oreilly.comSafari Books Online.Conferences.


Secure Cooking with Linux, Part 1
Pages: 1, 2, 3

Recipe 7.25: Encrypting Backups

Author's note: If someone steals one of your backup tapes, your sensitive information could become compromised. This recipe, excerpted from Chapter 7 on "Protecting Files," illustrates how to encrypt the contents of a backup tape using GnuPG (gpg), a popular encryption program for Linux and other operating systems.


You want to create an encrypted backup.


Method 1: Pipe through gpg.

  • To write a tape:

    $ tar cf - mydir | gpg -c | dd of=/dev/tape bs=10k
  • To read a tape:

    $ dd if=/dev/tape bs=10k | gpg --decrypt | tar xf -
  • To write an encrypted backup of directory mydir onto a CD-ROM:

    mkdir destdir
    tar cf - mydir | gpg -c > destdir/myfile.tar.gpg
    mkisofs -R -l destdir | cdrecord speed=${SPEED} dev=${SCSIDEVICE} -

    where SPEED and SCSIDEVICE are specific to your system; see cdrecord(1).

Method 2: Encrypt files separately.

  1. Make a new directory containing links to your original files:

    $ cp -lr mydir newdir
  2. In the new directory, encrypt each file, and remove the links to the unencrypted files:

    $ find newdir -type f -exec gpg -e '{}' \; -exec rm '{}' \;
  3. Back up the new directory with the encrypted data:

    $ tar c newdir


Method 1 produces a backup that may be considered fragile: one big encrypted file. If part of the backup gets corrupted, you might be unable to decrypt any of it.

Method 2 avoids this problem. The cp -l option creates hard links, which can only be used within a single filesystem. If you want the encrypted files on a separate filesystem, use symbolic links instead:

$ cp -sr /full/path/to/mydir newdir
$ find newdir -type l -exec gpg -e '{}' \; -exec rm '{}' \;

Note that a full, absolute pathname must be used for the original directory in this case.

gpg does not preserve the owner, group, permissions, or modification times of the files. To retain this information in your backups, copy the attributes from the original files to the encrypted files, before the links to the original files are deleted:

# find newdir -type f -exec gpg -e '{}' \; \
                      -exec chown --reference='{}' '{}.gpg' \;
                      -exec chmod --reference='{}' '{}.gpg' \;
                      -exec touch --reference='{}' '{}.gpg' \;
                          -exec rm '{}' \;

Method 2 and the CD-ROM variant of method 1 use disk space (at least temporarily) for the encrypted files.

See Also

gpg(1), tar(1), find(1), cdrecord(1).

Pages: 1, 2, 3

Next Pagearrow

Linux Online Certification

Linux/Unix System Administration Certificate Series
Linux/Unix System Administration Certificate Series — This course series targets both beginning and intermediate Linux/Unix users who want to acquire advanced system administration skills, and to back those skills up with a Certificate from the University of Illinois Office of Continuing Education.

Enroll today!

Linux Resources
  • Linux Online
  • The Linux FAQ
  • Linux Kernel Archives
  • Kernel Traffic

  • Sponsored by: