1

I'm trying to understand environment variables and the security implications from the command line and from a script or cron job. Duplicity expects (and requires for automation) that there be a PASSPHRASE environment variable set.

http://duplicity.nongnu.org/duplicity.1.html#sect6

I intend to run Duplicity on a machine where there will generally only be my account (with sudo) aside from root. I would still like to treat it like a multi-user system from a security standpoint.

I've never used environment variables, my main exposure being windows SYSTEM and USER variables, which are wide open for the system and user respectively.

I've gone through these answers and pages, but I'm not confident yet:

Is it safe to export a variable containing a password, then resetting it?

Why is passing the secrets via environmental variables considered "extremely insecure"?

https://www.linuxquestions.org/questions/linux-security-4/storing-a-password-in-an-environment-variable-894156/

https://security.stackexchange.com/questions/14000/environment-variable-accessibility-in-linux/14009#14009

There are a few references to "process environments" and it sounds like that's what I would want. Is this as "simple" as storing the passphrase in a secure file (chmod 600, similar to an SSH private key), reading the file, and defining a variable in a script? The script would then call the final program from this environment. I think I understand that USER variables are safe from other users in their basic form (aside from root).

I only mentioned Duplicity earlier, but I would be backing up to Backblaze B2 which means the Duplicity URL will contain my B2 application key as well.

I'm looking for something in layman's terms since I'm still quite new to Linux security in the context of multiple users.

  • This depends on the specifics of how cronjobs are run on your system. Which distribution is this? Are you using anacron? Where is the cronjob set? – muru Jul 5 at 14:15
  • This is Ubuntu 18.04. I have very little knowledge of cronjobs, so I had not intended on using anything but "plain" cron. I am however, open to suggestions on how to deal with my situation more effectively. – Brian Jul 5 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.