Encrypting cron emails with GPG

Introduction

You might have your server setup in such a way that it runs a few tasks with cron so you don’t have to worry about them. Except.. you should. That is if the scheduled tasks send mission critical information over the internet. Now assume you have some kind of security audit software running like say lynis. You sure don’t want that report in the wrong hands since an attacker could really use that information to break into your server way easier than otherwise.

Assumptions

• You are familiar with GPG
• You have root access to your linux web server
• Your server runs on a recent Ubuntu
• Cron is already configured to send emails

Encrypting

There are basically two ways of encrypting emails one is GPG and the other S/MIME. We will be using GPG. Further this article assumes you are familiar with GPG.

1. Upload your public key (ending in .asc) to your server /home is a good place.
2. that the key can actually be read by the command we will be using, it has to be slightly modified. To be precise the ASCII amor has to be removed we need the key in binary form. This is archived by the following command.

gpg --dearmor < /home/YOURPUBLICKEY.asc > /home/YOURPUBLICKEY.asc.gpg

1. Add this line at the top of your /etc/crontab just after MAILTO=[e-mail]. You need to replace the email address and the public key path.

GPG_CMD = "ifne /usr/bin/gpg --batch --armor --trust-model always --no-default-keyring --keyring /home/YOURPUBLICKEY.asc.gpg --recipient [e-mail] --encrypt"

1. For this command to work we need the program ifne installed. Usually if a command has no output to /dev/stdout or /dev/stderr gpg would encrypt an empty string and you would receive an encrypted email that has no content once decrypted. This would be annoying ifne prevents this. To install it run.

apt-get install moreutils

1. Now in /etc/crontab you can simply pipe the output to gpg and enjoy encrypted emails.

* * * * * root /bin/echo "gpg test" | $GPG_CMD

I got the inspiration for this from this a site that is unfortunately offline for a few days now (checked April 2021).