密码文件混淆
我正在使用 lua 来管理防火墙服务器，并希望混淆敏感变量，例如登录数据。我尝试过 luac 但变量内容仍然很容易读取。有什么方法可以加密/解密这些敏感数据吗？
I am using lua to administrate a firewall server and want to obfuscate sensible variables such as login data. I have tried luac but the variable content is still easily readable. Is there any way to encrypt/decrypt these sensible data?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我假设您有一个 lua 脚本，其中包含要发送的命令以及任何“秘密数据”，并且您希望能够运行该脚本而无需交互式地输入任何内容。
如果是这样，脚本本身必须能够解密您的秘密数据才能使用它 - 如果攻击者可以读取脚本，他可以执行相同的步骤来解密您的数据（或在调试器或类似程序中运行它）。因此，不可能真正隐藏脚本中的秘密数据。使用您的系统文件权限确保除了您和执行该脚本的进程之外没有人可以读取该脚本。
也就是说，如果您不想阻止真正的攻击者，而只想避免随意查看密码的人，任何编码方案都可以 - 从简单的 Rot13 over Base64 到十六进制编码。但您应该意识到这不是一种安全措施。
I'm assuming you have a lua script which contains both the commands to send as well as any "secret data", and you want to be able to run this script without having to type in anything interactively.
If so, the script itself must be able to decrypt your secret data in order to use it - and if an attacker can read the script, he can do the same steps to decrypt your data (or run it in a debugger or similar). Thus, it is impossible to really hide the secret data in your script. Use your systems file permissions to ensure nobody but you and the process that executes it can read the script.
That said, if you do not want to hinder real attackers, but only want to avoid casual lookers reading the password, any encoding scheme will do - from simple Rot13 over Base64 to hex-encoding. But you should be conscious that this is not a security measure.
如果您被允许使用编译库（即 LuaRocks），您可以使用 Kepler MD5 库加密/解密数据 - 如果您可以让脚本提示输入密码，您甚至可以使其（相当）安全。 （如果您无法提示输入密码，正如 Paulo 所说，混淆是您所能期望的最好方法。）
If you're allowed to use compiled libraries (ie. LuaRocks), you can use the Kepler MD5 library to encrypt/decrypt the data- and if you can have the script prompt for a password, you can even make it (reasonably) secure. (If you can't prompt for a password, as Paulo says, obfuscation is the best you can hope for.)