mass file encryption not working with openssl

Question

I have bunch of log files which I am trying to encrypt with public/private key using openssl and save to my NAS but it is failing.

My log files are in the following path :

/var/SYSLOGS/hosts/archive

My public key and private key are in /etc/log-enc/

[root@NAG01 log-enc]# ls -l
total 8
-rw-r--r-- 1 root root 891 Jul 11 15:58 syslog_privalye_key.pem
-rw-r--r-- 1 root root 272 Jul 11 15:59 syslog_public_key.pem

Now I am trying to execute following command If I am executing the same command one by one, then there is no issue.

for file in `find /var/SYSLOGS/hosts/archive/`
do  
FILE_BASE=$(basename $file)
echo "$file=>/NFS/Nag01/syslogs/hosts/$FILE_BASE.enc"
openssl rsautl -encrypt -inkey  /etc/log-enc/syslog_public_key.pem -pubin -in $file -out /NFS/Nag01/syslogs/hosts/$FILE_BASE.enc
done

Here are the error logs

RSA operation error
140628568049480:error:0406D06E:rsa routines:RSA_padding_add_PKCS1_type_2:data too large for key size:rsa_pk1.c:151:
/var/SYSLOGS/hosts/archive/192.168.33.5.log-20160131.gz=>/NFS/Nag01/syslogs/hosts/192.168.33.5.log-20160131.gz.enc
RSA operation error
140123978278728:error:0406D06E:rsa routines:RSA_padding_add_PKCS1_type_2:data too large for key size:rsa_pk1.c:151:
/var/SYSLOGS/hosts/archive/app02.log-20160306.gz=>/NFS/Nag01/syslogs/hosts/app02.log-20160306.gz.enc
/var/SYSLOGS/hosts/archive/192.168.34.8.log-20160227.gz=>/NFS/Nag01/syslogs/hosts/192.168.34.8.log-20160227.gz.enc
RSA operation error
139777258493768:error:0406D06E:rsa routines:RSA_padding_add_PKCS1_type_2:data too large for key size:rsa_pk1.c:151:
/var/SYSLOGS/hosts/archive/192.168.31.3.log-20160511.gz=>/NFS/Nag01/syslogs/hosts/192.168.31.3.log-20160511.gz.enc

Here are the raw files.

[root@NAG01 log-enc]# ls -l /var/SYSLOGS/hosts/archive/192.168.33.5.log-20160131.gz
-rw-------. 1 root root 3569 Jan 31 04:16 /var/SYSLOGS/hosts/archive/192.168.33.5.log-20160131.gz
[root@NAG01 log-enc]# ls -l /var/SYSLOGS/hosts/archive/192.168.34.8.log-20160227.gz
-rw-------. 1 root root 2142 Feb 27 03:11 /var/SYSLOGS/hosts/archive/192.168.34.8.log-20160227.gz

Answer 1

This worked for me.

First create the keys

openssl req -x509 -nodes -newkey rsa:2048 -keyout private-key.pem -out public-key.pem

then the same loop

for file in `find /var/SYSLOGS/hosts/archive/`
do 
FILE_BASE=$(basename $file)
echo "$file=>/NFS/Nag01/syslogs/hosts/$FILE_BASE.enc"
openssl smime -encrypt -binary -aes-256-cbc -in  $file -out /NFS/Nag01/syslogs/hosts/$FILE_BASE.enc -outform DER public-key.pem

done

Answer 2

Don't use openssl to encrypt files. It's not designed for this. (openssl isn't really designed for anything.) You're just fumbling in the dark. In the tiger's cage.

GnuPG is designed precisely to encrypt files. Install it from your distribution. Use gpg --gen-key to generate a new key. The keys are stored in ~/.gnupg. Use gpg --export to export a public key from an account, gpg --export-secret-keys to export a secret key, and gpg --import to import it on another acccount.

To encrypt a file, use gpg -e /path/to/file. To decrypt, use gpg /path/to/file.gpg.

---

Don't parse the output of find, use find … -exec …. And always use double quotes around variable and command substitutions. Maybe your files don't have special characters now, but using double quotes can't cause any harm and will save you from a security breach one day.

Your script is also broken in other ways, such as attempting to encrypt directories, causing spurious errors. From the look of your script, it looks like you don't expect to find subdirectories in /var/SYSLOGS/hosts/archive/, in which case you don't need find.

cd /var/SYSLOGS/hosts/archive/ &&
for x in *; do
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$x.gpg" "$x"
done

If there are subdirectories:

cd /var/SYSLOGS/hosts/archive/ &&
find . -type f -exec sh -c '
  mkdir -p "${0%/*}" &&
  gpg -e -o "/NFS/Nag01/syslogs/hosts/$0.gpg" "$0"
'