Securely passing password to openssl via stdin

user_288444 0
Viewed 39113

We know we can encrypt a file with openssl using this command:

openssl aes-256-cbc -a -salt -in twitterpost.txt -out foo.enc -pass stdin

The password will be read from stdin. As such, to provide the password beforehand, all we need do is prepend

echo "someGoodPassword" |

to the above command. My question is: How can I do this more securely? The above method doesn't look secure enough.

I'd appreciate some comments about this so I can understand this issue better.

openssl ssl unix security
4 Answers

You can use several methods for pass through the password: https://www.openssl.org/docs/man1.0.2/apps/openssl.html#PASS-PHRASE-ARGUMENTS

As @Petesh said, the root can read everything!

Therefore, if you write down the password into any common(!) file, e.g.

  • into a temporary file with any safe permission
  • or into the script what does do your echo trick into a pipe

the root user could find this!

Don't prefer to use everything what available via /proc (e.g. by the ps)

So, do not use...

openssl aes-256-cbc ... -passin 'pass:someGoodPassword'

or

PASSWORD='someGoodPassword'
openssl aes-256-cbc ... -passin 'env:PASSWORD'`

The best solution

  • Avoid storing passwords in plain text on your system (e.g. use password manager)

  • Pass through passwords to openssl via pipe/fifo:

    password_manager get_password | openssl aes-256-cbc ... -passin 'stdin'

    or

    # https://stackoverflow.com/a/7082184/1108919
password_manager get_password >&3
openssl aes-256-cbc ... -passin 'fd:3'

    or 

    openssl aes-256-cbc ... -passin "file:<(password_manager get_password)"
user_11089190
Related