SAS 9.4, Using 7zip to zip and encrypt a file via batch

[Gciocia]

Hello everyone, i'm trying to create a SAS program for zipping and encrypting a csv file, which i need to send via email. I used the routine for generate a random password, and found the routine to 7zip the file, but i can't apply password to the code:

data _null_;

*Path to winzip program;

zipexe='"C:\Program Files\7-Zip\7z.exe" a -tzip -p&Pwd';

*Zip file name; zipfile="C:\SASOutputs\Mail\RSK_001_Pratiche_A_Rischio_All.zip";

*File to be zipped;

file="C:\SASOutputs\Mail\RSK_001_Pratiche_A_Rischio_All.csv";

*Full cmd line to be passed to command line. It embeds the quotes for paths with spaces;

cmd = zipexe ||' "'|| zipfile ||'" "'|| file ||'"' ;

*Execute command;

call system(cmd);

run;

It only works if i use a fixed value instead of &Pwd

zipexe='"C:\Program Files\7-Zip\7z.exe" a -tzip -pPASSWORD';

How can i use my &Pwd variable to set a random password to the zip?

Thanks in advance Gianluca

[Kurt_Bremser · Accepted solution]

Macro variables are only resolved within double quotes, single quotes prevent resolution of macro triggers.

try this:

zipexe="'C:\Program Files\7-Zip\7z.exe' a -tzip -p&Pwd";

or this:

zipexe='"C:\Program Files\7-Zip\7z.exe" a -tzip ' !! "-p&Pwd";

Note that providing data via SSL/TLS (SSH) is much more secure, password-encoded files sent via email are open to all kinds of attacks (how does the recipient get to know the password?). On top of that, attached files are prone to exceed mailbox limits, or being discarded by anti-virus-protection.

[Gciocia]

Fantistic, it works perfectly

Now i can zip the csv file with a random password, and send it into a different mail so we can assure compliance standards

Thanks a lot Kurt!

[RW9]

I really cannot tell you how insecure and dubious encrypted files via email is.  It is so easy to simply scan for emails surrounding a file send for passwords.  You must have a better way of sending the file, secure web portal, shared area?

For your code, you need to consider which quoting is needed in the final command, and which is needed by SAS.  SAS requires macro variables to be surrounded by double quotes to be resolved:

'"C:\Program Files\7-Zip\7z.exe" a -tzip -p&Pwd';  <- Here &Pwd will not get resolved.

You may find the quote() function here is easier, or perhaps script the event in a batch file and just call that with the name of the file.

You will also note that:

'"C:\Program Files\7-Zip\7z.exe" a -tzip -p&Pwd';

Is not secure either, both the macro table, log and the code will contain the password - not a good idea.

Personally I would recommend not doing this process, but use secure file transfer.

[Kurt_Bremser]

Concur with @RW9 . If I am your Security Officer, and catch you having passwords on a command line, I'd have your hide nailed to my office door, pour encourager les autres.

[Gciocia]

I agree with you all about the secuirity issues. But we are talking of a temporary solution and data cointained into files doesn't contain any personal information.

We will send the output via ssh or into a shared area in the near future, time to build the infrastructure.

Again, thanks to everyone for your precious effort

Best Regards