Question

I’ve implemented a HTTP server (CherryPy and Python) that receives an encrypted file from a client (Android). I’m using OpenSSL to decrypt the uploaded file. Currently I’m using openssl -enc -pass file:password.txt -in encryptedfile -out decryptedfile to perform to decryption on the server side. As you can see the password used by openssl is stored in a plain text file (password.txt).

Is there a more secure way to store this OpenSSL password?

Thanks.

Answer 1

Pass it through a higher FD, and use that FD in the command line. Note that you’ll need to use the preexec_fn argument to set up the FD before the process gets run.

subprocess.Popen(['openssl', ..., 'file:/dev/fd/12', ...], ...,
  preexec_fn=passtofd12(password), ...)