OpenSSL is somewhat bad for this purpose, first and foremost you would have to give the command a passphrase to be able to decrypt your backed up data afterwards. This password could been read in the log-files then and is only advised where security is not a concern, which is I assume your concern to have the archives packed securely. So my advise is to use GPG for encryption. You can use like done in the commands below
gpg(which is actually GPG2 on newer Ubuntu installations) or
gpg2 (which needs to installed first on older Ubuntu installations; simply change below command to
gpg2). See as well Key generation: Differences between GnuPG classic, stable, modern?.
To do that you need to create a gpg key first with the following command:
You will then be prompted for your 'Real name' which can be any name and for your email address (best using a single name without spaces; see below how this output looks like). Then you will be asked if your given information is correct which you should confirm with 'o' if it is.
$ gpg --gen-key
gpg (GnuPG) 2.1.15; Copyright (C) 2016 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Note: Use "gpg --full-gen-key" for a full featured key generation dialog.
GnuPG needs to construct a user ID to identify your key.
Real name: Videonauth
Email address: [email protected]
You selected this USER-ID:
"Videonauth <[email protected]>"
Change (N)ame, (E)mail, or (O)kay/(Q)uit? o
After this you will be prompted to give a password to protect the key by a GUI dialog where you have to enter the password twice to make sure it is correct. You should remember that password since its the only way to get your files decrypted later on.
The output goes on like this:
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: key 338E09237C58EFA0 marked as ultimately trusted
gpg: revocation certificate stored as '/home/videonauth/.gnupg/openpgp-revocs.d/891E441008DE443C53B44AB2338E09237C58EFA0.rev'
public and secret key created and signed.
pub rsa2048 2017-12-06 [SC]
uid Videonauth <[email protected]>
sub rsa2048 2017-12-06 [E]
Now it is a good idea to backup your newly created key into a file which you should store on an USB-Stick which you can keep in a drawer etc. so you have access to this key in case you need to setup a new system and want to import your key. The following commands will create a backup of your keys and important bits which then can be found in
Create an general revocation certificate:
# generate a copy of the revoke certificate
# you need the key ID for this which you can find in
# the before output. In this example this would be
gpg -o ~/Download/key-revocation-cert.asc --gen-revoke 891E441008DE443C53B44AB2338E09237C58EFA0
This will give you the following dialog which I filled out to give an example:
$ gpg -o ~/Download/key-revocation-cert.asc --gen-revoke 891E441008DE443C53B44AB2338E09237C58EFA0
sec rsa2048/338E09237C58EFA0 2017-12-06 Videonauth <[email protected]>
Create a revocation certificate for this key? (y/N) y
Please select the reason for the revocation:
0 = No reason specified
1 = Key has been compromised
2 = Key is superseded
3 = Key is no longer used
Q = Cancel
(Probably you want to select 1 here)
Your decision? 0
Enter an optional description; end it with an empty line:
> Example Reason
Reason for revocation: No reason specified
Is this okay? (y/N) y
ASCII armored output forced.
Revocation certificate created.
Please move it to a medium which you can hide away; if Mallory gets
access to this certificate he can use it to make your key unusable.
It is smart to print this certificate and store it away, just in case
your media become unreadable. But have some caution: The print system of
your machine might store the data and make it available to others!
Create a copy of your public key:
# This will create a copy of your public key
gpg -o ~/Download/key-public.gpg --export 891E441008DE443C53B44AB2338E09237C58EFA0
Create a copy of your private key:
# This will create a copy of your private key
gpg -o ~/Download/key-private.gpg --export-secret-keys 891E441008DE443C53B44AB2338E09237C58EFA0
To use gpg with your public key you need to import the public key file on your server:
gpg --import key-public.gpg
Let's start with creating a proper line first and testing encrypting and decrypting to make sure a decrypt will work before you put it into crontab or scripts. With all of the above out of the way you can now generate directly encrypted archives with the following command (you need to change the username accordingly to the 'Real Name' you have created your key with).
tar -cv <directory-to-archive> | gpg -e -r Videonauth -o backup.tar.gpg
This creates an encrypted file without ever creating an unencrypted file beforehand, to decrypt it you need to put the file on your machine where you have the private key in your keyring and do the following:
gpg -d backup.tar.gpg | tar -xv
You will be prompted for your key password which you should supply and this unpacks the backup.tar.gpg file on your hdd.
Of course this can as well used to create compressed tar archives if you want to do that, just change the tar commands in the above lines accordingly. For further reading see
man gpg and
You can put those commands directly into your crontab or creating scripts for them.