Yrurtj

The following takes place on Ubuntu 18.

I need to automate the remote seeding of a gpg-agent with a passphrase stored in a file on my local machine using SSH.

The passphrase needs to be handled in such a way so that it cannot be easily viewed by other nosey users - principally on the remote server, but also it should be secure on the local box too.

The problem is a general one, rather than being GPG specific - how do I pass a string securely into a programming running on a remote server using ssh?

I know that putting the password on the command line means is visible using ps -ef on both local (ssh) and remote machines (bash -c). So I must avoid this.

I also know that storing the password in environment variables means a process' initial env can be see as cat /proc/<pid>/environ and gdb can be used to look at current state. So details can be seen on the local machine or the remote machine if local environment variables are forwarded. So this is not ideal, especially as I can't control tightly other people's access to the SSH user account on the remote machine.

After a bit of reading and experimentation I've come-up with the below - it certainly works! You can assume seed.txt is chmod 400 so short of someone having root access it is safe (or at least as safe as my SSH keys).

Note - seed.txt does not exist on the remote server, only on the local server, so it's contents must be sent to the remote server.

SSH connection is using keys so no password is need for that.

#!/bin/bash

ssh -T my-server <<EOSSH > /dev/null

printf '%sn' "$(cat seed.txt)" | /usr/lib/gnupg2/gpg-preset-passphrase -c 123456789

EOSSH

Using ps -ef on the local machine will only yield ssh -T my-server as the actual commands to be remotely executed are piped into stdin, rather than using the ssh command line.

Likewise the cat command line displays only the filename. printf, I believe, is a built-in command so will not show-up in ps. I believe the printf is being executed on the remote machine?

On the remote server ps will only show /usr/lib/gnupg2/gpg-preset-passphrase -c 123456789 as the passphrase is piped in again using stdin.

I'm making no direct use of environment variables so there shouldn't be any issue here. I'm a little anxious that something will be exposed from the SSH environment variables?

My question is - is my method sensible/simple/safe (assuming root access is not compromised), are there any obvious issues, and if yes, what are the suggested workarounds?

The only other options I've managed to get working is to use expect but given both ssh and gpg-preset-passphrase seem to be happy to accept input as stdin rather than interactively, it seems overkill to use expect?