tcreech.com

Encrypting pipes/socat/netcat with openssl

Example

On the sending side:

 uname -a | openssl enc -aes-256-cbc -k myoutofbandpassword | socat - TCP4:destinationhost:5001

On the receiving side:

 socat TCP4-LISTEN:5001 - | openssl enc -aes-256-cbc -d -k myoutofbandpassword

The above example will send the output of uname -a on the sending machine to the receiving machine at address destinationhost:5001. This output is encrypted and then later decrypted using a one-time password, myoutofbandpassword.

Of course, socat has a method that handles encryption (and optionally authentication too) all in one address type. The following should be essentially equivalent to the above:

On the sending side:

 uname -a | socat - OPENSSL:destinationhost:5001,verify=0,cipher=aNULL

On the receiving side:

 socat OPENSSL-LISTEN:5001,verify=0,cipher=aNULL -

Here, the output of uname -a is still encrypted, but uses SSL to negotiate a temporary private key. (This is no less secure if you trust in maths.) This now requires two-way communication. The “aNULL” option means that no authentication is used: anyone can connect and start an encrypted session.

If your sending-side doesn’t have socat, or socat is built without openssl support (such as with SmartOS’s pkgin version), you can use the “openssl” command directly:

 uname -a | openssl s_client -cipher aNULL -connect destinationhost:5001

Example wrapper/helper script

See symencrypt. Create files/symlinks named symencrypt and symdecrypt with the same content. This script implements the first example: one-way communication, key chosen and sent out of band, and no network.