Linux Tips

How to Create an Encrypted Compressed Backup in Linux

- by John Britto - Leave a Comment - 2 min read
Quick Linux Tip #83:

Question: How do I create an encrypted compressed backup in Linux?

Try: tar -czf - /home/linuxteck/documents | openssl enc -aes-256-cbc -pbkdf2 -out backup.tar.gz.enc

Info: tar -czf - writes the compressed archive directly to standard output. Piping it to openssl enc encrypts the archive on the fly, so the unencrypted backup does not need to be stored as a temporary file on disk.

Examples:

  • $ mysqldump db | gzip | openssl enc -aes-256-cbc -pbkdf2 -out db.sql.gz.enc  # Encrypt database dumps
  • $ tar -czf - /data | ssh remote 'cat > backup.tar.gz'  # Stream compressed archive over SSH
  • $ gpg --symmetric --cipher-algo AES256 backup.tar.gz  # Symmetric encryption alternative with GPG

Note: Direct streaming eliminates temporary archive files, saving disk space and reducing exposure of unencrypted backup data. Use -pbkdf2 with OpenSSL for password-based key derivation. Keep the encryption password securely stored because it is required to restore the backup.




LinuxTeck.com 
linuxteck:~$ tar -czf - /home/linuxteck/documents | openssl enc -aes-256-cbc -pbkdf2 -out backup.tar.gz.enc
enter aes-256-cbc encryption password:
Verifying - enter aes-256-cbc encryption password:

linuxteck:~$ ls -lh backup.tar.gz.enc
-rw-r--r-- 1 linuxteck linuxteck 234M Oct 03 10:23 backup.tar.gz.enc

linuxteck:~$ openssl enc -d -aes-256-cbc -pbkdf2 -in backup.tar.gz.enc | tar -xz -C /restore
linuxteck:~$

PREVIOUS ARTICLE Quick Linux Tip #82: How to Preserve File Timestamps with Rsync on Linux NEXT ARTICLE Quick Linux Tip #84: Perf Trace: Analyze System Calls on Linux
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.