I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server.
A form of PK encryption seems ideal for this, as I can store the public key on the server, and the private key somewhere else private (like on a post-it attached to my monitor, or for real security, under my matress). If I need to restore from backups, I can get the private key out of hiding. At least, so goes the theory...
However, only a small amount of data can be encrypted with an RSA public key, so this needs to be a symmetric key used for the actual encryption, which must be generated at the time of file encryption and stored alongside the backup so I don't have to store this on the server.
Given the above, do the following two simple shell scripts make security sense, and what (if any) existing and proven Open-Source software is available to do something like this?
#!/bin/bash #this is the encryption system used like this: ./crypt.sh publickey.pem mycleartextfile.txt PUBKEY=$1 CLEARTEXT_FILE=$2 SESSION_KEY=`openssl rand 256` echo "$SESSION_KEY" | openssl pkeyutl -encrypt -pubin -inkey "$PUBKEY" -out "$CLEARTEXT_FILE".key echo "$SESSION_KEY" | openssl enc -in "$CLEARTEXT_FILE" -e -blowfish -out "$CLEARTEXT_FILE".openssl -pass stdin
...and the decryption script:
#!/bin/bash #usage ./decrypt privatekey.pem encrypted-file-session.key encrypted-file PRIVATE_KEY=$1 SESSION_KEY_CRYPT=$2 CIPHERTEXT_FILE=$3 openssl pkeyutl -decrypt -inkey "$PRIVATE_KEY" -in "$SESSION_KEY_CRYPT" \ | openssl enc -d -blowfish -in "$CIPHERTEXT_FILE" -out "$CIPHERTEXT_FILE".out -pass stdin
Any thoughts on this are much appreciated.