Security: Best Solution Hide Credentials also from running Task / Process

[nics-on]

Hello,
first... Thanks for your great Work :)
Im looking for a possibility to mask the Credentials.

I tried:

• Use Vars inside Script... bad because clear Text.
• Use of .env file loading to my shell script... bad because clear Text.
• Use zenity... better, seems the best Way till now. But... the running process contains clear Text Credentials.

Can you tell me if there is a better or... maybe the best Way to get some privacy?

Edit:

• Use of env FREERDP_ASKPASS=true hides Credentials from running process.
  But this Solution works only when the process starts with or inside Terminal.

[akallabeth]

well, use /args-from like mentioned in help texts and runtime suggestions?

[nics-on]

Hi @akallabeth
i tried a search for "args-from" in the whole Repo. Found a lot but no Help or Wiki entry.
But lucky i found your Comments and Code for the Option :)
After some Hours.... WOW it Works fine now that was the right Way, ty.

Maybe some other also needs a Solution so... what i've done is a combination of 3 Methods:
If you change Filenames or Path you have to do this changes also in the Script & other Paths.
This Solution works with https://packages.debian.org/en/sid/zenity on Debian 13 (Trixie) so maybe other Distributions... other Methods.

1. Create Directory "~/.config/xfreerdp-custom/" and File "xrdp.env" in your (or Users) Home Directory

mkdir ~/.config/xfreerdp-custom/;nano ~/.config/xfreerdp-custom/xrdp.env

This is the File for Standard Connection Options Hostname/IP
Contents:

user='yourWindowsUserName'
host='10.10.8.x'
port='3389'

2. Create Directory "/usr/local/share/scripts/" and the Script which sends your values through stdin "xrdp.args.sh"

mkdir /usr/local/share/scripts/;nano /usr/local/share/scripts/xrdp.args.sh

Contents:

#!/bin/sh

# License: Free
# Author: Nicson Web & IT Consulting GmbH (CH)
# Github: https://github.com/nic-son

# Include pre- defined vars
. /home/$USER/.config/xfreerdp-custom/xrdp.env

# Send standard values to stdin
echo "/scale-desktop:100"
echo "/cert:ignore"
echo "+clipboard"

# Connection specific values from User > xrdp.env
echo "/u:$user"
echo "/v:$host"
echo "/port:$port"

# Use zenity to recieve password, also possible for other values
echo "/p:$(zenity --password --title='RDP Password')"

app=$1 # App given e.g. :  ./xrdp.args.sh outlook

if [ -z "$app" ]; then
	echo "Missing Parameter *appname*"
	exit
elif [ $app = "rdp" ]; then
	echo '/size:1600x900'
elif [ $app = "rdp-multi" ]; then
	echo '/monitors:0,1,2'
	echo '/multimon'
	echo "/floatbar"
# Office 365
elif [ $app = "outlook" ]; then
	echo '/app:program:C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE,name:Microsoft Outlook,icon:/usr/share/icons/outlook.ico'
	# Icon not working....?
else
	echo "ERROR: Wrong Parameter - isset: $1"
	exit
fi

4. Make the Script executable

chmod +x /usr/local/share/scripts/xrdp.args.sh

5. Create a Starter in your applications Directory (Trixie: /home/$USER/.local/share/applications)
   Exec Command (Flatpak Version....):

sh -c "bash /usr/local/share/scripts/./xrdp.args.sh rdp | flatpak run --command=xfreerdp com.freerdp.FreeRDP /args-from:stdin"

To run different Apps you have to modify the argument before " | Pipe" e.g. ./xrdp.args.sh rdp > ./xrdp.args.sh outlook
So i hope this is ok, seems a secure Option. Maybe there are also other Solutions. But this works for now... and is a base to work on.

Thank you, Merry Christmas .... and soon Happy New Year ;)

Clean Process running:

[akallabeth]

well, there is xfreerdp /? or man xfreerdp ?
(replace xfreerdp with your client of choice)