To encrypt and decrypt files with a password, use gpg command. It is an encryption and signing tool for Linux/UNIX like operating system such as FreeBSD/Solaris.
GnuPG stands for GNU Privacy Guard and is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility.
Encrypting a file in linux
To encrypt single file, use command gpg as follows:
$ gpg -c filename
To encrypt myfinancial.info file, type the command:
$ gpg -c myfinancial.info
Output:
Enter passphrase:<YOUR-PASSWORD> Repeat passphrase:<YOUR-PASSWORD>
This will create a myfinancial.info.gpg file.
Option:
- -c : Encrypt with symmetric cipher.
Caution if you ever forgot your password aka passphrase, you cannot recover the data as it use very strong encryption.
Task: decrypt file
To decrypt file use gpg command:
$ gpg myfinancial.info.gpg
Output:
gpg myfinancial.info.gpg gpg: CAST5 encrypted data Enter passphrase:<YOUR-PASSWORD>
Decrypt file and write output to file vivek.info.txt you can run command:
$ gpg myfinancial.info.gpg –o vivek.info.txt
Remember if file extension is .asc, it is a ASCII encrypted file and if file extension is .gpg, it is a binary encrypted file.
See also:
- GnuPG Frequently Asked Questions
- Consult man page of gpg
Featured Articles:
- 20 Linux System Monitoring Tools Every SysAdmin Should Know
- 20 Linux Server Hardening Security Tips
- Linux: 20 Iptables Examples For New SysAdmins
- My 10 UNIX Command Line Mistakes
- 25 PHP Security Best Practices For Sys Admins
- The Novice Guide To Buying A Linux Laptop
- Top 5 Email Client For Linux, Mac OS X, and Windows Users
- Top 20 OpenSSH Server Best Security Practices
- Top 10 Open Source Web-Based Project Management Software
Facebook it - Tweet it - Print it -
We're here to help you make the most of sysadmin work. So, subscribe!
{ 27 comments… read them below or add one }
Thanks! This helped me a lot. Encryption everywhere seems to be only about e-mail. I just wanted to encrypt a password file.
This came very handy…and is now bookmarked! Thanks.
This is fine as far as it goes. However, if you decrypt a file and look at it using a word processor (say), the word processor might well leave back-up copies of your sensitive file in /tmp or in a back-up directory. So when you delete your unencrypted file, you have to delete any other copies that might be lying around the filing system too. A better way around this problem might be to use whole partition encryption: http://encryptionhowto.sourceforge.net/Encryption-HOWTO-4.html
But even then, you need to watch out for stuff that may be on a different disk/partition, e.g. in /tmp.
David,
Good point about backup files. Thanks for sharing howto links.
Appreciate your post!
Great post.
I need to encript a backup file in non interactive mode, so I do not have a prompt to type the password, because is a automated script.
Do you have how I can proceed?
Tkx in advance.
Sirs,
can i encrypt squid.conf or httpd.conf that are located on /etc/xxx folder… knowing that squid process and apache process need to access this file in order to read the file configuration! if this is not workable in my case… is there a way to hide the .conf files from even the root users.. please your help is highly appreciated…
greetings from lebanon
Regards,
i want to encrypt/hide .conf. your help is highly appreciated…
thank for help I want to decrypt rar files
1) Unless the app is aware of the encryption , you cannot encrypt such .conf files.
2) It is possibles to write a script that wraps the process , i.e squid and call the gpg , decrypt the file and then call the squid , reencrypt the file , delete the .conf …
It is actually bound to how the process calls his conf files ,i.e at the beginning , in the loop …
3) You can even recompile squid with some crypting lib. and change all calls to read file to be proceeded by a decryption function.
4) No body but the root should have the root pass , other users must be in specific groups that enable them to do some stuff that normally only the root can do and hence avoid giving them the root pass.
I thought, even if you encrypt a backup script, it will still run as it is.
But it’s not.
I just want to hide the backup script form others because it contains critical information about the files being backed up.
Jay: I think you will need to create a new backup script that decrypts and reads an encrypted file containing the critical information about the files being backed up.
The information about the files will be protected, and the script should still run normally.
It’s very nice stuff … encryption and decryption in linux and tell me how to set password for each file and folder under linux.
A good post nixcraft, but I have a doubt, how linux encrypts? I mean in a navite level, without use particular apps or tools… thx
Non interactive encrypt/decrypt:-
Encrypt it…
gpg –yes –passphrase [passphrase] -c [filename]
Decrypt it…
gpg –yes –passphrase [passphrase] [filename]
Piece of pie…
This was a life saver.
So I thought this would help, but unfortunately it didn’t. I’m wondering why. Also, when I do a “gpg -h”, “–passphrase” doesn’t show up as one of the options. Is this like a secret option or something?
Hi,
You must to use the follow commands:
gpg –batch –yes –passphrase [passphrase] -c [filename]
Bye,
where would you check if the passphrase is entered correctly or not? If I want to encrypt a binary file to enter the correct password before someone can run my program, where do I implement the passphrase check? In the binary file or in my program?
Thank u very much
Sirs
I need to encrypt folder with it’s content with out need to encrypt all files inside this folder please your help.
your help is highly appreciated
Best Regard
Hai,…
I want to encrypt squashfs.img(squashfs.img.enc) file in Fedora Live OS. It should be decrypted while booting.. Can anyone knows how to do this?
For Gnome if you prefer the right click option install “seahorse-plugins” from synaptic or apt-get install, if you’re a KDE user you can install kgpg, both options allow key generating and management alone with right click encrypt options. If you prefer the GUI option that is.
That’s very interesting. I like it.
Hi,
I have encryted the file in windows machine but when i trying to dycrypt from linux using gpg filename it is not encrypting .the eror come has
gpg: encrypted with RSA key, ID 83994B4A
gpg: decryption failed: secret key not available
When i am use the command gpg -d also same eroro
Thanks
pavan
Hi,
You must to use the follow commands:
gpg –batch –yes –passphrase [passphrase] -c [filename]
Bye,
Its not working
Hi,
Is there any difference between .gpg and .pgp files. I have a pgp encrypted file and a key. Can anyone please let me know how to decrypt it through PHP or shell command? Thanks in advance.
Regards,
N Naresh Kumar