I have the following command but it doesn't work for me...

cd /etc/postfix/ssl/ && openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 <<PASS

The output is:

109 semi-random bytes loaded
Generating RSA private key, 1024 bit long modulus
e is 65537 (0x10001)
Enter pass phrase for smtpd.key:

It should auto answer the question and put password automaticaly.

I always use HEREDOC for automating my Q&A on bash and work fine...

What is the problem here?

May be because of security issues, but how can we deal with such issues?

I also know about this question but not able to resolve it.

I am trying this one: (no result)

printf '%s\n' "$PASS" | {
    openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 -passout fd:3
} 3<&0

any ideas?

closed as off-topic by Zelda, slm, vonbrand, Anthon, rahmu Mar 4 '14 at 13:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Zelda, slm, vonbrand, Anthon, rahmu

  • Cross-posted at stackoverflow.com/questions/22169829/… – devnull Mar 4 '14 at 11:18
  • Yes...There where no answer @devnull. What shall I do? – MLSC Mar 4 '14 at 11:19
  • 2
    What do you expect? That the community is out here to resolve your problems instantly? – devnull Mar 4 '14 at 11:20
  • Ok...I try to be more patient...Thanks myfriend – MLSC Mar 4 '14 at 11:21

You have to add -pass stdin for openssl to read from stdin, or else, as @XTian says, it will read the password directly from the associated tty or pts device. No shell redirection will solve this.

From the same section of man page that @XTian, gave:

stdin read the password from standard input.

You can do something like this:

cd /etc/postfix/ssl/ &&
  openssl genrsa  -passout stdin -des3 -rand /etc/hosts -out smtpd.key 1024 <<PASS

You can also specify the password using -passout pass:, but this is even less secure since the password can be seen by any user using ps (see the man page section in @XTian's post).

  • Excellent...This is working now – MLSC Mar 4 '14 at 12:02
  • I have a question///How can I do that by doing What I tried in origin questin(no result) – MLSC Mar 4 '14 at 12:04
  • pardon which one is correct? cd /etc/postfix/ssl/ && openssl genrsa -passout stdin -des3 -rand /etc/hosts -out smtpd.key 1024 <<PASS password password PASSW OR cd /etc/postfix/ssl/ && openssl genrsa -passout stdin -des3 -rand /etc/hosts -out smtpd.key 1024 <<PASS password PASSW with one password – MLSC Mar 4 '14 at 12:09
  • 1
    @Morteza, actually you only need one password when reading from stdin, although it won't complain if you give two. – Graeme Mar 4 '14 at 12:20
  • 1
    @Morteza, there is no confirmation reading from stdin, so the second one is just ignored. – Graeme Mar 4 '14 at 12:21

This is because openssl deliberately opens /dev/tty the controlling terminal, to prevent exactly what you are trying to do.

However there are several mechanisms to specify a password, the following option is just the first from the manual page (see below), choose which one is most appropriate for you.

-passout pass:abcd

From man openssl

PASS PHRASE ARGUMENTS Several commands accept password arguments, typically using -passin and -passout for input and output passwords respectively. These allow the password to be obtained from a variety of sources. Both of these options take a single argument whose format is described below. If no password argument is given and a password is required then the user is prompted to enter one: this will typically be read from the current terminal with echoing turned off.

             the actual password is password. Since the password is visible to utilities (like
             'ps' under Unix) this form should only be used where security is not important.

   env:var   obtain the password from the environment variable var. Since the environment of
             other processes is visible on certain platforms (e.g. ps under certain Unix OSes)
             this option should be used with caution.

             the first line of pathname is the password. If the same pathname argument is
             supplied to -passin and -passout arguments then the first line will be used for
             the input password and the next line for the output password. pathname need not
             refer to a regular file: it could for example refer to a device or named pipe.

   fd:number read the password from the file descriptor number. This can be used to send the
             data via a pipe for example.

   stdin     read the password from standard input.
  • even no answer with printf '%s\n' "$PASS" | { openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 -passout fd:3 } 3<&0 – MLSC Mar 4 '14 at 11:38
  • I also tried this one: openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024 -passout "pass:mypassword" – MLSC Mar 4 '14 at 11:46
  • 1
    Very strange, I just tried openssl genrsa -des3 -passout pass:abcd -rand /etc/hosts -out smtpd.key 1024 and that works ! – X Tian Mar 4 '14 at 11:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.