I'm trying to understand environment variables and the security implications from the command line and from a script or cron job. Duplicity expects (and requires for automation) that there be a PASSPHRASE environment variable set.
I intend to run Duplicity on a machine where there will generally only be my account (with sudo) aside from root. I would still like to treat it like a multi-user system from a security standpoint.
I've never used environment variables, my main exposure being windows SYSTEM and USER variables, which are wide open for the system and user respectively.
I've gone through these answers and pages, but I'm not confident yet:
There are a few references to "process environments" and it sounds like that's what I would want. Is this as "simple" as storing the passphrase in a secure file (chmod 600, similar to an SSH private key), reading the file, and defining a variable in a script? The script would then call the final program from this environment. I think I understand that USER variables are safe from other users in their basic form (aside from root).
I only mentioned Duplicity earlier, but I would be backing up to Backblaze B2 which means the Duplicity URL will contain my B2 application key as well.
I'm looking for something in layman's terms since I'm still quite new to Linux security in the context of multiple users.