How to Encrypt and Decrypt Files and Directories Using Tar and OpenSSL

To encrypt and decrypt files and directories using tar and OpenSSL, follow these steps. This method combines archiving with tar and encryption/decryption with OpenSSL’s enc utility.

Encrypt a File or Directory

Step 1: Archive the Directory (Optional)

If encrypting a directory, first bundle it into a single .tar file:

tar -cvf mydata.tar /path/to/directory_or_files

Replace /path/to/directory_or_files with the actual directory or files you want to encrypt.

More Read

How to Install Node.js on Linux

How to Schedule a Command on Particular Time in Linux

How to Cut Sections of Line in File

How to Remove a Directory and File in Linux Using ‘rm’ Command

Step 2: Encrypt with OpenSSL

Use OpenSSL to encrypt the file (or .tar archive) with a strong algorithm like AES-256-CBC:

openssl enc -aes-256-cbc -salt -in mydata.tar -out mydata.tar.enc

• -aes-256-cbc: The encryption algorithm (you can also use -aes-256-gcm for authenticated encryption).
• -salt: Adds security against rainbow-table attacks (enabled by default in newer OpenSSL versions).
• -in: Input file (e.g., mydata.tar or a single file like document.txt).
• -out: Encrypted output file (e.g., mydata.tar.enc).

You’ll be prompted to enter and confirm a password. Keep this password safe!

Decrypt a File or Directory

Step 1: Decrypt with OpenSSL

Decrypt the encrypted file using the same algorithm:

openssl enc -aes-256-cbc -d -in mydata.tar.enc -out mydata.tar

• -d: Flag for decryption.
• Enter the password used during encryption.

Step 2: Extract the Tar Archive (If Applicable)

If the decrypted file is a .tar archive, extract it:

tar -xvf mydata.tar

Optional: Streamline the Process (Compress + Encrypt)

Combine compression (e.g., gzip/bzip2) with encryption in one command:

tar -czvf - /path/to/directory | openssl enc -aes-256-cbc -salt -out mydata.tar.gz.enc

To decrypt and extract:

openssl enc -aes-256-cbc -d -in mydata.tar.gz.enc | tar -xzvf -

Important Notes

1. Password Security:

• Use a strong password. If you forget it, the data is permanently lost.
• Avoid using -pass pass:password in commands, as it exposes the password in your shell history.

1. File Extensions:

• The .enc extension is optional but helps identify encrypted files.

1. Algorithm Options:

• Use aes-256-gcm for both encryption and integrity verification.
• List supported algorithms with openssl list -cipher-commands.

1. Automation:

• For scripting, use -pass file:password.txt to read passwords from a file (secure the file with chmod 600).

Example Workflow

Encrypt a Directory

# Archive and encrypt
tar -cvf mydata.tar ~/Documents && openssl enc -aes-256-cbc -salt -in mydata.tar -out mydata.tar.enc

# Delete the original tar file (optional)
shred -u mydata.tar

Decrypt and Extract

# Decrypt
openssl enc -aes-256-cbc -d -in mydata.tar.enc -out mydata.tar

# Extract
tar -xvf mydata.tar

# Clean up decrypted tar file
shred -u mydata.tar

SSL/TLS Certificate Management

Generate a Self-Signed SSL Certificate

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

• Creates a self-signed certificate (cert.pem) and private key (key.pem) valid for 365 days.

Create a Certificate Signing Request (CSR)

openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr

• Generates a CSR (domain.csr) and private key (domain.key) for submitting to a Certificate Authority (CA).

Convert Certificate Formats

# PEM to DER
openssl x509 -in cert.pem -outform der -out cert.der

# DER to PEM
openssl x509 -in cert.der -inform der -out cert.pem

Encryption & Decryption

Encrypt a File with AES-256

openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc

• Prompts for a password to encrypt file.txt.

Decrypt a File

openssl enc -d -aes-256-cbc -in file.txt.enc -out file.txt

Hashing & Data Integrity

Generate a SHA-256 Hash of a File

openssl sha256 file.txt

Verify File Integrity

openssl sha256 -c file.txt

Password Hashing

Create a Password Hash

openssl passwd -6 "mypassword"

• -6 uses SHA-512 (replace with -1 for MD5 or -5 for SHA-256).

Network Testing

Test SSL/TLS Connection to a Server

openssl s_client -connect example.com:443 -servername example.com

• Checks SSL certificate validity, cipher suites, and connection details.

Generate Random Data

Create a Random Password or Key

openssl rand -base64 32

• Generates a 32-byte (256-bit) random Base64 string.

Verify Certificates

Check Certificate Expiry

openssl x509 -in cert.pem -noout -dates

View Certificate Details

openssl x509 -in cert.pem -text -noout

Create Diffie-Hellman Parameters

openssl dhparam -out dhparams.pem 2048

• Generates 2048-bit Diffie-Hellman parameters for secure key exchange (used in HTTPS servers).

PKCS#12 Keystores

Bundle Certificates for Browsers/Servers

openssl pkcs12 -export -out bundle.p12 -inkey key.pem -in cert.pem -certfile ca-chain.pem

• Creates a PKCS#12 file (bundle.p12) for importing into browsers or servers.

Benchmarking

Test Encryption Speed

openssl speed aes-256-cbc

• Benchmarks the performance of cryptographic algorithms.

Security Best Practices

1. Avoid Weak Algorithms: Prefer aes-256-gcm, SHA-256/512, and RSA-2048+.
2. Password Safety: Never hardcode passwords in scripts (use -pass file:password.txt instead).
3. Permissions: Secure private keys with chmod 600 key.pem.
4. Certificate Validation: Always verify certificates with openssl verify.

Summary

OpenSSL is indispensable for:

• Managing SSL/TLS certificates.
• Encrypting sensitive data.
• Generating cryptographic keys/hashes.
• Troubleshooting SSL connections.
• Converting certificate formats.
• Ensuring data integrity and security.

Use it to secure web servers, automate encryption workflows, or debug HTTPS issues in Linux environments.