Skip to main content
replaced http://unix.stackexchange.com/ with https://unix.stackexchange.com/
Source Link

Don't use openssl to encrypt files. It's not designed for this. (openssl isn't really designed for anything.) You're just fumbling in the dark. In the tiger's cage.

GnuPG is designed precisely to encrypt files. Install it from your distribution. Use gpg --gen-key to generate a new key. The keys are stored in ~/.gnupg. Use gpg --export to export a public key from an account, gpg --export-secret-keys to export a secret key, and gpg --import to import it on another acccount.

To encrypt a file, use gpg -e /path/to/file. To decrypt, use gpg /path/to/file.gpg.


Don't parse the output of findDon't parse the output of find, use find … -exec …. And always use double quotes around variable and command substitutions. Maybe your files don't have special characters now, but using double quotes can't cause any harm and will save you from a security breach one day.

Your script is also broken in other ways, such as attempting to encrypt directories, causing spurious errors. From the look of your script, it looks like you don't expect to find subdirectories in /var/SYSLOGS/hosts/archive/, in which case you don't need find.

cd /var/SYSLOGS/hosts/archive/ &&
for x in *; do
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$x.gpg" "$x"
done

If there are subdirectories:

cd /var/SYSLOGS/hosts/archive/ &&
find . -type f -exec sh -c '
  mkdir -p "${0%/*}" &&
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$0.gpg" "$0"
'

Don't use openssl to encrypt files. It's not designed for this. (openssl isn't really designed for anything.) You're just fumbling in the dark. In the tiger's cage.

GnuPG is designed precisely to encrypt files. Install it from your distribution. Use gpg --gen-key to generate a new key. The keys are stored in ~/.gnupg. Use gpg --export to export a public key from an account, gpg --export-secret-keys to export a secret key, and gpg --import to import it on another acccount.

To encrypt a file, use gpg -e /path/to/file. To decrypt, use gpg /path/to/file.gpg.


Don't parse the output of find, use find … -exec …. And always use double quotes around variable and command substitutions. Maybe your files don't have special characters now, but using double quotes can't cause any harm and will save you from a security breach one day.

Your script is also broken in other ways, such as attempting to encrypt directories, causing spurious errors. From the look of your script, it looks like you don't expect to find subdirectories in /var/SYSLOGS/hosts/archive/, in which case you don't need find.

cd /var/SYSLOGS/hosts/archive/ &&
for x in *; do
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$x.gpg" "$x"
done

If there are subdirectories:

cd /var/SYSLOGS/hosts/archive/ &&
find . -type f -exec sh -c '
  mkdir -p "${0%/*}" &&
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$0.gpg" "$0"
'

Don't use openssl to encrypt files. It's not designed for this. (openssl isn't really designed for anything.) You're just fumbling in the dark. In the tiger's cage.

GnuPG is designed precisely to encrypt files. Install it from your distribution. Use gpg --gen-key to generate a new key. The keys are stored in ~/.gnupg. Use gpg --export to export a public key from an account, gpg --export-secret-keys to export a secret key, and gpg --import to import it on another acccount.

To encrypt a file, use gpg -e /path/to/file. To decrypt, use gpg /path/to/file.gpg.


Don't parse the output of find, use find … -exec …. And always use double quotes around variable and command substitutions. Maybe your files don't have special characters now, but using double quotes can't cause any harm and will save you from a security breach one day.

Your script is also broken in other ways, such as attempting to encrypt directories, causing spurious errors. From the look of your script, it looks like you don't expect to find subdirectories in /var/SYSLOGS/hosts/archive/, in which case you don't need find.

cd /var/SYSLOGS/hosts/archive/ &&
for x in *; do
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$x.gpg" "$x"
done

If there are subdirectories:

cd /var/SYSLOGS/hosts/archive/ &&
find . -type f -exec sh -c '
  mkdir -p "${0%/*}" &&
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$0.gpg" "$0"
'
Source Link
Gilles 'SO- stop being evil'
  • 865.3k
  • 205
  • 1.8k
  • 2.3k

Don't use openssl to encrypt files. It's not designed for this. (openssl isn't really designed for anything.) You're just fumbling in the dark. In the tiger's cage.

GnuPG is designed precisely to encrypt files. Install it from your distribution. Use gpg --gen-key to generate a new key. The keys are stored in ~/.gnupg. Use gpg --export to export a public key from an account, gpg --export-secret-keys to export a secret key, and gpg --import to import it on another acccount.

To encrypt a file, use gpg -e /path/to/file. To decrypt, use gpg /path/to/file.gpg.


Don't parse the output of find, use find … -exec …. And always use double quotes around variable and command substitutions. Maybe your files don't have special characters now, but using double quotes can't cause any harm and will save you from a security breach one day.

Your script is also broken in other ways, such as attempting to encrypt directories, causing spurious errors. From the look of your script, it looks like you don't expect to find subdirectories in /var/SYSLOGS/hosts/archive/, in which case you don't need find.

cd /var/SYSLOGS/hosts/archive/ &&
for x in *; do
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$x.gpg" "$x"
done

If there are subdirectories:

cd /var/SYSLOGS/hosts/archive/ &&
find . -type f -exec sh -c '
  mkdir -p "${0%/*}" &&
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$0.gpg" "$0"
'