Encrypt an existing (important point) directory

Question

I'd like to encrypt an existing directory. I know there exists a software like cryptkeeper which could do such thins, but it doesn't allow to encrypt existing folder. With that software, we have to create one encrypt directory and put the existing directory in the new one. Could anyone be able to explain a clever way to do that from the shell or with an adapted software?

In fact, I'd like this file to be encrypted to protect it as much as possible (e.g., NSA). If I send this file to another user in other country, I want this file to be protected from hacker.

P.S. This file is very important. I work on a project since many years, and I want anyone could access this file.

Thanks in advance!

Answer 1

Use gpg. First, have the recipient of the files do:

gpg --gen-key

and follow the prompts to generate a 4096-bit RSA key. Then have the recipient do:

gpg --armor --export (name)

where name is the name given for the key in the first step. Then send the output of the command to you. Then you do:

gpg --armor --import

and paste in the key. For increased security, do:

gpg --list-keys --fingerprint

and confirm the fingerprint with the recipient by phone (the public key does not need to be sent confidentially, but it does need to not have been tampered with). Then, to encrypt a file for sending, do:

gpg --encrypt --recipient (name) <file.clear >file.encrypted

To make a single file out of a directory tree, use tar:

tar -f file.clear -C /path/to/directory -c .

You don't need to compress the tar file, as gpg does its own compression. The recipient can use gpg --decrypt to decrypt and then tar -x to unpack the tar file.

Answer 2

There are several ways to transfer safely folders and files over the Internet. Of course, whenever you put some archive on someone else's disk you run the risk that the space is «jeopardized», i.e. that it has been somehow hacked. That's why the best (but absolutely useless by today standards) method would be to keep your files at home, on a good safe vault. So, you have to compromise. This means that you have to take extra cautions to avoid mistakes.

I'd suggest the following procedures. They have advantages and disadvantages. In any case it is a good practice to employ strong passwords.

First option

Owncloud or Nextcloud. At this stage they are pretty similar, as Nextcloud is a recent fork from mid-2016. If you choose to use either of them, you will have to set your own server (which is best), or you can hire a shared hosting service, or even a VPS. As an admin, be sure to enable both the encryption module as well as the server side encryption. If some has access to the file within the server they will only see the file name but the content will be useless. You can share files or directories. Ubuntu has an official owncloud client to sync.

Second option

Seafile offers the option to encrypt a folder, but in this case you can only share the whole folder. You will have to register with them to download and install your own server. It seems easier to pay their service.

Third option

If you don't plan to share frequently, you can always compress a folder, encrypt it and send it, provided that it is not that large.

First, install seahorse-nautilus. Then, quit and restart Nautilus. You can now compress and encrypt. Your receiver must know the password: use Telegram's Secure Chat or some other private communication service.