Link to home
Start Free TrialLog in
Avatar of Phil Chapman
Phil Chapman

asked on

GPG Command Line

From the windows 10 command line

I'm using
gpg --always-trust -e -r "s-batchdev" TestUnEnc.pdf
To encrypt a file and it works fine.  
But how can I set the path where the encrypted file will be sent.


I'm using
gpg -d Test.pdf.gpg
To decrypt a file
But I'm being asked for the passcode.
1 - How can I modify the command so the user will not be asked for the passcode
2 - How can I modify the command so the path to the file can be set within the command
Avatar of Alex
Alex
Flag of United Kingdom of Great Britain and Northern Ireland image

That makes very little sense, what's the point of encrypting a file and then not having a pass code in order to open it.

The only way you'll be able to open this is if you give them a public key or a certificate key.
Avatar of noci
noci

gpg --help    should give all options.

ever tried to add: --output someother-filename  to a command?
Avatar of Phil Chapman

ASKER

Alex,
The program shells out and runs the command line.  The user never knows anything about the file whether it's encrypted or not.
ohhh so you're not encrypting it and then emailing it or something, you're encrypting locally or on a network.

My bad, sorry :(
For a file you can just specify the complete path. You may need to add " round a path containing blanks..
Like:
 "/where ever/this/file/may be"
 "w:\here ever\this\file\may be"
maybe \ needs to be doubled up like:
 "w:\\here ever\\this\\file\\may be"

and --passphrase "blah-di-blah-di-blah" should be usable...
(It might show the passphrase in a process list though).
More secure check if you can use the --passphrase-fd option. so your parent program can send the password using a write to a fd..?
noci,
can you modify the command below to
1.  Set the path where the Test.PDF will be going
2.  Not require the user to enter the passcode ( have the passcode as part of the command line?)

gpg -d Test.pdf.gpg

I found the following on you-tube
 https://www.youtube.com/watch?v=iEloW5QCvKI
That does what i need to do using

gpg--batch --cwas@1810200  s-batchdev Test.pdf.gpg

But i know nothing on creating a batch usable by gpg
First are you aware of the manual page: https://www.gnupg.org/documentation/manpage.html
Windows usage guide: https://www.glump.net/howto/cryptography/practical-introduction-to-gnu-privacy-guard-in-windows
See also: https://ubuntuforums.org/showthread.php?t=1510360

Some thing along:
gpg --batch --yes --output "C:\Temp\Test.pdf.gpg" --passphrase "The Very Secret Code" --symmetric "C:\Temp\Test.pdf" 

Open in new window

gpg --batch --yes   --output "C:\Temp\Test2.pdf" --passphrase "The Very Secret Code" --decrypt "C:\Temp\Test.pdf.gpg" 

Open in new window

Noci,
Trying encrypting the attached file with gpg and then decrypting the file with no input from the user
gpg --batch --yes   is meant to be used as background command.
it forces to NOT ask any questions.. If there are error youwill get a message & exit status  (errorlevel)  to indicate a failure.
I tried both of the command lines above and neither one works.  Please try encrypting and then decrypting the attached file
With:
1. Ability to get and put results of the encryption or decryption in a specified folder
2.  Does not require the user to put in the passcode
Test.txt
Here is a session....
cat on linux behaves like type on Windows. (I have no windows systems ...)
$? is  the variable containing the exist status of the previous command.


$ cat test.txt  
91234842        "$1,400.00"     06/28/2019      -$50.00
91325105        $175.00 07/01/2019      -$13.83
91256787        "$2,400.00"     07/01/2019      -$31.17
91597347        $370.00 07/01/2019      -$104.50
91597347        $370.00 07/01/2019      -$45.00
91325105        $245.00 07/01/2019      -$45.00
91325105        $70.00  07/01/2019      -$10.80
91597347        $370.00 07/01/2019      -$34.20
$ gpg --batch --yes --output "./test.gpg" --passphrase "The Very Secret Code" --symmetric ./test.txt
$ gpg --batch --yes --output "./test.dec" --passphrase "The Very Secret Code" --decrypt ./test.gpg
gpg: AES encrypted data
gpg: encrypted with 1 passphrase
$ echo $?
0
$ ls -l
total 16
drwxr-xr-x 2 ee ee 4096 Nov 21 12:19 specific-folder
-rw-r--r-- 1 ee ee  312 Nov 21 12:11 test.dec
-rw-r--r-- 1 ee ee  197 Nov 21 12:10 test.gpg
-rw-r--r-- 1 ee ee  312 Nov 21 12:09 test.txt
$ file *
test.dec: ASCII text
test.gpg: GPG symmetrically encrypted data (AES cipher)
test.txt: ASCII text
$ diff -y test.dec test.txt
91234842        "$1,400.00"     06/28/2019      -$50.00         91234842        "$1,400.00"     06/28/2019      -$50.00
91325105        $175.00 07/01/2019      -$13.83                 91325105        $175.00 07/01/2019      -$13.83
91256787        "$2,400.00"     07/01/2019      -$31.17         91256787        "$2,400.00"     07/01/2019      -$31.17
91597347        $370.00 07/01/2019      -$104.50                91597347        $370.00 07/01/2019      -$104.50
91597347        $370.00 07/01/2019      -$45.00                 91597347        $370.00 07/01/2019      -$45.00
91325105        $245.00 07/01/2019      -$45.00                 91325105        $245.00 07/01/2019      -$45.00
91325105        $70.00  07/01/2019      -$10.80                 91325105        $70.00  07/01/2019      -$10.80
91597347        $370.00 07/01/2019      -$34.20                 91597347        $370.00 07/01/2019      -$34.20
$ cp test.txt specific-folder
$ gpg --batch --yes --output "./specific-folder/test.gpg" --passphrase "The Very Secret Code" --symmetric ./specific-folder/test.txt       
$ gpg --batch --yes --output "./specific-folder/test.dec" --passphrase "The Very Secret Code" -d ./specific-folder/test.gpg
gpg: AES encrypted data
gpg: encrypted with 1 passphrase
$ ls -l specific-folder
total 12
-rw-r--r-- 1 ee ee 312 Nov 21 12:22 test.dec
-rw-r--r-- 1 ee ee 197 Nov 21 12:22 test.gpg
-rw-r--r-- 1 ee ee 312 Nov 21 12:19 test.txt
$ od -t x1 test.gpg
0000000 8c 0d 04 07 03 02 be de c9 de 07 fd cf 80 d1 d2
0000020 b4 01 cd 95 10 39 cc c2 cf 0b 6b a4 d4 d4 4f 99
0000040 aa 0c c8 6a c0 12 47 34 ee 60 3a 6e fc a8 d8 f4
0000060 00 39 1c 04 a7 27 58 3e 55 b6 93 c5 47 9e c9 24
0000100 a0 08 d3 6b b1 73 20 e4 02 1a ca 5a 5a 26 09 9d
0000120 a7 52 30 e4 e8 70 4e e2 de 22 42 b8 38 ab 9e dd
0000140 38 b4 74 24 c6 f0 e4 18 93 5f e1 40 0a 78 e8 8b
0000160 d6 ee b8 a2 86 1c 71 9d c5 e2 27 43 87 d7 8c 0b
0000200 41 e7 0e 31 96 b4 60 0c 7f d8 ee 89 0e 71 25 6d
0000220 91 f8 99 f6 2c 81 37 d0 6d 9d 6a 56 79 53 25 77
0000240 e3 68 cb 5f a8 f9 e5 69 2a 40 ac 4e 50 8a 9c 2d
0000260 1e ed 04 ae 60 00 59 00 70 f8 e6 e7 0d 52 82 28
0000300 3c 35 6e c9 81
0000305

Open in new window


Ergo gpg  works....  now it may not work in your environment...
so try the commands by hand first then you can at lease see what is wrong if there are things wrong.
To answer your first question.

You specify the path in the output switch option.  Here are some examples:

gpg -er "s-batchdev" -o "%temp%\test.txt.gpg" Test.txt

Open in new window


gpg -er "s-batchdev" -o "x:\path\test.txt.gpg" Test.txt

Open in new window


gpg -er "s-batchdev" -o "\\server\share\path\test.txt.gpg" Test.txt

Open in new window


You can explicitly specify the source file in the same manner:

gpg -er "s-batchdev" -o "\\server\share\path\test.txt.gpg" "x:\path\Test.txt"

Open in new window



To answer your second question.

You don't want to provide your passphrase in clear text within a script, as this would defeat the purpose of confidentiality.

However, you can increase your cache timeout values.  After applying the new values on the host performing the decrypting, you'll need to decrypt a relevant file once manually, to cache your private key.  After that, you should be good to go for the duration of the cache period or until the host is rebooted, etc.


User generated image

Once the private key is cached, you can decrypt as follows:

gpg -dr "s-batchdev" "test.txt.gpg"

Open in new window


That being said, I don't recommend automating decryption.  The method above significantly increases the chance that your private key could be compromised or any file could be decrypted using your cached private key at will, which of course defeats the purpose of encrypting (confidentiality) altogether.
This question needs an answer!
Become an EE member today
7 DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.