Closed matthewcummings closed 5 years ago
Also set -o pipefail
and check that the generated password isn't empty and isn't hash of empty (if using the head|hash|head trick I suggested, where the hash is actually just to replace encoding to hex).
Improved this to:
$ cat rand.sh
#!/bin/bash
set -eo pipefail
pw=`od -An -tx8 -N16 /dev/urandom | tr -d ' '`
test ${#pw} -eq 32 # relies on "set -e" mode
echo $pw
Edit: to clarify, the above is just a test script. I suggest you include lines from it into your larger script as needed. I do not suggest adding this as a separate script.
@solardiz @lukewegryn suggested pwgen but I don't think it matters too much either way, I'll go with the urandom approach.
Will also add set -o pipefail
Also, maybe we can avoid the dependencies on wget, gosu (depends on why exactly we need gosu), and pwgen (easy to avoid - just e.g.
head -c 32 /dev/urandom | sha256sum | head -c 64
).