6

In Linux, I am using 7z to decrypt a *.7z encrypted file. Is there a way to pass in the password via pipe or any other method that can be automated?

I tried echo password | 7z x archive.7z but still prompted me for password.

7

7z How to pass password and avoid prompt?

Is there a way to pass in the password via pipe or any other method that can be automated?

Try running the extraction commands with a similar syntax as in the below example to see if it'll work for your need setting the password variable accordingly beforehand passing it in or however you'd normally do that with the logic you use in your scripts, etc.

Be sure the password or variable value for it is directly after the -p switch with no spaces after -p.

Implicit Path Extraction with Password Variable

password="<password>"; 7z.exe x -p$password "archive.7z"

Explicit Path Extraction with Password Variable

password="<password>"; 7z.exe -e -p$password "<ArchivePath>\archive.7z" -o"<ExtractPath>"

7Z Help Source

7z.exe --help

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21

Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...]
       [<@listfiles...>]

<Commands>
  a : Add files to archive
  b : Benchmark
  d : Delete files from archive
  e : Extract files from archive (without using directory names)
  h : Calculate hash values for files
  i : Show information about supported formats
  l : List contents of archive
  rn : Rename files in archive
  t : Test integrity of archive
  u : Update files to archive
  x : eXtract files with full paths

<Switches>
  -- : Stop switches parsing
  -ai[r[-|0]]{@listfile|!wildcard} : Include archives
  -ax[r[-|0]]{@listfile|!wildcard} : eXclude archives
  -ao{a|s|t|u} : set Overwrite mode
  -an : disable archive_name field
  -bb[0-3] : set output log level
  -bd : disable progress indicator
  -bs{o|e|p}{0|1|2} : set output stream for output/error/progress line
  -bt : show execution time statistics
  -i[r[-|0]]{@listfile|!wildcard} : Include filenames
  -m{Parameters} : set compression Method
    -mmt[N] : set number of CPU threads
  -o{Directory} : set Output directory
  -p{Password} : set Password
  -r[-|0] : Recurse subdirectories
  -sa{a|e|s} : set Archive name mode
  -scc{UTF-8|WIN|DOS} : set charset for for console input/output
  -scs{UTF-8|UTF-16LE|UTF-16BE|WIN|DOS|{id}} : set charset for list files
  -scrc[CRC32|CRC64|SHA1|SHA256|*] : set hash function for x, e, h commands
  -sdel : delete files after compression
  -seml[.] : send archive by email
  -sfx[{name}] : Create SFX archive
  -si[{name}] : read data from stdin
  -slp : set Large Pages mode
  -slt : show technical information for l (List) command
  -snh : store hard links as links
  -snl : store symbolic links as links
  -sni : store NT security information
  -sns[-] : store NTFS alternate streams
  -so : write data to stdout
  -spd : disable wildcard matching for file names
  -spe : eliminate duplication of root folder for extract command
  -spf : use fully qualified file paths
  -ssc[-] : set sensitive case mode
  -ssw : compress shared files
  -stl : set archive timestamp from the most recently modified file
  -stm{HexMask} : set CPU thread affinity mask (hexadecimal number)
  -stx{Type} : exclude archive type
  -t{Type} : Set type of archive
  -u[-][p#][q#][r#][x#][y#][z#][!newArchiveName] : Update options
  -v{Size}[b|k|m|g] : Create volumes
  -w[{path}] : assign Work directory. Empty path means a temporary directory
  -x[r[-|0]]{@listfile|!wildcard} : eXclude filenames
  -y : assume Yes on all queries
  • Thanks. I was confused because -p said set password so I thought is only for archiving. – drum Jun 30 '16 at 18:51
  • Process scans will reveal that password. Could ENV variables be used instead? – Chris Oct 17 '17 at 15:11
  • @Chris See if specifying a variable to be set as the first argument passed would work. This way you could just pass in the password at run/execution time per your manual run or scheduled job, and the password would not be embedded within any script logic. So for example with batch script you could set password=%~1 or bash password=$1 for example. – Pimp Juice IT Oct 17 '17 at 15:17
  • Still dangerous. A ps scan will bring me all the password to others – Chris Oct 17 '17 at 15:18
  • @Chris On what type of machine you have this setup on exactly? Schedule the processes from machines that end-users do have have access to then I suppose. If you set the value of a password as an environmental variable, then looking at the logic of a script will expose that's the method and then that could be searched so ENV variable is just as insecure with regard to physical access to a machine it's hosted on and running some type of security scan. – Pimp Juice IT Oct 17 '17 at 15:22
0

The -p option is somewhat more secure than you'd expect. When 7zip first runs, if it detects the -p option, it will copy that value somewhere else, and it will overwrite the value that is visible in the process tree. So if you did "ps -aux", you might see "/usr/bin/7za -p******* x arch.7z" instead of the actual password after -p. At least this is the way it works on Linux- and you can configure the kernel such that process trees are invisible to normal users.

  • Clearing the password is a good idea, but it still leaves a small window when the password is visible. – RalfFriedl Sep 17 '18 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.