I wrote this script but it doesn't work since ba.tar not yet created.

#! /bin/bash
crontab -l|sed "\$a00 23 * * 5 tar cvf /var/backups/ba.tar /home/$USER"|crontab -
openssl aes-128-cbc -salt -in /var/backups/ba.tar -out /var/backups/ba.tar.aes -k 1416
rm /var/backups/ba.tar

How can I encrypt ba.tar?

  • What about using && to ensure the firs crontab is done before the next runs! Dec 4, 2017 at 17:24
  • how ? i try this crontab -l|sed "\$a00 23 * * 5 tar cvf /var/backups/ba.tar /home/alhanouf | openssl aes-128-cbc -salt -in /var/backups/ba.tar -out /var/backups/ba.tar.aes -k 1416 "|crontab - but it does not work too Dec 4, 2017 at 17:37
  • 1
    What is your sed command trying to do?
    – terdon
    Dec 6, 2017 at 10:15
  • I suppose you want to Add lines to cron from script.
    – dessert
    Dec 6, 2017 at 10:37

1 Answer 1


OpenSSL is somewhat bad for this purpose, first and foremost you would have to give the command a passphrase to be able to decrypt your backed up data afterwards. This password could been read in the log-files then and is only advised where security is not a concern, which is I assume your concern to have the archives packed securely. So my advise is to use GPG for encryption. You can use like done in the commands below gpg(which is actually GPG2 on newer Ubuntu installations) or gpg2 (which needs to installed first on older Ubuntu installations; simply change below command to gpg2). See as well Key generation: Differences between GnuPG classic, stable, modern?.

To do that you need to create a gpg key first with the following command:

gpg --gen-key

You will then be prompted for your 'Real name' which can be any name and for your email address (best using a single name without spaces; see below how this output looks like). Then you will be asked if your given information is correct which you should confirm with 'o' if it is.

$ gpg --gen-key
gpg (GnuPG) 2.1.15; Copyright (C) 2016 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Note: Use "gpg --full-gen-key" for a full featured key generation dialog.

GnuPG needs to construct a user ID to identify your key.

Real name: Videonauth
Email address: [email protected]
You selected this USER-ID:
    "Videonauth <[email protected]>"

Change (N)ame, (E)mail, or (O)kay/(Q)uit? o

After this you will be prompted to give a password to protect the key by a GUI dialog where you have to enter the password twice to make sure it is correct. You should remember that password since its the only way to get your files decrypted later on.

The output goes on like this:

We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key 338E09237C58EFA0 marked as ultimately trusted
gpg: revocation certificate stored as '/home/videonauth/.gnupg/openpgp-revocs.d/891E441008DE443C53B44AB2338E09237C58EFA0.rev'
public and secret key created and signed.

pub   rsa2048 2017-12-06 [SC]
uid                      Videonauth <[email protected]>
sub   rsa2048 2017-12-06 [E]

Now it is a good idea to backup your newly created key into a file which you should store on an USB-Stick which you can keep in a drawer etc. so you have access to this key in case you need to setup a new system and want to import your key. The following commands will create a backup of your keys and important bits which then can be found in ~/Download.

  1. Create an general revocation certificate:

    # generate a copy of the revoke certificate
    # you need the key ID for this which you can find in
    # the before output. In this example this would be
    # 891E441008DE443C53B44AB2338E09237C58EFA0
    gpg -o ~/Download/key-revocation-cert.asc --gen-revoke 891E441008DE443C53B44AB2338E09237C58EFA0

    This will give you the following dialog which I filled out to give an example:

    $ gpg -o ~/Download/key-revocation-cert.asc --gen-revoke 891E441008DE443C53B44AB2338E09237C58EFA0 
    sec  rsa2048/338E09237C58EFA0 2017-12-06 Videonauth <[email protected]>
    Create a revocation certificate for this key? (y/N) y
    Please select the reason for the revocation:
      0 = No reason specified
      1 = Key has been compromised
      2 = Key is superseded
      3 = Key is no longer used
      Q = Cancel
    (Probably you want to select 1 here)
    Your decision? 0
    Enter an optional description; end it with an empty line:
    > Example Reason
    Reason for revocation: No reason specified
    Example Reason
    Is this okay? (y/N) y
    ASCII armored output forced.
    Revocation certificate created.
    Please move it to a medium which you can hide away; if Mallory gets
    access to this certificate he can use it to make your key unusable.
    It is smart to print this certificate and store it away, just in case
    your media become unreadable.  But have some caution:  The print system of
    your machine might store the data and make it available to others!
  2. Create a copy of your public key:

    # This will create a copy of your public key
    gpg -o ~/Download/key-public.gpg --export 891E441008DE443C53B44AB2338E09237C58EFA0
  3. Create a copy of your private key:

    # This will create a copy of your private key
    gpg -o ~/Download/key-private.gpg --export-secret-keys 891E441008DE443C53B44AB2338E09237C58EFA0

To use gpg with your public key you need to import the public key file on your server:

gpg --import key-public.gpg

Let's start with creating a proper line first and testing encrypting and decrypting to make sure a decrypt will work before you put it into crontab or scripts. With all of the above out of the way you can now generate directly encrypted archives with the following command (you need to change the username accordingly to the 'Real Name' you have created your key with).

tar -cv <directory-to-archive> | gpg -e -r Videonauth -o backup.tar.gpg

This creates an encrypted file without ever creating an unencrypted file beforehand, to decrypt it you need to put the file on your machine where you have the private key in your keyring and do the following:

gpg -d backup.tar.gpg | tar -xv

You will be prompted for your key password which you should supply and this unpacks the backup.tar.gpg file on your hdd.

Of course this can as well used to create compressed tar archives if you want to do that, just change the tar commands in the above lines accordingly. For further reading see man gpg and man tar.

You can put those commands directly into your crontab or creating scripts for them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .