13

In Linux, I am using 7z to decrypt a *.7z encrypted file. Is there a way to pass in the password via pipe or any other method that can be automated?

I tried echo password | 7z x archive.7z but still prompted me for password.

3 Answers 3

12

7z How to pass password and avoid prompt?

Is there a way to pass in the password via pipe or any other method that can be automated?

Try running the extraction commands with a similar syntax as in the below example to see if it'll work for your need setting the password variable accordingly beforehand passing it in or however you'd normally do that with the logic you use in your scripts, etc.

Be sure the password or variable value for it is directly after the -p switch with no spaces after -p.

Implicit Path Extraction with Password Variable

password="<password>"; 7z.exe x -p$password "archive.7z"

Explicit Path Extraction with Password Variable

password="<password>"; 7z.exe -e -p$password "<ArchivePath>\archive.7z" -o"<ExtractPath>"

7Z Help Source

7z.exe --help

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21

Usage: 7z <command> [<switches>...] <archive_name> [<file_names>...]
       [<@listfiles...>]

<Commands>
  a : Add files to archive
  b : Benchmark
  d : Delete files from archive
  e : Extract files from archive (without using directory names)
  h : Calculate hash values for files
  i : Show information about supported formats
  l : List contents of archive
  rn : Rename files in archive
  t : Test integrity of archive
  u : Update files to archive
  x : eXtract files with full paths

<Switches>
  -- : Stop switches parsing
  -ai[r[-|0]]{@listfile|!wildcard} : Include archives
  -ax[r[-|0]]{@listfile|!wildcard} : eXclude archives
  -ao{a|s|t|u} : set Overwrite mode
  -an : disable archive_name field
  -bb[0-3] : set output log level
  -bd : disable progress indicator
  -bs{o|e|p}{0|1|2} : set output stream for output/error/progress line
  -bt : show execution time statistics
  -i[r[-|0]]{@listfile|!wildcard} : Include filenames
  -m{Parameters} : set compression Method
    -mmt[N] : set number of CPU threads
  -o{Directory} : set Output directory
  -p{Password} : set Password
  -r[-|0] : Recurse subdirectories
  -sa{a|e|s} : set Archive name mode
  -scc{UTF-8|WIN|DOS} : set charset for for console input/output
  -scs{UTF-8|UTF-16LE|UTF-16BE|WIN|DOS|{id}} : set charset for list files
  -scrc[CRC32|CRC64|SHA1|SHA256|*] : set hash function for x, e, h commands
  -sdel : delete files after compression
  -seml[.] : send archive by email
  -sfx[{name}] : Create SFX archive
  -si[{name}] : read data from stdin
  -slp : set Large Pages mode
  -slt : show technical information for l (List) command
  -snh : store hard links as links
  -snl : store symbolic links as links
  -sni : store NT security information
  -sns[-] : store NTFS alternate streams
  -so : write data to stdout
  -spd : disable wildcard matching for file names
  -spe : eliminate duplication of root folder for extract command
  -spf : use fully qualified file paths
  -ssc[-] : set sensitive case mode
  -ssw : compress shared files
  -stl : set archive timestamp from the most recently modified file
  -stm{HexMask} : set CPU thread affinity mask (hexadecimal number)
  -stx{Type} : exclude archive type
  -t{Type} : Set type of archive
  -u[-][p#][q#][r#][x#][y#][z#][!newArchiveName] : Update options
  -v{Size}[b|k|m|g] : Create volumes
  -w[{path}] : assign Work directory. Empty path means a temporary directory
  -x[r[-|0]]{@listfile|!wildcard} : eXclude filenames
  -y : assume Yes on all queries
6
  • Thanks. I was confused because -p said set password so I thought is only for archiving.
    – drum
    Jun 30, 2016 at 18:51
  • 1
    Process scans will reveal that password. Could ENV variables be used instead?
    – Chris
    Oct 17, 2017 at 15:11
  • @Chris See if specifying a variable to be set as the first argument passed would work. This way you could just pass in the password at run/execution time per your manual run or scheduled job, and the password would not be embedded within any script logic. So for example with batch script you could set password=%~1 or bash password=$1 for example. Oct 17, 2017 at 15:17
  • 2
    Still dangerous. A ps scan will bring me all the password to others
    – Chris
    Oct 17, 2017 at 15:18
  • @Chris On what type of machine you have this setup on exactly? Schedule the processes from machines that end-users do have have access to then I suppose. If you set the value of a password as an environmental variable, then looking at the logic of a script will expose that's the method and then that could be searched so ENV variable is just as insecure with regard to physical access to a machine it's hosted on and running some type of security scan. Oct 17, 2017 at 15:22
5

The -p option is somewhat more secure than you'd expect. When 7zip first runs, if it detects the -p option, it will copy that value somewhere else, and it will overwrite the value that is visible in the process tree. So if you did "ps -aux", you might see "/usr/bin/7za -p******* x arch.7z" instead of the actual password after -p. At least this is the way it works on Linux- and you can configure the kernel such that process trees are invisible to normal users.

1
  • 3
    Clearing the password is a good idea, but it still leaves a small window when the password is visible.
    – RalfFriedl
    Sep 17, 2018 at 17:06
0

I'm guessing you were using p7zip. Note that the upstream version of 7zip is now available for Linux, and supports exactly the usage you tried in your original question. (I would have expected p7zip to support this too.) For example:

printf '%s' "$PASSWORD" | 7zz x -aoa test.zip

This usage is particularly important for upstream 7zip, as it does not even attempt to hide the command-line arguments from the process tree.

(Adapted from https://stackoverflow.com/a/54964978)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .