1

This is a question about gpg. When I log into a linux system as a particular user ("opsacc"), I can encrypt a file using gpg. I can then decrypt the file without supplying a passphrase. The gpg public/private keys for this user were not created by me. The problem is I would like to replicate this scenario when logged in as a different account, but cannot do so because I always need to supply the passphrase. Ie, when logged in as another user I would like to set up gpg so that I can encrypt files and then decrypt them without supplying the passphrase. The gpg manual and other research seems to suggest this is not possible.

Can anybody suggest how to encrypt a file so that it can be decrypted (by the same user only) without supplying a passphrase? Or rather how to set up the necessary key pairs to enable this scenario?

In my case, the user who originally set up the key pairs for the account "opsacc" appears to have generated more that one public/private key pair. I'm not sure if this is necessary for decrypting the file without supplying the passphrase. It's possible the file was created on another linux system on which a similarly named account existed. Also possible is that one of the key pairs was created on another system and exported/imported here.

For further info see the output below from the command line:

I logged onto "server" as user "opsacc", and using gpg version 1.4.5:

[opsacc@server1 ~]$ gpg --version
gpg (GnuPG) 1.4.5
Copyright (C) 2006 Free Software Foundation, Inc.
This program comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions. See the file COPYING for details.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA
Cipher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
[opsacc@server1 ~]$

I created an encrypted file from stdin at the command line using gpg:

[opsacc@server1 ~]$ gpg -o .SecretFile.gpg -r opsacc -e
my_secret_word
[opsacc@server1 ~]$
[opsacc@server1 ~]$ ls -l .SecretFile.gpg
-rw-rw-r-- 1 opsacc opsacc 595 Mar  6 11:50 .SecretFile.gpg
[opsacc@server1 ~]$
[opsacc@server1 ~]$ file .SecretFile.gpg
.SecretFile.gpg: GPG encrypted data
[opsacc@server1 ~]$ 

I can then decrypt the file without supplying the passphrase:

[opsacc@server1 ~]$ gpg --decrypt --no-secmem-warning -q $HOME/.SecretFile.gpg
my_secret_word
[opsacc@server1 ~]$

Here are details of the public/private keys:

[opsacc@server1 ~]$ gpg -k
/opt/home/opsacc/.gnupg/pubring.gpg
----------------------------------
pub   1024D/3B50F829 2009-03-25
uid                  opsacc <[email protected]>
sub   2048g/63B0BE4D 2009-03-25

pub   1024D/82406185 2009-03-25
uid                  opsacc <[email protected]>
sub   2048g/766F847E 2009-03-25

[opsacc@server1 ~]$ 
[opsacc@server1 ~]$ gpg -K
/opt/home/opsacc/.gnupg/secring.gpg
----------------------------------
sec   1024D/3B50F829 2009-03-25
uid                  opsacc <[email protected]>
ssb   2048g/63B0BE4D 2009-03-25

sec   1024D/82406185 2009-03-25
uid                  opsacc <[email protected]>
ssb   2048g/766F847E 2009-03-25

[opsacc@server1 ~]$ 

I only want the user to decrypt files he encrypted. I didn't realize that the private key could be created without a passphrase. That's obviously what has happened in the scenario I described above.
Therefore when the opsacc user decrypts a file that he previously encrypted, no passphrase need be entered. I have replicated this scenario for another user. I am using this method to protect files on a multi-user system. Ie, when encrypted in this way, the files can only be decrypted by the owner, and without supplying a passphrase (very convenient when the files need to be read by an automated script), and other users on the system cannot decrypt the file. However I am wondering what the main security risks are in this scenario - what would a hacker need to do to gain access to opsacc's encrypted file and decrypt it?

1 Answer 1

1

By default, each system user has his own home directory and thus own GnuPG home directory. In each GnuPG home directory, you can store an individual replica of a secret key.

If no passphrase is required, it seems the key is not encrypted with one. Export the key (gpg --export-secret-keys [key-id], and import it for the other user (to his own GnuPG home directory, gpg --import) who should have to enter a passphrase. Now edit the key (gpg --edit-key [key-id]) and add a passphrase (passwd inside the GnuPG edit shell).

The other user will have to enter the passphrase to access his copy of the key. As he has no privileges to access opsacc's unencrypted version without a passphrase, he will not be able to decrypt files without the passphrase.

But be aware, once he has the passphrase, he can of course easily remove it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .