hide Kerberos passwords from process list

use open3 instead of .target.bash_output when setting passwords