How to encrypt / password protect big linux file?

postcd · 01-09-2014, 11:21 AM

Hello,

i have around 20 backup files tar.gz with sensitive data. The sizes of these files are from around 200MB to around 20GB

I want to secure these files so no one can read, use its contents. only me

the method of encrypting, password protecting them should be fast, so for example in case of 20GB file, it wont take more than like 10 minutes of server work to "encrypt it"

it should be able to "encrypt/decrypt" them from linux command line.

Please do you have any ideas on how to do it?

MensaWater · 01-09-2014, 11:36 AM

When you said encrypt/decrypt I immediately thought of GnuPG (gpg) which is often used for encrypting files. We use it for file transfers to and from other companies. I've not used it for a tar pipeline (I'm assuming you're doing something like that since you mentioned "backup" files. On searching for that I came across this link:
http://linux.icydog.net/ssh/piping.php

Which shows in part:

Quote:

2. Offsite backups

This is pretty much the same as above, except you want to transfer a bunch of files and leave them as a tarball on the server rather than as a bunch of files.

$ tar zcf - stuff | ssh user@server 'cat - > stuff.tar.gz'

You can also encrypt the tarball so that you'll have protection in case your backup server is hacked, gets stolen, or gains sentience. If you have a GPG keyring set up:

$ tar zcf - stuff | gpg -e | ssh user@server 'cat - > stuff.tar.gz.gpg'

If not, you can use a symmetric cipher just as easily (this should all be on one line):

$ tar zcf - stuff | openssl enc -rc4
| ssh user@server 'cat - > stuff.tar.gz.rc4'

Note that you can choose a cipher other than RC4. Just remember what the cipher was when decrypting (this should all be on one line):

$ ssh user@server 'cat stuff.tar.gz.rc4'
| openssl enc -rc4 -d -out stuff.tar.gz

Although it mentions offsite backups you could do it for on site. Haven't tried that myself though.

sgosnell · 01-09-2014, 12:07 PM

gpg is the way to go, IMO. If it's not already installed, you can get it from the repositories of most distros. You can run it from the command line, with a script, or get a GUI frontend.

MensaWater · 01-09-2014, 12:51 PM

Quote:

Originally Posted by sgosnell

a GUI frontend.

Such as...?

metaschima · 01-09-2014, 01:09 PM

I'd say making an encrypted partition is a better option for multiple large files. You can use cryptsetup to make a LUKS partition, or truecrypt.

Also, I can't guarantee that "no one can read" the files. Certain agencies likely are able.

Janus_Hyperion · 01-09-2014, 02:07 PM

Quote:

Originally Posted by MensaWater

Such as...?

seahorse? I do not know if it's still available - the seahorse extension to nautilus.

metaschima · 01-09-2014, 02:11 PM

There are some gpg GUIs listed here:
http://freecode.com/search?q=gpg&submit=Search

jailbait · 01-09-2014, 02:51 PM

I use the ccrypt command to encrypt sensitive data. You can read the data without making it readable to other people by using the ccat command which is an alias for:

ccrypt -c

see:

man ccrypt

-------------------------
Steve Stites

metaschima · 01-09-2014, 03:55 PM

I've used ccrypt for a while, and I also recommend it for single files. Just remember that programs can leak information out. Let's say you use ccat to decrypt the file and pipe it to a program, and then the program makes temporary files in /tmp. I've seen it happen.

You will also want an encrypted swap partition in case these files are put in swap unencrypted.