How to encrypt files and backups

Backups often contain sensitive data. If you store them off the server, encryption makes them useless to anyone without the password.

Encrypt a file with GPG

gpg -c backup.tar.gz

You get backup.tar.gz.gpg, protected with a password. Decrypt:

gpg backup.tar.gz.gpg

Encrypt during the backup

mysqldump -u root -p app_db | gzip | gpg -c > app_db.sql.gz.gpg

The data is encrypted before it touches the disk, useful when sending a backup to a Backup Box.

Key-based encryption (no interactive password)

For automated scripts, use a GPG public key instead of a password:

gpg --encrypt --recipient [email protected] backup.tar.gz

Important rules

• Keep the password or private key separate from the backups; without it, the data is lost permanently.
• Test decryption periodically, a backup that cannot be decrypted is worthless.
• Combine with automated backups with cron.