how can i mask the middle line of a pem key in bash script

Question

how can I mask the middle lines of a PEM key in bash script

I need to echo my pem key with mask(*) the middle lines through a bash script

for example:-

as

I tried with awk but it failed:

awk 'BEGIN{FS=OFS=""} {for(i=2;i<='15';i++) $i="*"}1'

What have you searched for, and what did you find? What have you tried, and how did it fail? — tripleee, Nov 27 '19 at 08:53
tried with awk but its failed ```awk 'BEGIN{FS=OFS=""} {for(i=2;i<='15';i++) $i="*"}1'``` — Pradeep Chandran, Nov 27 '19 at 08:57
You can't use single quotes inside single quotes. The number should not be quoted at all anyway. — tripleee, Nov 27 '19 at 09:06
But perhaps a better fix would be `'NR>2 && NR < 16 { gsub(/./, "*") } 1'` if you know the exact number of lines. To only print the first masked line, replace `1` with `NR<=3 || NR >= 15` for example. To cope with a variable number of lines, keep the last few lines in memory and print in the `END` block. — tripleee, Nov 27 '19 at 09:09
@PradeepChandran, How many lines you want to mask? All apart from 1st and last? Can you please confirm once? — RavinderSingh13, Nov 27 '19 at 09:16
Please update the question with real requirements. Your attempt implied you only need a solution for a 17-line file. — Wiktor Stribiżew, Nov 27 '19 at 10:05

Wiktor Stribiżew · Answer 1 · 2019-11-27T10:03:23.490

2

Scenario 1: 17-line PEM file

It looks like your file has a fixed amount of lines and you want to replace all lines from the third till the fifteenth one.

You may solve it with sed:

sed -e '3,15d' pemfile | sed -e  "3 i\\$(printf '*%.0s' {1..64})" > newpemfile

NOTES:

sed -e '3,15d' pemfile - removes lines from the third through the fifteenth
sed -e "3 i\\$(printf '*%.0s' {1..64})" > newpemfile - adds a 64-asterisk line as the third line and saves the file as newpemfile.

Scenario 2: Replace all lines but the first/last between two delimiter lines with a line with hardcoded number of asterisks

If your problem is replacing the lines between two delimiters you may use GNU sed solution like

sed -E "/^-+BEGIN CERTIFICATE-+$/{
    n;n;
    :a; N; /\n-+END CERTIFICATE-+$/!ba; s/.*(\n.*\n)/$(printf '*%.0s' {1..64})\1/;
}" pemfile

See this online sed demo

Here,

/^-+BEGIN CERTIFICATE-+$/{ - matches a line like ---BEGIN CERTIFICATE---- and if found, the block commands are executed:
- n;n; - read two lines, the last is in the pattern space
- :a; N; /\n-+END CERTIFICATE-+$/!ba; - read all lines up to a line like ---END CERTIFICATE--- appending with newlines to the pattern space
- s/.*(\n.*\n)/$(printf '*%.0s' {1..64})\1/; - replace the whole pattern space text with 64 asterisks and the last two lines (we remove all lines up to the last two here) }`

edited Nov 27 '19 at 10:03

answered Nov 27 '19 at 09:20

Wiktor Stribiżew

607,720
39
448
563

Great solution. Actually, you could combine this into one sed statement, correct? – stephanmg Nov 27 '19 at 09:21
Would pem file always have the same length? And only one cert in one pem file? – Jotne Nov 27 '19 at 09:28
1

@Jotne yes if they have the same key size. No if key size varies. – Johannes H. Nov 27 '19 at 09:28
2

@JohannesH.I did just check my works pem files on ubuntu and cert are on different size and also multiple cert in on pem file. – Jotne Nov 27 '19 at 09:33
@Wiktor Stribiżew it works for above pem key but i like to list all my pem keys with the mask, here you hardcore the line number and star char count both will be different for other pem keys :( – Pradeep Chandran Nov 27 '19 at 09:46
1

@PradeepChandran The second solution does not have any hardcoded line numbers, it is based on the assumption there are always two or more lines between `START CERTITICATE` and `END CERTITICATE` lines. – Wiktor Stribiżew Nov 27 '19 at 09:56
@Wiktor Stribiżew some pem keys did not have START CERTIFICATE and END CERTIFICATE lines – Pradeep Chandran Nov 27 '19 at 10:00
1

@PradeepChandran Then what are the requirements? – Wiktor Stribiżew Nov 27 '19 at 10:01
requirements are in the question: print the first and last two lines of a file, replace the middle content by one line of stars. period. – Johannes H. Nov 27 '19 at 15:30

potong · Accepted Answer · 2019-11-27T13:04:07.280

2

This might work for you (GNU sed):

sed -n '1p;1n;2p;2s/./*/gp;$!N;$!D;p' file

Turn off implicit printing by using the -n option.

Print the first and second lines, then replace every character of the second line by *'s and print that too.

Make a window of two lines throughout the remainder of the file and print it on the last line.

On reflection, a shorter solution:

sed 'N;2p;4s/\S/*/g;4P;$!D' file

does the same as the first solution but perhaps more cryptically.

edited Nov 27 '19 at 13:04

answered Nov 27 '19 at 09:49

potong

55,640
6
51
83

it works with most of the pem keys but not working with single lined pem keys like ```ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAhs3/WTw+nYEXM9daoBUA9Z76tjJ1qXRVUEyc/XjxY7A4xnSd+IQeU9PItu2pu/jIeXUM1ksLdCoTPdqDTgrojQqjRNMjKrjDgp4BHSR5t0z2IYFbnkOmlp4t6CJ2XjfMMeBKnGa+tHpcZ+THJIVOK+KjdBEcwgoU3D7V++XDRrb9GvTMQTnwM0WPkHFqPyJfRaEyl89RVRhlQtseI08uCRRwZnxIzWeghoGGc0vfjvyFJud4YfEjP0wvd07XGPBg/ubJNdoPNS/73XdrS935vsBGZy20AjsHOjs7ZErqA46Ija2TWQXS7UUOLaSukYRNqFzh5A40ePuVAkuflnS+XAgtw== test``` – Pradeep Chandran Nov 27 '19 at 09:57
fixed that issue, split the single line to multiple with fold command thanks for the help!!!! – Pradeep Chandran Nov 27 '19 at 10:07

score 0 · Answer 3 · answered Nov 27 '19 at 09:25

I highly suggest using @WiktorStribizew's anser if the file is actually a fixed 16 lines long.

If it can vary (keys might have more or less bits), the simple way is to combine head and tail:

head -n2 key.pem ; echo 'XXXXXXX' ; tail -n2 key.pem

But if you're looking for a single command, take a look at this answer form a different question: https://stackoverflow.com/a/48002163/2284641

Jotne · Answer 4 · 2019-11-27T09:46:58.373

Here is what I did find work on our pem files

awk '/-----BEGIN/ {f=2} f-->0; /-----END/' etc/auth/server.pem
-----BEGIN CERTIFICATE-----
MIID8jCCAhoCCQDGQsEmfeBvJTANBgkqhkiG6w0BAQsFADB/MQswCQYDVQQGEwJV
-----END CERTIFICATE-----
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIF8jBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG6w0BBQwwDgQIpS+A9Ql+5uUCAggA
-----END ENCRYPTED PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MII8ejCCAmICCQCNHBN8tj/FwzANBgkqhkiG6w0BAQsFADB/MQswCQYDVQQGEwJV
-----END CERTIFICATE-----

It prints the header and footer of all cert + first line of cert.

Not exactly whats requested, but should be ok for the purpose of hiding the cert, and works with multiple cert in same pem file and multiple length of cert.

Or this is more correct (no counting lines, only awk)

awk '/-----BEGIN/ {f=2} f-->0; /-----END/ {print "****************************************************************\n" p "\n" $0}  {p=$0}' etc/auth/server.pem
-----BEGIN CERTIFICATE-----
MII8MjCCAhoCCQDGQsEmfeBvJTANBgkqhkiG9w0BAQsFADB/MQswCQYDVQQGEwJV
****************************************************************
WW/14Mz4
-----END CERTIFICATE-----
-----BEGIN ENCRYPTED PRIVATE KEY-----
MIIF8jBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIpS+A9Ql+5uUCAggA
****************************************************************
d9k=
-----END ENCRYPTED PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MII8ejCCAmICCQCNHBN8tj/FwzANBgkqhkiG9w0BAQsFADB/MQswCQYDVQQGEwJV
****************************************************************
ZZc1oaC0PKSzBmq+TpbR27B8Zra3gpoA+gavdRZj
-----END CERTIFICATE-----

awk '
  /-----BEGIN/ {f=2}
  f-->0; 
  /-----END/ {print "****************************************************************\n" p "\n" $0}
  {p=$0}
  ' etc/auth/server.pem

how can i mask the middle line of a pem key in bash script

4 Answers4

Linked