In the previous exercise you wrote a script that prompted the user to provide a password for the account
that was being created in this lesson you're going to learn a few different ways to generate some random
data including how to automate the process of generating a random password.
This way you'll be able to improve your script by requiring less input from the user.
And in my opinion the more you can automate the better.
I have a terminal open up in my local system and I'm going to move into the class folder.
We're going to continue working on the local user's system so I'll just change directory into their.
Now we'll start the virtual machine and log into it.
Now we can connect to it and move into the vagrant folder into the CD Ford slash vagrant.
Now I'm going to create a script called L user demo 5. sh.
Course we always start out our scripts of the shebang.
And then we're going to put a header to our file here just a short sentence or two about the goal for
this script.
And so what this script does is it generates a list of random passwords.
Now before we do any real coding let's look at the bash man page to see if it provides any way for us
to get some random data.
So let me see my changes here and we'll do man bash and we'll just look for random since random is an
all capital letters and by convention variables are in all capital letters I can probably assume that
random is a bash built in variable and it is and you can confirm that if you were to just go up the
main page here into the header and you will see that it is indeed in the variable section of the man
page and the scroll back down here and just read what this random variable is about.
It says each time this parameter is referenced a random integer between 0 and 32000 767 is generated.
So let's get back to the command line here by pressing Q to exit out of the man page and just echo a
random and see what happens.
Echo dollar random and there's around a number 43 8 let's see what happens if we access it again and
we get different numbers each time we echo the random variable to the screen here.
So that's a pretty simple way to get some random data.
Let's get back into our script here.
So the first password will generate will just be a random number as a password.
So we'll set the password variable equal to dollar random and then we'll just echo that to the screen.
See my changes and exit.
Of course this is the first time I'm going to be executing the scripts I'm going to set the permissions
on it.
Chaumont 755.
All user demo.
5. sh.
And then go ahead and execute it.
So if we keep executing it you can see we just get a different random number just because I'm lazy I'm
going to do something here that's a bit of a shortcut.
I'm going to do.
Exclamation mark vi to execute the most recent command that started with a V and this is called an event
designator and I go through this in my command line Kung Fu book.
But it's a quick way to execute a previous command that starts with the given string.
So instead of having to retype out the whole them space I'll use or Desch or five.
SH And I'm going to be executing this a lot.
Coming executing the script and then going back and editing and so on and so forth.
I'm just going to use this shortcut so if I do.
Exclamation mark VI or bang VI and hit enter will be back into editing our script.
So just using dollar sign random might be good enough especially if the user is forced to change their
password on log in.
And if you are concerned about security perhaps you would like a fairly long password.
So let's do something like use two or three random numbers all together.
So will reassign our password variable to random and just do this three times here.
And we'll display that password to the screen OK I'm going to execute dot forward slash.
I'll use the Dromo 5 and I'm to use my shortcut here.
Exclamation mark dot when you perform this shortcut it actually displays what it executes and then executes
it.
I'm just going to hit the up arrow since I'm already here.
So here you can see that we're getting some random data.
The first password is just one random number.
The second password that we're generating here are three random numbers together.
And as you can see there are varying lengths and whatever so this also could be good enough but we can
do something better.
If you think about it something that is always changing is time it's never the same time ever again.
It's now and then now was a second ago and now is also a second ago and so on.
So that is some data that is always changing so let's use the current date and time as the basis for
a password degenerate.
So let's go ahead and look at the date command and some of its options.
So obviously the date prints or sets the system date and time.
The synopsis here is date followed by optional option and the Lipsius there says that you can have multiple
options.
And then also in brackets which means it's optional is a format plus followed by some sort of format.
So let's check out the different formats that are available to us not just to afford for search with
a slash format and press enter it and to go to the next match and to go the next match and so on.
So here it says format controls the output and each one of these looks like they begin with a percent
sign.
For example percent lower case a is the abbreviated week day name percent upper case a is the full weekday
name and so on and so forth.
I want to point out percent sign yes on here and percent sign lowercase s is seconds since 1970 0 101
January 1st 1970 at 0 hours UTC.
This particular date is called the epoch.
And some people actually call this epic time or Unix time.
This Unix time and it's also called POSIX time by the way or epoch time is simply the number of seconds
that have elapsed since January 1st 1970 so I'm hit.
Q here to exit on the man page and let's just see what that looks like will the date plus that says
hey we're going to use a format we'll use percent sign s and hit enter.
And so that is the number of seconds since January 1st 1970 and we do it again and again.
So 14 seconds 15 seconds 18 19 20 21 and so on.
So this number just continually increments every single second.
So we could actually use this as a password.
Let's get back to editing our files here I'm going to use my shortcut bang the
so we'll set the password equal to 8.
And remember that the dollar sign opening parentheses and then a command followed by the closing parentheses.
That takes the output of that command within the parentheses and assigns it to the variable so the password
variable is going to contain the value of whatever that date command returns.
And then we'll just echo this to the screen.
Hey I'm going to execute the script again.
And here we can see that it you know in increments by one number each time one second each time we run
it or in this case a couple of seconds.
Because I've been talking for a couple of seconds.
In theory this password could be guessed.
For example the more you know about the password generation technique the easier the passwords are to
crack.
So if you know what day a password was generated on and you know that there are only eighty six thousand
four hundred seconds in a day that means there are only eighty six thousand four hundred possible passwords.
Now you can further infer some more information and guess that the password was probably generated during
normal business hours.
So that leaves about an eight hour window.
Now you're down to about 28 29 thousand possible passwords.
Now I'm getting a little bit off track here but you get the idea.
So let's find a way to make this even harder to guess.
Let's get back to the man page for date.
I don't know the last command that I executed that started within him was mandate so I can do.
Exclamation mark him and hit enter.
So I want to point out this nanoseconds format.
What do you use this format.
It prints the nanosecond that the date command was executed.
So there's about nine digits there.
So that leaves us a whole lot more data together.
So it'd be really hard to guess those nanoseconds because each time you run the day command I mean has
to be the exact to the nano second and that provides us a lot more variation.
So if we actually combine that with the epoch time then we can get a long number.
So let's do this let's run the data command will say we're going to use a format we want the second
since the epic.
And then we also want the nanosecond and we'll hit in here like this and press enter.
So now when we execute this maybe the first portion of the password that represents the percent sign
S is only incrementing by one digit.
But the last few digits they're pretty much look random because they're based on the nanoseconds of
when the date command was executed.
So let's go ahead and use this as a possible password.
Sign the date command to the password variable and then echo the password
let's execute the script a couple of times.
And so you can see that it looks fairly random.
So that's a better password than the just the second since epoch.
Let's take this one step further by using checksums or cryptographic hash functions.
A checksum is a numeric value computed for a block of data that is relatively unique.
Checksums were and are used to verify the integrity of data such as files.
For example if you download a file and you want to make sure that it's not corrupt in some way you find
the published checksums for the file and compare it to the file you downloaded.
Let's take sinto for example they publish Siobhan some's and shot 256 sums for their downloads.
By the way I didn't include the Cinto ISO that I'm about to use in the course download because it's
about 700 megabytes the time in this recording.
So if you want to follow along with this specific section you're going to have to download the ISOs
separately and then look at the check checksums published by Santos.
At the time you download the ISO file.
Anyway here are the contents of the Shaw one some text file published by Santos.
So for each file that they publish they produce a Shaw one some that corresponds to that file.
So the first file up there the Cinto 7 DVD 16:11 ISO corresponds to the CS 0 1 8 5 7 7 etc. shall want
some so we can use the Shaw one some command on our side to run the Shaw one mathematical algorithm
against this file to return its checksum or Shaw one some value.
So I've downloaded the minimal ISO so I'm going to run Shaw one some on the Scinto 7 minimal ISO here
and hit enter some more or less.
This number represents all the data in that single file.
If it matches what is published then you're virtually guaranteed that the data is exactly the same.
So in this case we have a known good copy of the Sentosa ISO because it Shaw won some matches the publisher
on won some.
I'll highlight that here.
Here's the show on some of our local file.
And here is the published Shaw one some provided by Sentosa that is supposed to correspond to that file.
And so as you can see it begins with 7:01 and ends with it for half an hour begins with 7:1 and also
ends with for f..
So we have the same file.
They also publish Shaugh 256.
So let's use the Shaw 256 some command against that ISO and hit enter.
OK it generated the shot 256 some for that file and we can compare it to what's published.
So let's look at the shot 256 some file that I downloaded from Cintas.
OK this checks out as well it should because the other some checked out but we're just experimenting
here so we have a 256 some that begins with 2007 and ends with 86 a.
And sure enough the minimal ISO corresponds begins with 27 and ends with eighty six.
A Let's change the file just ever so slightly and see if the some still match.
So I'm just going to add one character to the end of the file and one way to do that is to simply do
something like Echo a one to the end of this file and hit enter.
So now we've changed the file just a bit.
So I'm in the back up here and execute my shot 256 some command again and see what happens.
Now it doesn't match the sum we receive.
Begin with a and ends with a one here.
Obviously this is a big long string in the middle.
But if we compare that to the known good checksum it doesn't match.
So even a very slight change of data completely changes this check that's returned.
By the way there are other hash functions and check some program so we can do a quick ls and user Bensenville
the shoe LS Desch l user Ben for any programs that and in some will use a wildcard of asterisk and then
some and hit enter.
So you have S.K. some empty fivesome Shaw one some sha to 24 or so on.
So all these programs do pretty much the same thing.
They take a big chunk of data and reduce it down to a single number or a string that represents that
chunk of data to verify if it's the same or not.
OK now let's bring this back to password generation.
As you might have noticed the checksums are actually hexadecimal numbers with zero through nine representing
Well zero of 9 and a few f representing the values from 10 to 16.
If we were to use a Shaw 256 sum as a password for example that password would consist of 16 different
characters that 0 through 9 and a through f and B 64 characters and length.
That's a pretty darned good password.
So let's turn the current date and time into a shot 256 some by piping the output of the date command
as the input into the SHA 256 sum command.
So we'll just run the date command by itself date and we'll use the Epik here and now when I'm going
to do is use a pipe symbol which takes the output of the preceding command and sends it as a standard
input to the following command.
Sha to 56 and hit enter.
OK so that's the SHA 256.
Some of the output of the date command at the time it was executed.
So obviously when you execute this you're going to get a different value because when you're watching
this video it's going to be far past when I recorded it so obviously you're going to be getting different
data here.
So how does this work or why does this work so we were running Shaw 256 some against files.
Well let's look at the man Pedro a quick
so in the synopsis there we have an optional option as well as an optional file and it says with no
file or one file is a dash read standard input.
So remember with a pipe pipe turned to the output of the previous command as standard input and the
command that follows the pipe.
So that is how this works and by the way most commands will work like this.
If they take a file as an argument you can also not use the file and instead use standard input via
a pipe and it will operate on that input.
So I'll hit you to exile the man page here.
Since our goal here is to really generate a seemingly random set of characters as a password we really
don't care if the short summer Mayne's intact or not.
We're not going to be using that check sum to check it against another piece of data.
We just want its output.
So if we want to control the size of this generated password you'll need to control the number of characters
returned or displayed.
One way to do this is with the head command.
And just to briefly recap how can you tell if head is a program on the system or if it's a shell built
in.
Well of course you can use the type built in type dashi head.
Sure enough head is user bin head which is a program so he can't use help.
And what we have to do is use man head.
Just a quick reminder there.
So what head does is it outputs the first part of files or the head portion of a file without any option
it just prints the first 10 lines of a file.
You can also see this command like the shot 256 some command.
It says With no file or one file as a dash read standard input.
So we know we can use this head command in conjunction with the pipe the first option that's listed
there is dash C or dash dash bytes and the long form and what that does is print's the first k bytes
of each file.
So if we were to do dasht see one then it would just print the first character of the file.
The next option is Dasch in four lines and that prints the first number of lines that you specify instead
of the default first 10 lines.
So let's go ahead and try both of these options out.
So let's do head dash and one on Etsy password.
And what that does is print's the first line of ETSI password.
By the way you can also do this head dash in space one ETSI password.
So if you see either style if you see someone like me who take some shortcuts sometimes I'll probably
squish the value against its options so dash in one for example.
But if you see a dash in space 1 it's the same thing.
So if you see the one you know it's the same thing.
And by the way there's an old style of using this head command so let's do this head dash 1 ETSI password.
So instead of using a dash in followed by a number just use the dash followed up by the number.
So here's how to print the first two lines of that file head to the password and so on.
Obviously that's equivalent of head Desch into that C password or head dash in space to ETSI password.
OK let's just print the first character of the password file head Dasch see one ETSI password.
Let's print the first two characters had dash C to add c password.
So obviously the first line we can see it starts with the root the first character is are the first
two characters are are O.
Now I'm sure you remember from the main page how you can use standard input instead of a file with the
head command.
So let's try that out.
Let's generate some output from the echo command we'll just do echo testing and then we'll pipe that
output as the standard input into the head command.
And let's just print the first two characters dash C 2.
So sure enough it returns t e.
Now let's change the date command.
The shot 256 some command and the head command all together.
So you can have multiple pipes not just one pipe but you can keep modifying the output and keep piping
it in two different commands.
So we'll execute date second since the epoch will get the Shah to 56 some for that and we'll print the
first eight characters.
So if hit the up arrow key and do that again.
Again we keep getting a seemingly bit of random data here if we want to make this even better.
We can add those nano seconds to the mix so we can do date s in SHA use some head dash C-8 and we get
even more random data.
Now let's add this method to our script saw go back and edit the file
will say we'll create a better password.
So we'll use the date command was seconds and nanoseconds Shaw 56 some had Dessie and then we'll just
say specify 32 character length password here.
And will echo this password to the screen.
Got my opening quote there.
Let's exit to the command line and execute our script.
Hey so the password at the very bottom here the latest thing that we're echoing to the screen is that
32 character password.
And so each time we execute it we get a very different result.
So that looks like a pretty good password to me.
But we can even take this further.
Let's go back and edit or file again.
Let's create an even better password.
One way we can do this is just add some random numbers to the mix so we'll do date plus ASP plus in
and we'll follow that by a couple of random numbers here.
And then we'll pipe that into sha 2:56.
And then we're going to do is let's say we want to make this password.
Forty eight characters in length so we'll do Dessie forty eight and we'll echo that password to the
screen.
OK as you can see we got a 32 character password and then the forty eight character password here.
So just keep running that and we get lots of different passwords here that we could use.
Now there are other probably way more secure ways to generate a password that has nothing to do with
the current date.
But this is really honestly good enough especially if you're going to force a password change on log
in.
But while we're at it let's keep going and add a special character to the generated password file.
Now let's start out by displaying the set of special characters that we want to use.
And I'm actually going to store this into a variable right here in our interactive shell so I don't
have to keep typing these characters over and over again so I'm just going to use a simple name of capital
S.
Now again that's not a best practice for shell scripting but it's going to work for testing and it will
use a better more descriptive variable name for our script.
But here in the command line I'm just going to use the variable S and assigned it to the special characters.
Hey let's echo those characters.
OK.
Those are special characters.
Now we need a way to randomly extract just one special character from that list.
Now there is a command called shove S H U F.
Now let's see if it can do what we want.
So let's look at the man page for this command.
It says right a random permutation of the input lines to standard output.
So this appears to work on entire lines.
Now of course if you're unsure what a command does well just try it out.
So let's do that here let's run it against the password file for example and see what happens to go
the man page and we'll just do Schaaf at c password and let's do it a couple times to see if we can
figure out what it's doing here.
So sure enough it is definitely printing entire lines.
And if we just look for example at the last line here and FS nobody our PC user Einstein and so on that
this is definitely displaying random lines out of the ETSI password file.
So we need to break our list of single characters into individual lines so that we can then use Schaaf
to do the randomization.
So there happens to be a command called foaled that can do just this.
Let's look at the man page for foaled of the fold command wraps each input line to fit in a specified
width and it looks like there are some different ways to specify that width.
And by the way if we want to change our entire line of special characters into separate lines then we
simply need a width of one.
So if we look here Dasch be says it shows bytes that C counts characters rather than columns.
So w use width instead of 80.
So it looks like we have a couple of different options here a dash B C or dash w that we can use.
It's not really clear here and the man page what the difference is.
So what I like to do is experiment so I'm going to use each one of these options and see if I can spot
a difference between them so I'll just hit Q to get out of the man page and return to the command line.
So let's echo our string of characters here.
Echo.
Now let's see what fold.
There should be one does OK.
And lists are characters with the.
One looks like our last character here is equal sign but it looks like there's an empty line here.
OK.
Well let's see what Dasch see one does.
Same thing.
Let's look at Dasch w one.
OK so in my opinion it's easier to work with a dash w option because we don't have to account for that
blank line that's being generated.
So now let's pass this output into the shelf command.
So we'll do Ecko dollar s into fold and then we'll pass that to shop and we get a different order of
the characters.
Let's keep doing this couple of times here.
And sure enough each time we run it these characters are displayed in a different order.
Now we're getting a random list of special characters.
If we only want one special character we can use the hit command with a dash see option followed by
a one so let's see that head dash see one and sure enough we get a dollar sign that time we execute
it.
It's time we get a closing parentheses a pound sign closing parentheses the carrot symbol pound sign.
So this appears to be working doing what we really want which is to get a random special character.
Now I hope you noticed a pattern in how I worked through this little mini challenge here.
First I had a goal in mind.
I knew I wanted a random single special character.
Next I simply displayed what I had in this case.
I use the echo command to display the special characters.
Now if I was working on another problem perhaps I would display the contents of a file or something
else.
Next I change the output so that I could work with it easier.
The way you can change the output is by using that output as the input of another command.
So I pipe the output of the echo command into the fold command and I kept doing this until I reached
my goal.
Taking the output piping it in as the input to another command and keep repeating that.
So it's important to keep in mind that Unix and Linux philosophy that each program should only do one
thing and that it should do it very well.
So in our case the echo command only displays output.
It doesn't do any sorting it doesn't do any randomization and so on.
It does it's one job and it does it really well when you need another job done you'll need to use another
command.
That's why we use pipes so we can string together all the specialized commands to make the system do
exactly what we want.
Some people call this data lungeing or string manipulation and so on.
At any rate I go over a lot of these techniques in my command line Kung Fu book and it's filled with
examples of small specialized commands all piled together to do something unique and useful.
Anyway before I get too carried away about how awesome Linux is and the philosophy and so on let's go
ahead and add this last way to generate a password to our script.
We're just going to append a special character to the password so we'll do a special character variable
name which is a lot better than just dollar sign.
S We're going to echo our string of special characters.
Type that into fold with the width of one column Schaaf to randomize those lines and then we're just
going to extract one character from that the first character and now we're going to echo that password
that we generated previously and we're going to append this special character to it.
Hey let's save our changes and execute our script.
Hey so you can see that this forty eight character password was generated and then we just displayed
that in addition to a random special character.
So each time we do this we'll get a different password that now includes a special character so we have
a great password.
In my opinion that you can use especially if it's just a one time password so to quickly recap in this
lesson you were introduced to the built in variable of random which generates a random integer each
time that it's referenced.
You also worked with a date command and used its formatting options to control its output.
From there we talked about checksums and specifically looked at the Shaw one PS. and Shaw 256 some commands.
You also learned about the head command which can display the top or beginning lines or characters of
a file.
Next to use the full command to transform a single line of text into multiple lines.
Finally you use the shut command to randomly select a line.