2

I must use a proxy for all internet traffic, I currently have it specified like this in /etc/environment :

http_proxy=http://jsj:[email protected]:8080
https_proxy=http://jsj:[email protected]:8080
ftp_proxy=http://jsj:[email protected]:8080
no_proxy="localhost,127.0.0.1,localaddress,.localdomain.com"
HTTP_PROXY=http://jsj:[email protected]:8080
HTTPS_PROXY=http://jsj:[email protected]:8080
FTP_PROXY=http://jsj:[email protected]:8080
NO_PROXY="localhost,127.0.0.1,localaddress,.localdomain.com"

With my password in plain text because other than my browser - nothing prompts for a password and connections fail.

How can I get around this problem of having to specify my password in plaintext?

jsj
  • 1,400
  • 1
  • 16
  • 28

1 Answers1

1

If you put proxy settings in /etc/environment then every process running on the system will have access to the password.

If you only want the proxy settings for your user then put the settings in a file that's read when you log in, typically ~/.profile. If you don't want the password to be readable by someone who steals the disk, encrypt your home directory, or read it back from a password store — see Avoiding plain-text password in http_proxy. The password will still be readable by all the applications you run.

Alternatively, if you want to hide the password more, you could run a proxy locally, and have it use your work proxy as an upstream proxy. Then only your own proxy would need to have your credentials for the upstream proxy. Tinyproxy should be a good choice; it's small, supports upstream proxies, and supports HTTPS, but not FTP. The password needs to be in the configuration file; put this on an encrypted volume if you want to protect it against disk thieves.

Community
  • 1
Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
  • Assuming I put in in ~/.profile. Is it normal to put passwords in plaintext for this kind of thing? The credentials are the same for *everything* in my organisation, so I'm assuming it's some sort of security faux pas to put it in plaintext anywhere (a faux pax generally - not just in terms of my organisation's policies) – jsj Apr 28 '16 at 23:44
  • @jsj That depends on the sensitivity of the password. If this was only a password for the proxy, it would probably be low-value. Given that this is your everything-password, it's high-value and should definitely not be exposed to all the applications you run — but your organization clearly expects you to expose it at least to your browser, so they aren't very good at security: they're focusing on controlling employees and have forgotten that they're supposed to protect the organization from intrusions. *(cont.)* – Gilles 'SO- stop being evil' Apr 28 '16 at 23:53
  • @jsj *(cont.)* Given that your org apparently expects you to write the password in your browser configuration, I wouldn't sweat writing it in `tinyproxy.conf` without worrying about encryption. – Gilles 'SO- stop being evil' Apr 28 '16 at 23:53
  • The browser prompts for authentication (and presumably then throws the credentials away afterwards - idk how long the proxy auth lasts for?) And setting aside my orgs decisions, what do you think the best policy would be? separate, low value credentials for the internal proxy? – jsj Apr 29 '16 at 01:38
  • @jsj From a security perspective, just make sure that the proxy only listens on localhost. From a bureaucratic perspective, I don't know what your organization would require. – Gilles 'SO- stop being evil' Apr 29 '16 at 13:55