A robust Bash shell script designed to automate the secure archival, encryption, and management of a user-specified directory. It uses industry-standard tools to create a password-protected, encrypted archive, serving as a reliable method for securing data at rest.
🔒 Secure Encryption: Utilizes the powerful AES-256-CBC algorithm to encrypt the archived directory.
📁 Efficient Archival: Employs the tar command to create a single, compressed archive of a directory and all its contents.
🛡️ Passphrase Protection: Uses PBKDF2 with 200,000 iterations to derive a secure cryptographic key from a user-provided passphrase, making it highly resistant to brute-force attacks.
📝 Automated Documentation: Automatically generates a README file with all necessary decryption instructions for traceability.
The script follows a clear, sequential logic for secure archival and encryption.
The script first creates a single, compressed archive of the target directory. It uses tar with the -c (create), -z (compress with gzip), and -f (file) flags. The -C flag is used to change the working directory to the parent of the target directory, a best practice that ensures the archive is created without including the full, absolute path of the directory.
This is the security core of the script. The openssl enc command is used for symmetric encryption. The -aes-256-cbc flag specifies a strong encryption algorithm, and -pbkdf2 -iter 200000 applies a robust key derivation function to the user's passphrase, significantly strengthening it against attacks. A random -salt is also generated and embedded to protect against pre-computation attacks.
A crucial security step is the secure cleanup of the original data. The rm -rf command is used to recursively and forcefully remove both the original directory and the unencrypted .tar.gz archive. This ensures that only the encrypted .locked file remains, preventing any sensitive data from being left on the system in an unencrypted state.
The final step is to generate a README file with instructions for decryption and extraction. The cat <<EOF (Heredoc) syntax is used to create this multi-line document. The README provides the exact openssl and tar commands required to reverse the process, including placeholders for the user's passphrase.
- This script requires
opensslandtarto be installed on your system.
- Save the script: Save the code to a file (e.g.,
lock-vault.sh). - Make it executable:
chmod +x lock-vault.sh
- Run the script:
./lock-vault.sh
- Follow the prompts: The script will then prompt you to enter the directory name and your passphrase.
After running the script, a new file (e.g., <your_directory>.locked) and a README file will be generated. The README will look like this:
🔐 Encrypted Vault: <your_directory>.locked
This vault was encrypted using AES-256-CBC with PBKDF2 and a custom passphrase.
To unlock:
1. Run the following command:
openssl enc -d -aes-256-cbc -pbkdf2 -iter 200000 -salt \
-in <your_directory>.locked -out <your_directory>.tar.gz -pass pass:[your_passphrase]
2. Extract the archive:
tar -xzf <your_directory>.tar.gz
📄 Metadata:
- Original directory: <your_directory>
- Encryption method: AES-256-CBC
- Iterations: 200000
- Salt: embedded in encrypted file
- IV: auto-generated and embedded
⚠️ Keep your passphrase safe. Without it, the vault cannot be decrypted.
This tool is designed to be expanded. Potential enhancements include:
- Error Handling: Add more robust error handling for user inputs and command failures.
- GUI Interface: Develop a simple graphical user interface (GUI) to make the tool more accessible to non-technical users.
- Platform Specificity: Add checks to ensure the script is being run on a compatible operating system.
- Multiple Hashing Algorithms: Include options for different encryption algorithms or hash functions.
This project is licensed under the Apache License, Version 2.0. See the LICENSE file for details.
Angelo Ayton - Security Systems Architect
Contributions, issues, and feature requests are welcome! Feel free to check the issues page.
Copyright 2025 Angelo Ayton