LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-10-2020, 11:52 AM   #1
vinmansbrew
Member
 
Registered: Feb 2016
Posts: 102

Rep: Reputation: Disabled
gpg passphrase automation


I am looking to try and automate a gpg decryption, the problem I run into is when it asks for a passphrase. I am having trouble finding a variable to allow the passphrase to run with the command.

I am aware of the security concerns, of having a clear text password. Ideally, I'd like to have a script file that is limited to only the user that would run it. Which would be the same user that is doing the decryption.

I've tried a couple commands:
gpg -d "file-name" --passphrase="phrase" , --passphrase "phrase" , --passphrase-file "file with passphrase in it"
And a couple other variations.
 
Old 08-10-2020, 01:01 PM   #2
pan64
LQ Guru
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 15,081

Rep: Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957Reputation: 4957
you ought to read the man page of gpg. There is an option: --passphrase-file (for example)
Quote:
Read the passphrase from file file. Only the first line will be read from file file. This can only be used if only one passphrase is supplied. Obviously, a passphrase stored in a file
is of questionable security if other users can read this file. Don't use this option if you can avoid it. Note that this passphrase is only used if the option --batch has also been given.

Last edited by pan64; 08-10-2020 at 01:04 PM.
 
Old 08-11-2020, 03:06 PM   #3
vinmansbrew
Member
 
Registered: Feb 2016
Posts: 102

Original Poster
Rep: Reputation: Disabled
The only option listed that I find is passphrase-fd, which doesn't seem to help.
 
Old 08-11-2020, 03:57 PM   #4
shruggy
Senior Member
 
Registered: Mar 2020
Posts: 1,161

Rep: Reputation: Disabled
Quote:
Originally Posted by vinmansbrew View Post
I've tried a couple commands:
gpg -d "file-name" --passphrase="phrase" , --passphrase "phrase" , --passphrase-file "file with passphrase in it"
From the manpage:
Quote:
Note that since Version 2.0 this passphrase is only used if the option --batch has also been given. Since Version 2.1 the --pinentry-mode also needs to be set to loopback.
The same paragraph in version 2.0.x reads
Quote:
Note that this passphrase is only used if the option --batch has also been given. This is different from gpg.
 
Old 08-12-2020, 09:47 AM   #5
vinmansbrew
Member
 
Registered: Feb 2016
Posts: 102

Original Poster
Rep: Reputation: Disabled
I'll have to check those out. The manpage I found didn't have any of that.
 
Old 08-25-2020, 11:34 AM   #6
vinmansbrew
Member
 
Registered: Feb 2016
Posts: 102

Original Poster
Rep: Reputation: Disabled
Well, I found how to do almost everything. I can get the file to output where I want, and use a passphrase, though it is clear text. I should be able to make a cron that calls the script which I should be able to secure.
gpg -d --output "output directory" --batch --passphrase "passphrase" "file name"

It's a start.

Now, I have been trying to see how I add other users that are allowed to use the gpg key. I made the key as root, and root can use it. But I'd like another user to be able to do it, as well.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
gpg / gpg-agent -- Can't connect to /root/.gnupg/S.gpg-agent jrtayloriv Linux - Security 9 06-03-2019 10:06 AM
file descriptors in Perl-----I need to use gpg's "--passphrase-fd n" option Rain Duck Programming 5 02-25-2011 09:52 AM
GPG: Bad session key gpg between gpg on linux and gpg gui on windows XP konqi Linux - Software 1 07-21-2009 09:37 AM
Revoking GPG key with only passphrase and public key djib Linux - Security 2 03-13-2007 03:20 AM
KMail and PGP/GPG not working - doesn't ask for passphrase steve1401 Linux - General 2 02-08-2005 06:42 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:00 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration