Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a script which creates a nightly backup of several directories.

It is created using tar -czf, and the destination tar.gz file path is on a mounted network directory. The resulting file is about 1.2Gb large.

The network speed is reasonably fast (copying from the network drive to the local occurs at ~28MB/sec).

Now I want to use public-key encryption to encrypt the tar.gz file before transferring it to the network drive, and would like to know what the best way to do so is.

Should I create the file locally first, encrypt it, and then copy over? Or is there a way to "stream" tar output through an encryption process, and write the results directly to the network drive?

share|improve this question

Pack your_dir in a encrypted archive your_archive.tgz.gpg (symmetric encryption):

tar -cz your_dir | gpg -c -o your_archive.tgz.gpg

Unpack it:

gpg -d your_archive.tgz.gpg | tar xz

See the docs of GPG for how to use asymmetric instead of symmetric encryption.

share|improve this answer
Using GPG seems creates keys in the user home holder, and prompts for a passphrase. Basically, the process seems to be too opaque for my taste… – Joel L Jan 17 '12 at 15:22
Should tar xz in the second set of commands be tar -xz instead? – Kenny Evitt May 29 at 20:58
@KennyEvitt: You can use it with or without the - – Florian Diesch May 30 at 0:23
up vote 6 down vote accepted

The following process encrypts the file on local disk first, and can then be sent over the network (or stored however needed)

First, generate public and private keys (done only once):

openssl genrsa -out key.pem 2048
openssl rsa -in key.pem -out key-public.pem -outform PEM -pubout

Then, at each backup:

  1. Generate long random passphrase, save in file

    • echo -n "Tl4R6dnvWXiDeXr1LtpCNkyLG1" > key.txt
  2. encrypt file with passphase

    • openssl enc -aes-256-cbc -pass file:key.txt < UNENCRYPTED_FILE > encrypted.dat
  3. encrypt passphrase with public key

    • openssl rsautl -encrypt -pubin -inkey key-public.pem < key.txt > enc.key.txt

Then save encrypted.dat AND enc.key.txt where desired.

To decrypt:

  1. Decrypt encrypted passphrase with private key

    • openssl rsautl -decrypt -inkey key.pem < enc.key.txt > key.txt
  2. Decrypt file

    • openssl enc -aes-256-cbc -d -pass file:key.txt < encrypted.dat > UNENCRYPTED_FILE

This is a lot longer than Florian's anwser, but I decided to use it so I can better understand the process, and not depend on server-dependent GPG configuration variables, etc. I also couldn't find any useful GPG documentation.

share|improve this answer
Random passphrase can also be created easily with openssl like so openssl rand 32 -out key.txt – Wolfgang Dec 27 '13 at 8:23
@Wolfgang — I'm actually generating the passphase from a python script (that runs the backup process), but thanks for the tip! – Joel L Dec 27 '13 at 11:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.