The following bash
script fulfills your requirements:
#!/usr/bin/env bash
# Print usage information of the script
if (($# == 0)) || [[ "$1" == "--help" ]] || [[ "$1" == "-h" ]]; then
echo "Usage: $0 <filename> [<filename> ...]"
exit 1
fi
echo "Passphrase:"
# Disable output to prevent terminal leakage of passphrase when the passphrase is entered
stty -echo
# Read passphrase via standard input
# The "-r" parameter of read prevents the interpretation of escape sequences
# Setting the IFS (Internal Field Separator) environment variable empty to allow the passphrase to contain whitespaces
IFS="" read -r passphrase
# Enable output
stty echo
# Execute GnuPG to encrypt every file with AES-256 given as a parameter to the script
for arg in "$@"; do
gpg --batch --symmetric --passphrase-fd 0 --cipher-algo AES256 "$arg" <<< "$passphrase"
done
- Save it as
enc.sh
and make it executable withchmod +x enc.sh
. - To encrypt multiple files, execute
./enc.sh file1 file2 ...
and enter your passphrase which is required once. - Files are encrypted with GnuPG using AES-256.
- The passphrase will not be leaked through the terminal, the shell history or
/proc
'scmdline
. - To decrypt a file execute
gpg filename.gpg
or usegpg --multifile --decrypt file1.gpg file2.gpg ...
to decrypt multiple files at once.