0

Is it possible to encrypt a file as it downloads? Security is #1 concern, so what I am after is a way that once the file is completely downloaded and moved to an encrypted drive (not directly downloading to encrypted drive due to security) the file will be irrecoverable on the system it was downloaded on due to the encryption.

Is this possible in Ubuntu?

  • Are these arbitrary files? Are they coming from a server you control? Easy way is to simply encrypt them before downloading... – crovers Oct 5 '16 at 17:49
  • @crovers - they are not coming from a server I control. They are coming from a vendor server, who will not allow encryption, but on our end we want them encrypted. – BellHopByDayAmetuerCoderByNigh Oct 5 '16 at 17:51
  • What is the attack vector you are concerned about? Other users on the same machine? Someone accessing the hard drive of the computer via another boot medium and finding the file in its download or temp directory? – crovers Oct 5 '16 at 17:54
  • @crovers - Accessing the hard drive via another boot medium. – BellHopByDayAmetuerCoderByNigh Oct 5 '16 at 17:55
  • 2
    If you don't want to use your main encrypted filesystem, why not add a second encrypted file system just for the downloads, then move it to your main one when you are happy? – crovers Oct 5 '16 at 17:56
-1

The most fast method that comes to mind:

  • download it
  • move it to the encrypted disk (command: mv /dir_download/file /dir_destination/file )
  • securely delete the original file (command: srm -l filename )

Even do it automatically every time something is downloaded.

downsides: secure delete is slow, it overwrite the original file multiple times and with the option "-f" or "-l" you can change that number.

Install it on ubuntu:

apt-get install secure-delete

Another way could be to encrypt also the 1 disk (or create another encrypted partition)

  • 1
    Why not just download files directly to the encrypted disk? – Samuel Shifterovich Oct 5 '16 at 18:34
  • I have no idea, question just says 'not directly downloading to encrypted drive due to security'. – Mirko Conti Oct 5 '16 at 18:37
  • 1
    "Due to security" – Samuel Shifterovich Oct 5 '16 at 18:48
1

To encrypt a file as it gets downloaded, store it in an encrypted drive.

The requirement “not directly downloading to encrypted drive due to security” is meaningless since downloading to an encrypted drive is not a security risk. It needs to be either clarified or ignored.

If there is a requirement not to download directly to a certain location because that location should only contain valid, complete files, then download to a different directory on the same encrypted drive first, then validate the fully downloaded file, and if valid move the file to the final location. In this scenario, the intermediate staging location on the encrypted drive is necessary anyway because if the intermediate staging location was outside the drive then it would be impossible to guarantee that the final location only contained valid files, since during a copy it would contain a partial file.

If there is a requirement that files that are being downloaded but not validated do not risk filling the encrypted drive, then apply a size limit to the download.

0

I'm struggling to imagine the real world application for this, but...

How are you "downloading"? Would this be driven by a user or triggered from code? What protocol (http[s], ftp, sftp, scp, rcp, smb....)?

Where does the encrypted drive figure? If the drive is not mounted you can't read or write to it. If the system doesn't know the encyption key it can't mount the drive. There is no such thing as a write only filesystem.

You can ancrypt the file on the device in such a way that the device cannot retrieve the plain text.

Assuming its simply http without relying a cookie based session,then

  • you can use curl or wget to copy the file to a ram disk,
  • then use a public key (gpg or openssl) to create an encrypted file on non-volatile storage,
  • Shred the plain text copy on the ram disk

The plain text can be recovered using the private key (which is stored elsewhere).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.