代理设置：如何提升代理密码的安全性？

Great question—storing plaintext passwords directly in .bashrc or similar config files is a major security risk, so it’s really proactive of you to seek better alternatives. Below are several reliable methods to handle proxy auth securely:

1. Use a System Keyring (Most Secure) #

Nearly all Linux desktop environments include an encrypted keyring manager (like GNOME Keyring, KWallet, or libsecret) that safely stores sensitive credentials. You can use command-line tools to fetch your proxy password from the keyring at runtime instead of hardcoding it.

Here’s how to do it with secret-tool (part of the libsecret package):

• First, store your proxy password in the keyring (you’ll be prompted to enter the password):

  secret-tool store --label="Work Proxy Credentials" service proxy account your_work_username
  

• Then, add this snippet to your .bashrc to load the proxy variables dynamically:

  # Load proxy credentials from system keyring
  PROXY_USER="your_work_username"
  PROXY_PASS=$(secret-tool lookup service proxy account $PROXY_USER)
  export http_proxy="http://$PROXY_USER:$PROXY_PASS@proxy.yourcompany.com:8080"
  export https_proxy=$http_proxy
  export no_proxy="localhost,127.0.0.1,*.yourcompany.com"
  

The password stays encrypted in your keyring and is only retrieved when you open a shell—no plaintext ever hits your config files.

2. Restricted Permissions Script (Simpler Alternative) #

If you don’t want to use a keyring, you can isolate the proxy config in a separate file with strict permissions to limit access to only your user account.

Steps:

• Create a dedicated script (e.g., ~/.secure_proxy_setup.sh) with your proxy export line:

  export http_proxy="http://your_work_username:your_password@proxy.yourcompany.com:8080"
  export https_proxy=$http_proxy
  

• Lock down the file so no other users can read or execute it:

  chmod 700 ~/.secure_proxy_setup.sh
  

• Add a line to your .bashrc to source this script when you open a shell:

  source ~/.secure_proxy_setup.sh
  

While this still uses plaintext, the strict permissions mean only you can access the password—far safer than having it in .bashrc (which may be readable by other users on shared systems).

3. Prompt for Password on Shell Startup #

If you don’t mind entering your password each time you open a shell, you can skip storing it entirely and use a prompt:
Add this to your .bashrc:

read -s -p "Enter proxy password: " PROXY_PASS
echo
export http_proxy="http://your_work_username:$PROXY_PASS@proxy.yourcompany.com:8080"
export https_proxy=$http_proxy
unset PROXY_PASS  # Clear the password from memory after setting

The -s flag hides your input while typing, and unset PROXY_PASS removes the password from your shell’s memory once the proxy is configured.

Important Notes #

• Always avoid typing commands with plaintext passwords directly into the terminal—they’ll get saved in your bash history. If you must, prefix the command with a space (make sure HISTCONTROL=ignorespace is set in your .bashrc to skip saving those commands).
• For tools like Git or Docker, you can configure their own credential helpers instead of relying on global proxy variables, which adds another layer of security.

内容的提问来源于stack exchange，提问作者Yves