How to Encrypt Files, Folders and Disks on Linux

How to Encrypt Files Using OpenSSL on Linux

To encrypt files on Linux using OpenSSL, we will apply the following recommended options for strong security:

• -aes-256-cbc: Uses the AES algorithm with a 256-bit key in Cipher Block Chaining (CBC) mode for robust encryption.
• -pbkdf2: Employs the PBKDF2 algorithm to derive a secure key from the password, enhancing resistance to brute-force attacks.
• -iter 200000: Specifies 200,000 iterations for PBKDF2, increasing the computational cost of brute-force attempts.
• -md sha256: Uses SHA-256 as the hashing algorithm for key derivation, ensuring secure key generation.
• -salt: Adds a random salt to protect against rainbow table attacks.

🔐 Example: encrypting secrets.txt into secrets.txt.enc:

user@host:~$ openssl enc -aes-256-cbc -pbkdf2 -iter 200000 -md sha256 -salt -in secrets.txt -out secrets.txt.enc
enter AES-256-CBC encryption password:JohnWeakP@sswd:)
Verifying - enter AES-256-CBC encryption password:JohnWeakP@sswd:)

🔓 Example: decrypting secrets.txt.enc back to secrets.txt:

user@host:~$ openssl enc -d -aes-256-cbc -pbkdf2 -iter 200000 -md sha256 -salt -in secrets.txt.enc -out secrets.txt
enter AES-256-CBC decryption password:JohnWeakP@sswd:)

How to Encrypt Files Using GnuPG on Linux

Another way to encrypt files on Linux is by using GnuPG with a symmetric cipher:

• --symmetric: Encrypts with a symmetric cipher using a passphrase.
• --s2k-cipher-algo AES256: Sets AES-256 as the symmetric encryption algorithm.
• --s2k-digest-algo SHA512: Uses SHA-512 as the digest algorithm for key derivation.
• --s2k-count 65536: Applies 65,536 iterations to strengthen the passphrase against brute-force attacks.

🔐 Example: encrypt the file secrets.txt into secrets.txt.gpg:

user@host:~$ gpg --symmetric --s2k-cipher-algo AES256 --s2k-digest-algo SHA512 --s2k-count 65536 -o secrets.txt.gpg secrets.txt

🔓 Example: decrypt secrets.txt.gpg back into secrets.txt:

user@host:~$ gpg --output secrets.txt --decrypt secrets.txt.gpg

How to Create and Initialize an Encrypted File Container on Linux

The first step is to create an encrypted container on Linux using dd. A container is simply a regular file that will later be formatted and mounted as a virtual disk.

• In this example, we create a file named container in the root directory (/container). Its size is 1 GiB and it is filled with random data to ensure security:

root@host:~# dd if=/dev/urandom of=/container bs=1M count=1024 iflag=fullblock status=progress

Next, we need to set up a loop device. A loop device on Linux allows us to map a regular file (such as our container) to a virtual block device, making it behave like a real disk.

• Check the first available loop device:

root@host:~# losetup -f

• Map the container file to the /dev/loop0 loop device:

root@host:~# losetup /dev/loop0 /container

• Install the cryptsetup package, which provides the LUKS encryption tools:

root@host:~# apt update && apt install cryptsetup

• Format the loop device with LUKS to initialize encryption:

root@host:~# cryptsetup luksFormat /dev/loop0
WARNING!
========
This will overwrite data on /dev/loop0 irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /container:JohnWeakP@sswd:)
Verify passphrase:JohnWeakP@sswd:)

• Open (decrypt) the loop device with LUKS and map it to a virtual device named decrypted_container:

root@host:~# cryptsetup luksOpen /dev/loop0 decrypted_container
Enter passphrase for /container:JohnWeakP@sswd:)

• Format the new container with the file system of your choice (here ext4):

root@host:~# mkfs.ext4 /dev/mapper/decrypted_container

• When finished, close the LUKS device and detach the loop device:

root@host:~# cryptsetup luksClose /dev/mapper/decrypted_container

root@host:~# losetup -d /dev/loop0

Your encrypted container is now successfully created, formatted, and ready for use on Linux.

How to Mount the Encrypted Container and Copy Files on Linux

Now let’s see how to mount and use the encrypted container we created earlier.

• Check the first available loop device:

root@host:~# losetup -f

• Map the container file to the /dev/loop0 loop device:

root@host:~# losetup /dev/loop0 /container

• Unlock the loop device with LUKS and map it to decrypted_container:

root@host:~# cryptsetup luksOpen /dev/loop0 decrypted_container
Enter passphrase for /container:JohnWeakP@sswd:)

• Mount the decrypted container to /mnt/container:

root@host:~# mkdir -p /mnt/container; mount /dev/mapper/decrypted_container /mnt/container

• You can now use /mnt/container like any mounted device. For example, copy a file into it:

root@host:~# cp file.txt /mnt/container/