It is also possible to pass environment variables explicitly through ssh. It does require some server-side set-up through, so this this not a universal answer.
In my case, I wanted to pass a backup repository encryption key to a command on the backup storage server without having that key stored there, but note that any environment variable is visible in ps
! The solution of passing the key on stdin would work as well, but I found it too cumbersome. In any case, here's how to pass an environment variable through ssh:
On the server, edit the sshd_config
file, typically /etc/ssh/sshd_config
and add an AcceptEnv
directive matching the variables you want to pass. See man sshd_config
. In my case, I want to pass variables to borg backup so I chose:
AcceptEnv BORG_*
Now, on the client use the -o SendEnv
option to send environment variables. The following command line sets the environment variable BORG_SECRET
and then flags it to be sent to the client machine (called backup
). It then runs printenv
there and filters the output for BORG variables:
$ BORG_SECRET=magic-happens ssh -o SendEnv=BORG_SECRET backup printenv | egrep BORG
BORG_SECRET=magic-happens