Encrypt sensitive data using SSL and Docker

For 1,000 reasons or more, you want to encrypt a file containing text. Which software should you install? Well ... none other than Docker!

By using a Docker Alpine/OpenSSL image, it's so easy to encrypt/decrypt files using OpenSSL.

Linux scripts

Create a new file on your disk with this content. This is the encrypt.sh script.

#!/usr/bin/env bash

(
  MY_PASSWORD="ThisIsMyLongPasswordNobodyWillBeAbleToCrackIt" &&
  docker run --rm -it -v $(pwd):/data -w /data -u $(id -u):$(id -g) alpine/openssl enc -aes-256-cbc -salt -pbkdf2 -a -in /data/secrets.md -out /data/secrets_encrypted.md -k ${MY_PASSWORD}
)

And this is the decrypt.sh script:

#!/usr/bin/env bash

(
  MY_PASSWORD="ThisIsMyLongPasswordNobodyWillBeAbleToCrackIt" &&
  docker run --rm -it -v $(pwd):/data -w /data -u $(id -u):$(id -g) alpine/openssl enc -aes-256-cbc -salt -pbkdf2 -a -d -in /data/secrets_encrypted.md -out //data/secrets_decrypted.md -k ${MY_PASSWORD}
)

Update the MY_PASSWORD variable in both scripts to use yours.

DOS scripts

For the illustration purpose, the DOS encryption script, encrypt.cmd, will ask you for a password (since the -k parameter is not part of the instruction). If the encrypted file has been created, the original one will be removed from your disk.

Here is the content of the encrypt.cmd DOS script:

@echo off

cls

docker run --rm -it -v %CD%:/data -w /data alpine/openssl enc -aes-256-cbc -salt -pbkdf2 -a -in /data/secrets.md -out /data/secrets.encrypted

# Put this part in comment if you want to keep the original, unencrypted, file.
IF EXIST secrets.encrypted (
  del secrets.md
)

The decryption script, decrypt.cmd will ask you for the password and will display the decrypted content on the console (since the -out parameter is not part of the instruction).

Here is the content of the decrypt.cmd DOS script:

@echo off

cls

docker run --rm -it -v C:\temp:/data -w /data alpine/openssl enc -aes-256-cbc -salt -pbkdf2 -a -d -in /data/secrets.encrypted

Use case

In addition to simple encryption need, one use case is to store confidential files in online systems, e.g. a versioning system such as Github, or on cloud disks (e.g. Google drive).

Command line arguments

The openssl enc command accepts those arguments:

Option	Description
enc	Encoding with Ciphers
-aes-256-cbc	The encryption cipher to be used
-salt	Adds strength to the encryption
-pbkdf2	Generate a PBKDF2 key derivation of a supplied password
-a	Encrypted data should be in Base64 and not binary
-d	Decrypt action (if -d is missing, action is encryt)
-in	Specifies the input file
-out	Specifies the output file
-k	Provide the password to use

Decrypt on the console, don't write a file

Edit the decrypt.sh (or decrypt.cmd) script and search for -out /data/secrets_decrypted.md. Remove that part.

Now, when you'll run decrypt.sh the decrypted content will be displayed on the console only, nothing will be written on the disk. Your secrets are safe.

Example

Imagine a text file like secrets.md with this content:

# My password

## My secret site

### FTP server

* Name: `127.0.0.1`
* Login: `admin`
* Password: `admin`

### Admin interface

* URL: `https://..../admin`
* Login: `admin`
* Password: `admin`

By running the encrypt.sh script, the file secrets_encrypted.md will be created on your disk and will have this content:

U2FsdGVkX18jyyHAiaDcwolgvrCmB9SutNFhOFosDZvYA+t/8F5PWsxU+YIb0xLj
/0swl1Mvh9XBcg3FwpQn5CGm5ltb3zKiExPO8WoTuYOmlJj2PN5eLJv3GWVVJ8/t
q31xBBAlbI0k+a3pWiETl1qEmh4hwc4jeC5NOByYSAojiIdCNF0W5+VVkUlBeKGb
sv8tpDWEb/dgHrfFPtZD5MqeNQw71/ndORZC1ZDIT/Ju6O7a6rd9ph0aQuPz49PU
SzDUePUgn9wbR0tZvNM1JA1LkN1kDaguJ940TdKns+Q=

From now, you can remove secrets.md since you've the encrypted version.

To retrieve the original content, just run the decrypt.sh script.

By running that command (or by running decrypt.sh), you'll decrypt the file secrets_encrypted.md and get a newer one called secrets_decrypted.md.