I'm working on an automated backup solution to protect my files on my Linux servers. However, I'm not sure about how to securely encrypt the resulting archives. I am using 64bit linux, and I am looking for a solution that would have a separate key/password for each individual archive backed up.

I've seen solutions such as:

  1. Using TrueCrypt to create a small container for the individual archive
  2. Creating a luks?/dmcrypt volume and just putting everything in there

How would I do this where each backup copy would have its individual key/key files? I'm looking for a solution that where all of the private keys would not be exposed on the machine being backed up? [I.e. I have a key file, and it has a generated keyfile just for that backup]

3 Answers 3


First of all, I wouldn't recommend using disk encryption tools for this particular purpose as they are optimized for (surprise) hard disk encryption:


It is possible that some implementations can adjust themselves for "simple" file encryption, I suggest to consult the appropriate documentation about this matter.

If you don't want to expose your decryption key in any way to the machine to be backed up (that sounds like a good design decision) an obvious solution is using hybrid crypto-systems. An obvious choice would be OpenSSL that is easily scriptable as described here:


  • Hard drive encryption would be a bad situation for this since it just puts everything in the same treasure chest. I just need the setup to work so that if one backup is compromised then the other backups are still safe.
    – monksy
    Jul 1, 2013 at 18:20

You should consider GPG or PGP as an option. GPG should work find on the command line or embedded in a script and all you need on your computer is the public half of the key-pair. The private half (the decryption key) can be kept offline on a USB thumb-drive or on another system.

When you use GPG to encrypt a file it will create a new symmetric key, use that to encrypt the data and then use the public key to encrypt the symmetric key. If you run the same gpg command to encrypt your backup file every day, each file will have it's own unique encryption key.


Both LUKs and TrueCrypt are Disk Encryption mechanisms. It is really hard to create a unique passwords even you use loop drives. Automation will also be hard in practice use. This is what I suggest which can done bash script with following steps.

  1. Do the back up Step 2: Key you need to GPG generate key pair.
  2. Automation key generation can be found here Unattended key generation
  3. Do the gpg encryption with passing the public key as parameter.
  4. SCP the private key to secure location and securely delete it from server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .