How to hide passwords and secret keys in environment variables ? (Linux)

Question

I am using manjaro and bash shell. I am trying to hide passwords and secret keys in environment variables so that I can use them in my python script.

I tried this in my .bashrc file

export BOT_EMAIL="mymail@automail.com"
export BOT_PASS="pass_"

And if i run this script from terminal it runs

import os

a = os.environ.get("BOT_EMAIL")
b = os.environ.get("BOT_PASS")

print(a, b)

and gives me this output as expected

mymail@automail.com pass_

But the problem arrives when i try to run the script from sublime text 3 it gives me this

None None

which i think is sublime problem so I restarted sublime about ten times and even restarted my computer but it keeps giving None.

I am noob in programming and linux it would be very helpful if someone can solve this problem.

Note well that "hide" is a poor term for what you describe. You may save yourself the need to type the information manually, but environment variables and shell configuration files are not secure means to store or convey sensitive information such as passwords. — John Bollinger, Sep 22 '20 at 18:53
[This answer](https://unix.stackexchange.com/a/212363/79040) by `Jenny D` to the question *Hiding Passwords in Shell Scripts* has superb advice about password security. I recommend you read it. — mattst, Sep 24 '20 at 17:24

score 2 · Accepted Answer · answered Sep 22 '20 at 18:32

Sublime inherits its environment variables from the environment it's started in. So, if you start it from bash, it will be able to read all the variables you had set when it started. If you start it from the sublime_text.desktop file (an icon in a menu or on the side bar), it'll only be able to read the env variables that were set when the Launcher process started up -- i.e., at login. So, if you don't want to always start from the command line, put your environment variables in your ~/.profile file, then log out and back in. Putting them in ~/.bashrc won't work, as that's only read for interactive sessions.

Alternatively, you can define env vars in your build system. A sample one might look something like this:

{
    "shell_cmd": "python3 -u \"$file\"",
    "file_regex": "^[ ]*File \"(...*?)\", line ([0-9]*)",
    "selector": "source.python",

    "env": {"PYTHONIOENCODING": "utf-8",
            "MYVAR1": "value1",
            "MYVAR2": "value2"
    }
}

This has the advantage of being able to change variables and values without having to log out and back in.

score 0 · Answer 2 · answered Mar 30 '21 at 19:51

I think MattDMo touched on this (but just to elaborate on why thats important - as I recently resolved this same issue)

Your IDE is inheriting the env var from the program-startup. To have your new env var take effect: shut down and restart your IDE.

score -3 · Answer 3 · answered Sep 22 '20 at 17:14

-3

You are setting the environmental variable for your local user. Sublime most possibly should be running as a different user. You can figure this out from top or ps command.

If you want global variables set, explore /etc/profile or /etc/environment.

answered Sep 22 '20 at 17:14

rickydj

629
5
17

1

No, you don't want to be running an editor as a different user, and you **definitely** don't want to be messing around with global variables and `/etc/` files... – MattDMo Sep 22 '20 at 18:24

How to hide passwords and secret keys in environment variables ? (Linux)

3 Answers3