Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So it's not the most secure practice to pass a password in through a command line argument. That said, the documentation for openssl confused me on how to pass a password argument to the openssl command.

Here's what I'm trying to do

openssl aes-256-cbc -in some_file.enc -out some_file.unenc -d

This then prompts for the pass key for decryption. I searched the openssl documents and the interwebs to try and find the answer if I simply wanted to give the password to the command without trying to echo the password to the file. I tried adding -pass:somepassword and -pass somepassword both with and without quotes to no avail.

I finally figured out the answer and saw in some other forums people had similar questions, so I thought I would post my question and answer here for the community.

note: I'm using openssl version 0.9.8y

share|improve this question

1 Answer 1

up vote 9 down vote accepted

The documentation wasn't very clear to me, but it had the answer, the challenge was not being able to see an example.

Here's how to do it:

openssl aes-256-cbc -in some_file.enc -out some_file.unenc -d -pass pass:somepassword

Notice that the command line command syntax is always -pass followed by a space and then the type of passphrase you're providing, i.e. pass: for plain passphrase and then the actual passphrase after the colon with no space.

Additionally the documentation specifies you can provide other passphrase sources by doing the following:

  • env:somevar to get the password from an environment variable
  • file:somepathname to get the password from the first line of the file at location pathname
  • fd:number to get the password from the file descriptor number.
  • stdin to read from standard input

Now that I've written this question and answer, it all seems obvious. But it certainly took some time to figure out and I'd seen it take others similar time, so hopefully this can cut down that time and answer faster for others! :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.