Labels

Aws (32) MySQL (20) Aurora (12) Rds (7) DynamoDB (6) Cloudformation (4) Python3 (4) Unix (3) MongoDB (1)

Thursday, 8 June 2017

GPG encrypt tool

sdasdadadaGnuPG allows to encrypt and sign your data and communication, features a versatile key management system as well as access modules for all kinds of public key directories. GnuPG, also known as GPG, is a command line tool with features for easy integration with other applications.


Gpg key has a public and private keys. A public kye is usually indentified by a unique code like F25AB507 A private key instead is a text file and it is similar to the ssh private key, this must be kept secret and it is used to decrypt messages.

Exchanging PUBLIC Keys

  • Access to the public an secret keys To communicate with others you must exchange public keys.
    gpg --list-keys gpg --list-secret-keys
  • Exporting a public key The key is exported in a binary format, GnuPG therefore supports a command-line option --armor[2] that causes output to be generated in an ASCII-armored format similar to uuencoded documents.
    gpg --output mario.public.gpg --export tom@tom.org --armor
  • Import public key
    gpg --import mario.public.gpg gpg --list-keys
  • Delete public key
    gpg --delete-secret-keys F25AB506

Private Key

to export a private key:
gpg --export-secret-key -a "User Name" > private.key
to delete an private key (a key on your private key ring):
gpg --delete-secret-key "User Name"

Encrypting and decrypting documents

  • Encrypt Docs
  • Don't forget the receipent
    gpg --output doc.gpg --encrypt --recipient tom@tom.org doc.txt
  • Decrypt doc
    gpg --list-private-keys # you must have the private key listed here in order to decrypt the message gpg --output doc.txt --decrypt doc.gpg
    gpg --decrypt doc.gpg | tar -tzvf - tar czvf - . 2>>logfile.log | gpg -r $gpgKey -o /backup/${FILENAME} -e

Example how do an decrypt:

108  gpg --list-secret-keys
106  gpg --import tom.private.key
108  gpg --list-secret-keys
112  gpg --decrypt doc.gpg |  tar -tzvf -
117  gpg --delete-secret-keys F25AB507
118  gpg --list-secret-keys

Change private key metadata

gpg --edit-key tom@tom.org
gpg> uid        # List the uid of the key
  • Add a uuid to the private key
    gpg> adduid Real name: Tom tom Email address: tom@tom.org Comment: own key You selected this USER-ID: "Tom Tom (own key) tom@tom.org"
    Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
    You need a passphrase to unlock the secret key for user: "Tom Tom (This is my first GPG key) tom@tom.org" 2048-bit RSA key, ID E14CE65A, created 2015-05-15
    pub 2048R/E14CE65A created: 2015-05-15 expires: never usage: SC trust: unknown validity: unknown sub 2048R/AEF0F5C8 created: 2015-05-15 expires: never usage: E [ unknown] (1) Tom Tom1 (pbx key) tom1@tom.org [ unknown] (2). Tom Tom (own key) tom@tom.org
  • Delete a uuid from the private key gpg> deluid 1 You must select at least one user ID.
    gpg> uid
    pub 2048R/E14CE65A created: 2015-05-15 expires: never usage: SC trust: unknown validity: unknown sub 2048R/AEF0F5C8 created: 2015-05-15 expires: never usage: E [ unknown] (1) Tom Tom1 (pbx key) tom1@tom.org [ unknown] (2). Tom Tom (own key) tom@tom.org
    gpg> uid 1
    pub 2048R/E14CE65A created: 2015-05-15 expires: never usage: SC trust: unknown validity: unknown sub 2048R/AEF0F5C8 created: 2015-05-15 expires: never usage: E [ unknown] (1)* Tom Tom1 (pbx key) tom1@tom.org [ unknown] (2). Tom Tom (own key) tom@tom.org
    gpg> deluid Really remove this user ID? (y/N) y
    pub 2048R/E14CE65A created: 2015-05-15 expires: never usage: SC trust: unknown validity: unknown sub 2048R/AEF0F5C8 created: 2015-05-15 expires: never usage: E [ unknown] (1). Tom Tom (own key) tom@tom.org

TAR and GPG

compress and encrypt Mysql data directory

gpgKey=E14CE65A
FILENAME=data_dir.tar.gpg
echo "Start tar and compress of data directory at $(date)" >> logfile.log
cd /var/lib/mysql
rm $(ls -t /backup/????????_backup_DB.tar.gpg | tail -1)
if ! tar czvf - . 2>>logfile.log | gpg -r $gpgKey -o /backup/${FILENAME} -e >> logfile.log 2>&1
then
    echo "ERROR: error during tar/gpg.  Backup failed." >> logfile.log
    SUCCESS=NO
else
    SUCCESS=YES
fi

Encrypt files with multi --recipient

gpg --encrypt --recipient tom@example.com \
              --recipient bob@example.com doc.txt

Docs

Etichette: