so I want to avoid this requirement.

  2. Modifying the script to use encrypted passwords—and encrypting the output that gets displayed once all passwords are entered—would be a manual process, and one I'd have to redo when I change the passwords. And I'd need to retest the encrypted script after every change, to make sure I didn't mess anything up.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .