This is a part of my script

sudo bash -c "printf '%s\n' \
'user-test:' \
'  hash: \"$HASHED_PASSWORD\"' \
'  reserved: true' \
'  backend_roles:' \
'    - \"admin\"' \
'  description: \"admin user\"' >> /etc/opensearch/opensearch security/internal_users.yml"

‍‍$HASHED_PASSWORD‍‍‍ is generated using usr/share/opensearch/plugins/opensearch-security/tools/hash.sh

It generates it in this format $2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK

I want this exact value to be written in the /etc/opensearch/opensearch security/internal_users.yml file but it is unable to do so, as $2, $12, $M is treated as a variable.

This is how it actually writes.

user-test:
  hash: "y2/PO6SqvPjuXzJaCK"
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"

This is a part of my script

sudo bash -c "printf '%s\n' \
'user-test:' \
'  hash: \"$HASHED_PASSWORD\"' \
'  reserved: true' \
'  backend_roles:' \
'    - \"admin\"' \
'  description: \"admin user\"' >> /etc/opensearch/opensearch security/internal_users.yml"

‍‍$HASHED_PASSWORD‍‍‍ is generated using usr/share/opensearch/plugins/opensearch-security/tools/hash.sh

It generates it in this format $2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK

I want this exact value to be written in the /etc/opensearch/opensearch security/internal_users.yml file but it is unable to do so, as $2, $12, $M is treated as a variable.

This is how it actually writes.

user-test:
  hash: "y2/PO6SqvPjuXzJaCK"
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"

• bash

• Can you print $HASHED_PASSWORD using echo $HASHED_PASSWORD and share value? – Alireza Commented Feb 4 at 12:33
• 2 Your code works fine for me as-is (but without sudo as my system doesn't have that). Please make sure the code you post does reproduce the problem you need help with. If you can reproduce the problem without sudo and/or >> /etc/opensearch/opensearch security/internal_users.yml and/or just starting with HASHED_PASSWORD='$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK' then show THAT instead of including more unnecessary detail - make it a minimal reproducible example, emphasis on minimal. – Ed Morton Commented Feb 4 at 13:39
• $HASHED_PASSWORD is between single quotes and therefore not expanded. – user1934428 Commented Feb 5 at 9:15

2 Answers 2

This is all about quoting.

I made a local file to test it.

$: cat tst
#! /usr/bin/env bash
set -x
bash -c "printf '%s\n' '
user-test:
  hash: \"${1:-${HASHED_PASSWORD:?Password Not Set}}\" # arg 1st, env 2nd, else bail
  reserved: true
  backend_roles:
    - \"admin\"
  description: \"admin user\"
'"

If the password data isn't exported in the environment OR passed in, it fails.

$: ./tst
./tst: line 3: HASHED_PASSWORD: Password Not Set

Pass it in -

$: ./tst "$tmp"
+ bash -c 'printf '\''%s\n'\'' '\''
user-test:
  hash: "$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK" # arg 1st, env 2nd, else bail
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"
'\'''

user-test:
  hash: "$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK" # arg 1st, env 2nd, else bail
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"

(Yes, I added an explanatory comment that ends up in the yaml, but it's also a yaml comment.)

You can set the value inline -

$: HASHED_PASSWORD='$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK' ./tst
+ bash -c 'printf '\''%s\n'\'' '\''
user-test:
  hash: "$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK" # arg 1st, env 2nd, else bail
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"
'\'''

user-test:
  hash: "$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK" # arg 1st, env 2nd, else bail
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"

Or export it -

$: export HASHED_PASSWORD='$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK'
$: ./tst
+ bash -c 'printf '\''%s\n'\'' '\''
user-test:
  hash: "$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK" # arg 1st, env 2nd, else bail
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"
'\'''

user-test:
  hash: "$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK" # arg 1st, env 2nd, else bail
  reserved: true
  backend_roles:
    - "admin"
  description: "admin user"

I put the whole yaml string in one outer set of single-quotes with your newlines embedded to simplify a bit. The command using it is in double-quotes so that the single-quotes are just data in the string, and it's double-quote interpolated, so the var value goes in as data and doesn't get re-interpolated. All that gets passed to the bash -c, so it works.

YMMV.

It's probably best to pass it as an argument to your bash script, rather than interpolating it directly:

HASH='$2y$12$M44wSxuwYbYRUqRKf1IUAuY5jvBlh4tu5XVx7/PO6SqvPjuXzJaCK'
bash -c 'printf %s\\n "$1"' script "$HASH"