Im Forum haben wir oft User, die Dateien verschlüsseln wollen, ohne gleich die gesamte Freigabe der Diskstation ebenfalls zu verschlüsseln. Wenn man nur einzelne Dateien verschlüsseln will, dann wäre auch eine Lösung wie TrueCrypt der eigentliche Overkill.

Zum Glück gibt es openssl, welches ebenfalls Files verschlüsseln kann. Das kann man direkt auf der Kommandozeile verwenden. Weil die Synthax etwas umfangreich ist und man immer relativ viel tippen muss, habe ich mir dieses kleine Script geschrieben. Es handelt sich dabei um ein kleines Bashscript (k.A. obs auch mit anderen Shells funzt). Das Script nimmt die Aktion (verschlüsseln/entschlüsseln), den Algorithmus und das File für die Aktion entgegen.

Wichtig: Nach dem Verschlüsseln der Datei wird diese über die Originaldatei geschrieben d.h. es existiert danach nur noch die verschlüsselte Version der Datei!

#!/bin/bash
 
#Define vars for commandline args
ACTION=''
FILE=''
CIPHER=''
 
#Read args from cli
while (( $# ))
do
 case "$1" in
  'dec-write' | 'enc' | 'dec-disp' | 'dec' )
   ACTION="$1"
   shift
  ;;
  '-f' | '--file')
   shift
   FILE="$1"
   shift
  ;;
  '-d' | '--digest')
   shift
   DIGEST="$1"
   shift
  ;;
  '-c' | '--cipher')
   shift
   CIPHER="$1"
   shift
  ;;
  *)
   echo ""
   echo "Usage: crypt.sh  dec-write|dec-disp|enc -f|--file /path/to/FILE [-d|--digest digest_to_use] [-c|--cipher cipher_to_use]"
   echo "Order of arguments is not important!"
   echo "enc        : encrypts a file"
   echo "dec-disp   : decrypts a file to a temp file, display its unencrypted content and deletes the temp file"
   echo "dec-write  : decrypts a file and copy the unencrypted file back to its origin in the filesystem"
   echo "-f|--file  : file to perform ACTION on"
   echo "-c|--cipher: cipher to use for ACTION. See <openssl ciphers> command for ciphers supported on your system"
   echo "-d|--digest: digest to use for hashing the password and creating/verifying a checksum of the of the unencrypted content"
   echo ""
   exit
 esac
done
 
#Checks for args given by user
[ -z "$FILE" ] && echo 'FATAL_ERROR: No FILE given' && exit 1
[[ "x$FILE" != x  && ! -f "$FILE" ]] && echo "FATAL_ERROR: Given FILE not found. Check $FILE" && exit 1
[ -z "$ACTION" ] && echo 'FATAL_ERROR: No ACTION given' && exit 1
[ -z "$CIPHER" ] && echo 'INFO: No CIPHER given <blowfish> will be used' && CIPHER='blowfish'
[[ "$CIPHER" != 'blowfish' && -z "$(openssl ciphers | grep -v 'grep' | grep -i '\-'${CIPHER}'\-')" ]] && echo "INFO: $CIPHER not found. <blowfish> will be used" && CIPHER='blowfish'
[ -z "$DIGEST" ] && echo 'INFO: No digest given. <sha256> will be used instead' && DIGEST='sha256'
 
if [ -n "$DIGEST" ] ; then
 case $DIGEST in
  md|md5|sha1|sha256|sha224|sha512|md4)
 ;;
 *)
  echo 'INFO: No or a non-valid DIGEST given <sha1> will be used' && DIGEST='sha1'
 ;;
 esac
fi
#Generate "random" string for temp FILENAME
FILENAME=$(basename "$FILE")
FILENAME=$(echo "$FILENAME" | md5sum | awk '{print $1}')
FILENAME=".${FILENAME:4:16}"
 
case $ACTION in
 'enc')
  openssl dgst -${DIGEST} -out "${FILE}.hash" "$FILE" > /dev/null 2>&1
  openssl enc -in "$FILE" -out "/tmp/$FILENAME" -e -md "${DIGEST}" -"${CIPHER}" > /dev/null 2>&1
  [ $? -eq 0 ] && mv "/tmp/$FILENAME" "$FILE" && exit 0
  echo 'FATAL_ERROR: File could not be encrypted. Check your parameters!' && rm "/tmp/$FILENAME" > /dev/null 2>&1 && exit 1
  ;;
 'dec-disp' | 'dec')
  openssl enc -in "$FILE" -out "/tmp/$FILENAME" -d -md "${DIGEST}" -"${CIPHER}" > /dev/null 2>&1
  [ $? -ne 0 ] && echo "FATAL_ERROR: Wrong password and/or wrong algorithm provided and/or $FILE is not encrypted at all!" && exit 1
  [ "$(openssl dgst -$DIGEST /tmp/$FILENAME 2>/dev/null | awk -F'= ' '{print $2}')" = "$(cat ${FILE}.hash | awk -F'= ' '{print $2}')" ]
  if [ $? -ne 0 ] ; then
   echo "WARNING: File decrypted but hashes do NOT match. File is possibly compromised!!"
  else
   echo "INFO: File decrypted and hashes DO match"
  fi
  [ -f "/tmp/$FILENAME" ] && cat "/tmp/$FILENAME" && rm "/tmp/$FILENAME" > /dev/null 2>&1 && exit 0
 ;;
 'dec-write')
  openssl enc -in "$FILE" -out "/tmp/$FILENAME" -d -md "${DIGEST}" -"${CIPHER}" 2>/dev/null
  [ $? -ne 0 ] && echo "FATAL_ERROR: Wrong password and/or wrong algorithm provided and/or $FILE is not encrypted at all!" && exit 1
  [ "$(openssl dgst -$DIGEST /tmp/$FILENAME 2>/dev/null | awk -F'= ' '{print $2}')" = "$(cat ${FILE}.hash | awk -F'= ' '{print $2}')" ]
  if [ $? -ne 0 ] ; then
   echo "WARNING: File decrypted but hashes do NOT match. File is possibly compromised!!"
  else
   echo "INFO: File decrypted and hashes DO match"
  fi
  [ -f "/tmp/$FILENAME" ] && mv "/tmp/$FILENAME" "$FILE" > /dev/null 2>&1 && exit 0
 ;;
esac