I would like to download some files from my server into my laptop, and the thing is that I want this communication to be as stealth and secure as it can be. So, far I came up using VPN, in that way I redirect the whole internet traffic of my laptop via my server. Additionally, I tried to send a file using ftp and observing Wireshark at the same time. The communication seems to be encrypted, however I would like also to encrypt the file itself (as a 2nd step security or something like that).

My server is a RasPi running Raspbian. My laptop is Macbook Air.

I want firstly to encrypt a file in my Ras Pi and secondly download it. How can I do that?

  • 1
    gpg can encrypt files, either asymmetrically (using a public key for encryption and a private key for decryption) or symmetrically (using the same key/password for encryption and decryption: dewinter.com/gnupg_howto/english/GPGMiniHowto.html – Martin von Wittich Oct 19 '14 at 9:54
  • Why not use a protocol such as HTTPS, SFTP or FTPS? If the communication is encrypted, adding a second layer of encryption won't gain you anything. – Gilles 'SO- stop being evil' Oct 19 '14 at 13:07

You can use openssl to encrypt and decrypt using key based symmetric ciphers. For example:

openssl enc -in foo.bar \
    -aes-256-cbc \
    -pass stdin > foo.bar.enc

This encrypts foo.bar to foo.bar.enc (you can use the -out switch to specify the output file, instead of redirecting stdout as above) using a 256 bit AES cipher in CBC mode. There are various other ciphers available (see man enc). The command will then wait for you to enter a password and use that to generate an appropriate key. You can see the key with -p or use your own in place of a password with -K (actually it is slightly more complicated than that since an initialization vector or source is needed, see man enc again). If you use a password, you can use the same password to decrypt, you do not need to look at or keep the generated key.

To decrypt this:

openssl enc -in foo.bar.enc \
    -d -aes-256-cbc \
    -pass stdin > foo.bar

Notice the -d. See also man openssl.

  • Also, you can output the result to a file using the option -out FILENAME rather than piping in the output. – crazyGuy Nov 14 '17 at 10:25

For one-off cases you can encrypt using zip and a password. While not as strong as key based techniques (because it is hard to have a good password) it is probably fine ad-hoc situations.

Command line looks like this:

zip -r -0 -e encrypted_file.zip /path/to/files

-r to recurse directories.
-e to encrypt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.