5

If I set a passphrase on my private key like so:

openssl rsa -des -in insecure.key -out secure.key

and I remove the passphrase like so:

openssl rsa -in secure.key -out insecure.key

then my private key (insecure.key) ends up with a file mode of 644.

How can I tell openssl to create insecure.key with a file mode of 600 (or anything)?

I know that I can simply chmod the file afterwards, but what if I lose connection? Then there's a private key on the filesystem that anybody could read.

  • Just lauch all the commands in one line separated by ";" – YoMismo Apr 17 '15 at 10:50
  • Thanks @YoMismo that's a better solution, but there's still an (albeit miniscure) time where the private key is exposed. – Ellis Percival Apr 17 '15 at 10:57
  • 2
    nohup bash -c "your_commands_separated_by_;" & will execute the complete list of the commands even if the connection is lost. Your file will be exposed much less time than when you lauch the commands by hand, and no connection loss affects the execution. – YoMismo Apr 17 '15 at 11:35
10

You can try to set umask before converting it

umask 077; openssl rsa -in secure.key -out insecure.key

Edit: To not affect other files in the current shell environment by the umask setting execute it in a subshell:

( umask 077; openssl rsa -in secure.key -out insecure.key )
  • Does this set umask permanently? Would I need to set it back to whatever it was afterwards? – Ellis Percival Apr 17 '15 at 10:47
  • 1
    No, it set it for the session/login. If you need to execute further commands you can revert it like this: umask 033 or umask 022 (to give 644) – Romeo Ninov Apr 17 '15 at 10:50
  • 3
    Only the current shell environment is affected. Which you can see by executing umask ; ( umask 077 ; umask ) ; umask; it returns 0002, 0077, 0002. So if the anwser encloses the command sequence in subshell parenthesis you're fine. In other words; no reset of umask is necessary if both commands are within a ( umask 077 ; openssl ... ) subshell. – Janis Apr 17 '15 at 10:57
4

One way to do this is to make a blank insecure.key file first and chmod it.

touch insecure.key
chmod 600 insecure.key

Which makes the directory look like

total 28
drwxr-xr-x  2 flyte flyte 4096 Apr 17 11:44 .
drwxr-xr-x 12 flyte flyte 4096 Apr 17 11:44 ..
-rw-------  1 flyte flyte    0 Apr 17 11:44 insecure.key
-rw-------  1 flyte flyte 1746 Apr 17 11:42 secure.key

And then remove the passphrase

openssl rsa -in secure.key -out insecure.key

Which makes the directory look like

total 32
drwxr-xr-x  2 flyte flyte 4096 Apr 17 11:44 .
drwxr-xr-x 12 flyte flyte 4096 Apr 17 11:44 ..
-rw-------  1 flyte flyte 1679 Apr 17 11:45 insecure.key
-rw-------  1 flyte flyte 1746 Apr 17 11:42 secure.key

However, this is a bit of a faff and it'd be nicer if there was an argument to openssl which does this in one go.

3

A trivial but simpler solution is to chmod 700 a directory and operate inside it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.