Hi there

I would like my backup script to automatically encrypt my files that are sent to an external host via scp.
So in the script, just before scp is called, i would like to pass an encryption command..

I know a couple encryption tools, like gpg and bcrypt, but they require a user input for the passphrase...

Is it a possible thing to do?

Cheers,

several options.. using keys with gpg being one of them..

http://sleepyhead.de/howto/?href=crypt

documented under 'man enc'

be sure to protect your backup script!

Also note that if you pass a password to openssl on the command line like that, anyone who runs 'ps' on the system while openssl is running will see the password!

I agree and I would like to emphasise that encryption is worthless when the passphrase can be read from disk or memory.

I've been called out! I guess I'm too used to running on single user systems...

"worthless" is a bit extreme. SSL, GPG, IPSec, SSH etc all use encryption keys read from disk, and they are hardly "worthless".

The right approach is to just be careful about when keys might be exposed and mitigate against those cases.

Sure, but that's a different context. In this context (which is the same as people wanting to use LUKS or run an obfuscated binary combined with automagically providing the passphrase) it almost always is. It's not the encryption method that's the problem here, but the way it's misused. I mean, if this practice would have been secure (channel, sender or message integrity) AND convenient it would already have been provided for, wouldn't it?..


I agree, though depending on what the recipient expects the integrity/security to be I wonder the user knows what is then expected from him...