5

Is there a utility for editing password protected files that re-encrypts the file once editing is complete?

e.g.

env PASSWORD=$(my-secret-command) \
    encrypted-edit secrets.txt.enc

Which (for example) runs EDITOR with a decrypted secrets.txt.enc then re-encrypts it on save.

The encoding could use OPENSSL or any other utilities to encrypt a file using a password.


This seems like a utility that might exist but I'm not aware of any.

6
  • 6
    Technically Vim can: vimhelp.org/editing.txt.html?#encryption
    – muru
    May 14 at 7:06
  • Out of interest, are you looking to protect the contents just from other non-privileged users or from root too? May 14 at 7:58
  • Depending on your use case, office utilities like libreoffice allow protecting files and would do so again once editing is done.
    – FelixJN
    May 14 at 8:16
  • KeePassXC has a cli utilility, but may be too much for what you are looking for. May 14 at 10:06
  • 1
    When comparing solutions, you may want to check which one writes the plantext file temporarily to disk. Those are insecure, because the attacker may be running a program in the backround checking for newly created files and copying them.
    – pts
    May 15 at 17:03

2 Answers 2

9

If by utility you mean an editor then vim can do a reasonable job. It uses blowfish2 encryption. To enable your vim for this option place this command in your .vimrc

set cm=blowfish2

To encrypt an exisiting file, say file1

$ vim file1
:X

(capital X, or it will simply exit vim)

Now enter your password as desired (and confirm)

:wq

Next time you open file1, you would need to enter the password and on exit it will be re-encrypted automatically.

To remove the password from file1, open it in vim and use :X again to define a new password, except that this time you press enter (i.e. no password). Save and exit and the new file1 would be without password.

3

Aside from the native encryption support in Vim mentioned in comments and other answers, the gnupg plugin for Vim may be of some interest. It provides fully transparent editing of GPG encrypted files (and unencrypted GPG ASCII-armored files). Advantages to this over Vim’s native encryption support include:

  • Support for public-key encryption as well as symmetric encryption. This is useful if you expect to need to share the file with people.
  • Support for signing files on write in addition to encrypting them.
  • Automatically disables viminfo, swapfile, and persistent undo for encrypted files, reducing the possibility of accidentally writing unencrypted data to disk.
  • Keys off of the file extension, so creating a new encrypted file consists of just opening a file with the right extension that doesn’t already exist.
  • Full support for gpg-agent and most equivalent software, so you can set things up such that Vim never actually touches the password.
  • Because it uses GPG, access to the file isn’t dependent on Vim itself, just a usable copy of GPG.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .