Sure, you could use PGP/GPG to encrypt the files, either using your own personal public key (then you only remember your personal key's passphrase) or using -c
conventional encryption only with a passphrase for the file you have to remember.
Then copy the encrypted files to wherever for backups.
Or, you could use a tool like TrueCrypt (though it's no longer officially supported) or dm-crypt/LUKS to create a big encrypted container file, put your files inside it, and copy the whole container to wherever.
Or, you could use an encrypted filesystem like EncFS to encrypt a local folder into a shared OneDrive (or other service) folder. The local files can remain un-encrypted, while the online copy/folder would be encrypted.
Deleting the local files is an option (after verifying the online copies can be decrypted), but for a good backup strategy you should keep a local copy somewhere/somehow just in case the online copy has problems, or the passphrase is lost, etc...
- How-To Geek on How to Encrypt Cloud Storage on Linux and Windows with EncFS
- encfs4win - "experimental project of porting encfs to the Windows world"
Super ArchWiki EncFS page - very good info on using EncFS. Linux-oriented, but if the EncFS port for windows works it should be useable too.
Here's the best backup feature of EncFS (IMO) - it can do a "--reverse
" mount, using a plain folder to create a "virtual" encrypted copy, without writing a single byte to your hard drive. Then the "virtual" encrypted files can be sent to the cloud (or any backup location) and you just need the encrypted options file (encfs6.xml, keeping it with the backup files would work) and passphrase to read them. Here's some pasted info:
Backup plaintext directory
The following example assumes you want to create an encrypted backup of an existing plaintext directory ~/mythesis
which contains the file thesis.txt
.
First, we create the encrypted backup of the existing plaintext directory:
$ encfs --reverse ~/mythesis /tmp/thesisbackup
Note the directory order is reversed to normal usage in this case. Using the --reverse
option has two effects: Firstly, the configuration file is now stored in the plaintext directory and /tmp/thesisbackup
only contains it in encrypted form. Secondly, the files in /tmp/thesisbackup
are not persistent. They will vanish once it is unmounted (no, this is not due to usage of the /tmp
mountpoint).
For the second reason, now is the time to copy the encrypted files to the desired backup location, before unmounting the temporary encfs directory again:
$ cp -R /tmp/thesisbackup/* /mnt/usbstick/
$ fusermount -u /tmp/thesisbackup
and done.
To restore (or view) the backup, we need access to the encryption options in plaintext, which has to be passed to encfs with the environment variable ENCFS6_CONFIG (we use a different directory in order not to mess up the existing ~/mythesis):
$ ENCFS6_CONFIG=~/mythesis/.encfs6.xml ~/mnt/usbstick/thesisbackup ~/restoremythesis
I'm not sure about a fully automated solution to backup scattered folders, encrypt and upload and delete the originals all at once, that wasn't part of the question when I originally answered. A web search would probably find some programs that have automated encrypted cloud backups, if you trust the companies / cloud storage, but the point of DIY encryption is usually so you will be the only person in the who has the key.
If I were to try it myself, I'd probably write a short BASH script to mount an EncFS folder online, copy backup files to it, and unmount when it was done syncing. To add incremental backups would need date checking and/or file hashes, comparing to find new/changed/deleted files, and only copying the appropriate files, but that tends to explode the complexity of the process.
While searching for .encfs6.xml I did find a program that might make the "automatic" part a little easier on Windows:
Boxcryptor, a cross-platform program (Win, Mac, iOS, Android, Google Chrome, but NO linux...) that works with about 25 different storage providers (including Microsoft OneDrive) that apparently uses EncFS (it uses a .encfs6.xml
file) and RSA keys also. I haven't used it (no linux) and aren't very familiar with it, there's a free basic version, but here's a little info from the "What is Boxcryptor" page:
Boxcryptor supports all major cloud storage providers (such as Dropbox, Google Drive, Microsoft OneDrive, SugarSync) and supports all the clouds that use the WebDAV standard (such as Cubby, Strato HiDrive, and ownCloud).
Boxcryptor creates a virtual drive on your computer that allows you to encrypt your files locally before uploading them to your cloud or clouds of choice. It encrypts individual files - and does not create containers. Any file dropped into an encrypted folder within the Boxcryptor drive will get automatically encrypted before it is synced to the cloud.
It's "Technical Overview" pages have some details, here's something on "How Boxcryptor is zero-knowledge":
Boxcryptor is a zero-knowledge service provider because any private and sensitive information that we receive from the users will always be in the encrypted form protected by the user’s password - which is never transferred to us or anyone. Only public keys are in plain text.