I would like to use GnuPG to decrypt short messages that are stored on a remote host (running Linux), i.e.:

  1. ssh [<user>@]<host>
  2. gpg -d <file-to-decrypt>
  3. interact with gpg-agent and/or just type in the password
  4. close SSH connection

but in a more automated way. I just want to type a single command and the script should do the rest (except for (interactive) input of the password), i.e.:

  1. remote-gpg [<user>@]<host> <file-to-decrypt>
  2. [query for password without echoing it back in plaintext]
  3. [dump the decrypted text on stdout] AND close the SSH connection

My main challenge is merging the "ssh" and "gpg" step.

I am looking for a simple and effective way to achieve this:

  • with as little dependencies on the client side (ideally, just ssh + core utilities)
  • without messing a lot with sockets and pipes on the server side
  • with no assumption about whether gpg-agent is running on the server

So, solutions such as writing a GNU expect script are out of question.

Motivation: A typical use case would be using a phone (running Android) to retrieve an encrypted message (e.g., a password) from the remote server. Closing the connection upon information delivery is desired because you might forget logging out before your phone gets lost/stolen, and the thief cannot retrieve additional information without guessing the password (since password is queried every time). Finally, removing your phone's SSH key from server's authorized_keys file is all it takes to prevent a security breach.

By the way, would there be any additional security risks with that approach (as compared to the 4-step manual process)?

ssh -t user@host gpg -d file

I don't think it has to be more complicated than that.

The decrypted output will be echoed back to your terminal. The -t option asks ssh to request a tty, which is needed so that gpg can prompt on your terminal for the password.

This seems no more or less secure to me than your 4-step method.


tldr you want someone to write the code for you. Lucky for you I already have something similar.


# Get our original tty and turn off -echo
stty_orig=`stty -g` stty -echo 
read Pass
# type in your pass for gpg.
gpg --passphrase="$Pass" --no-tty -d $1
# Output goes to STDOUT
stty $stty_orig

Call it by:

ssh -t user@host 'decyrpt.sh File'

Assumptions: You file is in the home directory, and decrypt.sh is in your $PATH.

  • I didn't request the code, but it is always welcome - thanks!
    – leden
    Sep 18 '14 at 1:05
  • 3
    I think stty_orig=stty -g` stty -echo` should be 2 lines. The way you used it works, but has a different meaning.
    – glglgl
    Jan 15 '15 at 13:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.