You can use the fuse filesystem encfs to do this simply. Install rpm
fuse-encfs or apt package
encfs and use
encfs --reverse to mount an encrypted version of any directory, eg
/tmp/mycleardata, at a new point, eg
/tmp/crypt-view. Backup this directory in your usual way, and then unmount the fuse filesystem. You also need to backup the
.encfs6.xml that will have been added to your original directory, and remember the password you used when
encfs asked you for one. When you want to update the backup, do the same commands. This will re-use the
.encfs6.xml file and need the same password.
Here's an example script to play with. Obviously, normally you do not provide the password inline, and you do not normally destroy the
# create some test data directory
mkdir -p /tmp/mycleardata/dira
date > /tmp/mycleardata/dira/filea
date > /tmp/mycleardata/fileb
# mount an encrypted view. encfs asks for a config (blank line) and pw
mkdir -p /tmp/crypt-view
if [ -f /tmp/mycleardata/.encfs6.xml ]
then encfs --stdinpass --reverse /tmp/mycleardata /tmp/crypt-view <<\!
else encfs --stdinpass --reverse /tmp/mycleardata /tmp/crypt-view <<\!
# show files, do a backup
ls -ltRA /tmp/mycleardata/
ls -ltR /tmp/crypt-view
rsync -a /tmp/crypt-view/ /tmp/mybackup
# remove the crypted view
fusermount -u /tmp/crypt-view
ls -ltR /tmp/mybackup
# restore from backup. use encfs to mount backup and show clear view
mkdir -p /tmp/newclear
ENCFS6_CONFIG=/tmp/mycleardata/.encfs6.xml encfs --stdinpass /tmp/mybackup /tmp/newclear <<\!
ls -ltR /tmp/newclear # should be same as original dir
fusermount -u /tmp/newclear # remove clear view
Here's an example of the resulting filenames:
-rw-r--r-- 1 meuh 30 May 14 17:40 42eg5KinDst09lDzN4YNRAIG
-rw-r--r-- 1 meuh 1264 May 14 17:32 bj5Su3csNAALZEAJEB,CazsC
drwxr-xr-x 2 meuh 60 May 14 17:18 sJzZa,U7Oeyfq2j8tfeLqkm,
-rw-r--r-- 1 meuh 30 May 14 17:40 q-c1AOYzAcy06HJ8klCZewsD
Note this security message from the encfs package installation:
According to a security audit by Taylor Hornby (Defuse Security), the
current implementation of Encfs is vulnerable or potentially vulnerable
to multiple types of attacks. For example, an attacker with read/write
access to encrypted data might lower the decryption complexity for
subsequently encrypted data without this being noticed by a legitimate
user, or might use timing analysis to deduce information.
Until these issues are resolved, encfs should not be considered a safe
home for sensitive data in scenarios where such attacks are possible.
You might also look at ecryptfs, which can optionally encrypt filenames, and duplicity which encrypts rsync.