Greetings,

SunOS 5.8.

If I need to decrypt files using the pgpv command in a Perl script which
is run as a crontab job,  how should I provide the passphrase that's
read from a file located in a secure place automatically?

Thanks in advance for any ideas.

Bing

In article <3F09F434.4476ABC8@tamu.edu>,
 Bing Du Test <bing-du@tamu.edu> wrote:

> SunOS 5.8.
> 
> If I need to decrypt files using the pgpv command in a Perl script which
> is run as a crontab job,  how should I provide the passphrase that's
> read from a file located in a secure place automatically?

Embedding passwords in files, even if the permissions restrict access, 
is considered less secure.  Sometimes there's no other way around this 
without implementing something much more complicated.  If the passphrase 
is already encrypted, this would be easier.

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...

Thanks Michael.  I'm interested in 'implementing something much more
complicated' you indicated in your message.  Would you be more specific about
what it could be?

I think what I originally asked was how to enter password or passphrase in
script rather than being prompted interactively?

Bing

"Michael Vilain " wrote:

> In article <3F09F434.4476ABC8@tamu.edu>,
>  Bing Du Test <bing-du@tamu.edu> wrote:
>
> > SunOS 5.8.
> >
> > If I need to decrypt files using the pgpv command in a Perl script which
> > is run as a crontab job,  how should I provide the passphrase that's
> > read from a file located in a secure place automatically?
>
> Embedding passwords in files, even if the permissions restrict access,
> is considered less secure.  Sometimes there's no other way around this
> without implementing something much more complicated.  If the passphrase
> is already encrypted, this would be easier.
>
> --
> DeeDee, don't press that button!  DeeDee!  NO!  Dee...

In article <3F0AD55C.37EAB6D5@tamu.edu>,
 Bing Du Test <bing-du@tamu.edu> wrote:

> Thanks Michael.  I'm interested in 'implementing something much more
> complicated' you indicated in your message.  Would you be more specific about
> what it could be?
> 
> I think what I originally asked was how to enter password or passphrase in
> script rather than being prompted interactively?
> 
> Bing
> 
> "Michael Vilain " wrote:
> 
> > In article <3F09F434.4476ABC8@tamu.edu>,
> >  Bing Du Test <bing-du@tamu.edu> wrote:
> >
> > > SunOS 5.8.
> > >
> > > If I need to decrypt files using the pgpv command in a Perl script which
> > > is run as a crontab job,  how should I provide the passphrase that's
> > > read from a file located in a secure place automatically?
> >
> > Embedding passwords in files, even if the permissions restrict access,
> > is considered less secure.  Sometimes there's no other way around this
> > without implementing something much more complicated.  If the passphrase
> > is already encrypted, this would be easier.

Just a SWAG, but why not investigate other encryption methods like 
kerberos or setup a public/private key server and use those.  It's not a 
trival problem and this about streches the limit of my knowledge.

Bottom line: someone has to know a password/phrase that must be entered 
somewhere--either via terminal or file.  Unless there's some other way 
to do it, I think you're SOL.

-- 
DeeDee, don't press that button!  DeeDee!  NO!  Dee...

Philip Brown <phil+s3@bolthole.no-bots.com> wrote:
>   On Mon, 07 Jul 2003 17:29:08 -0500, bing-du@tamu.edu wrote:
>  >Greetings,
>  >
>  >SunOS 5.8.
>  >
>  >If I need to decrypt files using the pgpv command in a Perl script which
>  >is run as a crontab job,  how should I provide the passphrase that's
>  >read from a file located in a secure place automatically?
>   
>   If your passphrase is going to be dependant on the security of the
>   filesystem, then essentially, your private key is then dependant on the
>   security of the filesystem. In which case, you may as well not HAVE a
>   passphrase, and just rely on the security of the filesystem :->

Hmmm, with a file to read through processes...you can't
even hold the passphrase in a process to be an advantage
over holding it in a file anymore.

That was sort of the idea behind Tcl creator John Ousterhout's
technique of having a background 'expect' job that authorized
processes could pseudo-connect to to get the passphrase.

(Enter the passphrase after any reboot.)