Skip to content


How to encrypt your Linux backups

Linux Security

We covered the creation and extraction of compressed archives such as tar on a Linux machine. A lot of Linux users use these compression formats for backups purposes. Although this compresses pretty well it does not secure the backup. To do that you need to add a password, or to encrypt it. Let’s look at a simple form of securing your backup when you create an archive.

Note: these steps apply to files and folders of any kind – not just ‘backups’.

A quick recap of the compression and extraction of the tar.gzformat. To compress a directory called todays_backup do the following:

# tar -zcf todays_backup.tar.gz todays_backup

This command will compress the directory todays_backup into the compressed file todays_backup.tar.gz. To decompress it use the following command:

# tar -zxf todays_backup.tar.gz

Now to the fun part. Let’s look at how we can add a basic level of encryption to the process we used above. To compress the directory todays_backup with protection do the following:

# tar -zcf – todays_backup|openssl des3 -salt -k yourpassword | dd of=todays_backup.des3

Replace yourpassword with a password of your own. Keep the password to yourself, and keep it carefully. The above command will generate a file called todays_backup.des3. This file can only be decompressed using this password.

To extract your protected archive file todays_backup.des3 use the following command:

# dd if= todays_backup.des3 |openssl des3 -d -k yourpassword |tar zxf -

Make note of the trailing - at the end. It is not a typo, but a requirement for this command to work. Replace yourpassword with the password you used while encrypting the file. Executing the above command will extract the compressed file todays_backup.des3 into a directory todays_backup. Use this encryption with care. As I said earlier, the only way you can retrieve your data once secured is by using the password, so do not lose this password under any circumstances.

Posted in Linux, Security.

Get Simple Help tutorials just like this one in your email inbox every day - for free! Just enter your email address below:

 

You can always opt out of this email subscription at any time.

7 Responses

Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.

  1. Bishinik says

    Why use the dd command? Simple redirect will work as well. So the openssl command could be simplified to:

    openssl des3 -salt -k yourpassword > todays_backup.des3

    and

    openssl des3 -d -k yourpassword < todays_backup.des3

  2. MikeT says

    And anyone who checks the shell history knows your password.

    I’ve not checked but the respective enciphering command MUST have a way of launching the command without putting the password into the command line.

  3. amela-shopru says

    Наша компания специализируется на оптовой продаже радиотелефонов,
    проводных телефонов, стационарных телефонов, системных телефонов,
    домашних телефонов, офисных телефонов, АТС, мини АТС, факсов, и расходных материалов к ним.
    Оптом сотовые и обычные телефоны, радиотелефоны, факсы, мини-АТС, цифровое фото.
    Оптовая продажа проводных телефонов, радиотелефонов, факсов, мини-АТС.

  4. geizer-shop-ru says

    В нашем интернет магазине Вы всегда сможете подобрать любую бытовую технику:
    Мясорубки Блендеры
    Водонагреватели
    Электро плиты
    Кухонные вытяжки
    Варочные панели
    Стиральные машины
    Пылесосы
    Фритюрницы
    Тостеры .
    Продажа бытовой техники Bosch, Siemens, Gorenje, Beko, Blomberg и др.
    Интернет магазин бытовой техникой Гейзер.
    Geizer-shop.ru.

  5. layra-market-ru says

    В нашем интернет магазине Вы всегда сможете подобрать любую бытовую технику:
    блендеры, кухонные комбайны, кофемолки, утюги, пароварки, микроволновки,
    стиральные машины, холодильники, кондиционеры.
    Продажа бытовой техники Bosch, Siemens, Gorenje, Beko, Blomberg и др.
    Интернет магазин оптово-розничнной торговли бытовой техникой Лаура маркет.

  6. ttwwwru says

    В нашем интернет магазине Вы всегда сможете подобрать и купить любую флеш карту.
    У нас вы найдете хранители информации от следующих брендов :
    флэш-диски Transcend
    портативный HDD Transcend
    флэш-диски Kingston
    флэш-диски APACER
    флеш диски Corsair
    флэш-диски LG
    портативные HDD Samsung
    флеш карты PQI
    флеш диски Sandisk

Continuing the Discussion

  1. Blog de NeKRoMaNT » Paseos por la red el 2009-02-19 linked to this post on February 20, 2009

    [...] a link on Delicious. Encript backups en Linux Escrito por NeKRoMaNT en: General [...]



Some HTML is OK

or, reply to this post via trackback.