File Encryption Management on macOS

Secure sensitive data across your Roundfleet devices using advanced file encryption and decryption techniques. This tutorial covers OpenSSL encryption methods, enterprise key management, security policies, and compliance monitoring for comprehensive data protection.

Understanding File Encryption on macOS

File encryption protects sensitive data by converting it into an unreadable format that can only be accessed with the correct decryption key. While macOS offers FileVault for full-disk encryption, selective file encryption provides granular control over specific documents and data files.

Key Encryption Methods

DES (Data Encryption Standard) - Legacy encryption for basic protection
AES-256-CBC - Advanced Encryption Standard with 256-bit keys
AES-256-GCM - AES with Galois/Counter Mode for authenticated encryption
ChaCha20-Poly1305 - Modern stream cipher with authentication
RSA - Public-key encryption for key exchange and digital signatures

Basic File Encryption

Simple File Encryption

#!/bin/bash

# Basic file encryption using OpenSSL
INPUT_FILE="/path/to/original.txt"
OUTPUT_FILE="/path/to/encrypted.txt"
PASSWORD="your_secure_password"

openssl des -in "$INPUT_FILE" -out "$OUTPUT_FILE" -k "$PASSWORD"

echo "File encrypted successfully: $OUTPUT_FILE"

Enhanced File Encryption

#!/bin/bash

# Enhanced file encryption with validation
encrypt_file() {
    local input_file="$1"
    local output_file="$2"
    local password="$3"
    local algorithm="${4:-aes-256-cbc}"
    
    # Validate input parameters
    if [[ -z "$input_file" ]] || [[ -z "$output_file" ]] || [[ -z "$password" ]]; then
        echo "❌ Error: Missing required parameters"
        echo "Usage: encrypt_file <input_file> <output_file> <password> [algorithm]"
        return 1
    fi
    
    # Check if input file exists
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Error: Input file does not exist: $input_file"
        return 1
    fi
    
    # Create output directory if it doesn't exist
    local output_dir
    output_dir=$(dirname "$output_file")
    mkdir -p "$output_dir"
    
    echo "🔒 Encrypting file with $algorithm..."
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    
    # Perform encryption
    if openssl "$algorithm" -in "$input_file" -out "$output_file" -k "$password" 2>/dev/null; then
        echo "✅ File encrypted successfully"
        
        # Verify encrypted file was created
        if [[ -f "$output_file" ]]; then
            local file_size
            file_size=$(stat -f%z "$output_file" 2>/dev/null || echo "0")
            echo "  Encrypted file size: ${file_size} bytes"
        fi
        
        return 0
    else
        echo "❌ Encryption failed"
        return 1
    fi
}

# Usage examples
encrypt_file "/Users/john/Documents/sensitive.txt" "/Users/john/Encrypted/sensitive.enc" "mypassword123" "aes-256-cbc"

AES-256 Strong Encryption

#!/bin/bash

# Advanced AES-256-CBC encryption with salt
encrypt_file_aes256() {
    local input_file="$1"
    local output_file="$2"
    local password="$3"
    
    echo "🔐 Performing AES-256-CBC encryption..."
    
    # Use AES-256-CBC with salt for enhanced security
    if openssl aes-256-cbc -salt -in "$input_file" -out "$output_file" -k "$password"; then
        echo "✅ AES-256 encryption completed"
        
        # Generate file hash for integrity verification
        local hash
        hash=$(shasum -a 256 "$output_file" | cut -d' ' -f1)
        echo "  File hash (SHA-256): $hash"
        
        # Save hash for verification
        echo "$hash" > "${output_file}.sha256"
        echo "  Hash saved to: ${output_file}.sha256"
        
        return 0
    else
        echo "❌ AES-256 encryption failed"
        return 1
    fi
}

# Example usage
encrypt_file_aes256 "/path/to/document.pdf" "/path/to/document.pdf.enc" "strong_password_123!"

File Decryption

Basic File Decryption

#!/bin/bash

# Basic file decryption using OpenSSL
INPUT_FILE="/path/to/encrypted.txt"
OUTPUT_FILE="/path/to/decrypted.txt"
PASSWORD="your_secure_password"

openssl des -d -in "$INPUT_FILE" -out "$OUTPUT_FILE" -k "$PASSWORD"

echo "File decrypted successfully: $OUTPUT_FILE"

Advanced File Decryption

#!/bin/bash

# Advanced file decryption with verification
decrypt_file() {
    local input_file="$1"
    local output_file="$2"
    local password="$3"
    local algorithm="${4:-aes-256-cbc}"
    
    # Validate parameters
    if [[ -z "$input_file" ]] || [[ -z "$output_file" ]] || [[ -z "$password" ]]; then
        echo "❌ Error: Missing required parameters"
        echo "Usage: decrypt_file <input_file> <output_file> <password> [algorithm]"
        return 1
    fi
    
    # Check if encrypted file exists
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Error: Encrypted file does not exist: $input_file"
        return 1
    fi
    
    echo "🔓 Decrypting file with $algorithm..."
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    
    # Create output directory
    local output_dir
    output_dir=$(dirname "$output_file")
    mkdir -p "$output_dir"
    
    # Perform decryption
    if openssl "$algorithm" -d -in "$input_file" -out "$output_file" -k "$password" 2>/dev/null; then
        echo "✅ File decrypted successfully"
        
        # Verify hash if available
        verify_file_integrity "$input_file" "$output_file"
        
        return 0
    else
        echo "❌ Decryption failed - incorrect password or corrupted file"
        return 1
    fi
}

# Verify file integrity
verify_file_integrity() {
    local encrypted_file="$1"
    local decrypted_file="$2"
    local hash_file="${encrypted_file}.sha256"
    
    if [[ -f "$hash_file" ]]; then
        echo "🔍 Verifying file integrity..."
        local stored_hash expected_hash
        stored_hash=$(cat "$hash_file")
        
        # For verification, we need the original file hash (this is a simplified example)
        if [[ -f "$decrypted_file" ]]; then
            echo "  File integrity check completed"
        fi
    fi
}

# Usage example
decrypt_file "/path/to/document.pdf.enc" "/path/to/document_recovered.pdf" "strong_password_123!" "aes-256-cbc"

Batch File Operations

Encrypt Multiple Files

#!/bin/bash

# Batch encrypt multiple files
batch_encrypt() {
    local source_dir="$1"
    local encrypted_dir="$2"
    local password="$3"
    local file_pattern="${4:-*}"
    
    echo "📁 Batch encryption starting..."
    echo "  Source: $source_dir"
    echo "  Target: $encrypted_dir"
    echo "  Pattern: $file_pattern"
    
    # Create encrypted directory
    mkdir -p "$encrypted_dir"
    
    local count=0
    local success=0
    
    # Process files matching pattern
    while IFS= read -r -d '' file; do
        if [[ -f "$file" ]]; then
            local relative_path
            relative_path=$(realpath --relative-to="$source_dir" "$file")
            local encrypted_file="$encrypted_dir/${relative_path}.enc"
            
            # Create subdirectories if needed
            mkdir -p "$(dirname "$encrypted_file")"
            
            echo "  Processing: $relative_path"
            
            if openssl aes-256-cbc -salt -in "$file" -out "$encrypted_file" -k "$password" 2>/dev/null; then
                ((success++))
                echo "    ✅ Encrypted"
            else
                echo "    ❌ Failed"
            fi
            
            ((count++))
        fi
    done < <(find "$source_dir" -name "$file_pattern" -type f -print0)
    
    echo "🎉 Batch encryption completed: $success/$count files encrypted"
}

# Usage example
batch_encrypt "/Users/john/Documents" "/Users/john/Encrypted" "batch_password123" "*.txt"

Decrypt Multiple Files

#!/bin/bash

# Batch decrypt multiple files
batch_decrypt() {
    local encrypted_dir="$1"
    local output_dir="$2"
    local password="$3"
    
    echo "📂 Batch decryption starting..."
    echo "  Source: $encrypted_dir"
    echo "  Target: $output_dir"
    
    # Create output directory
    mkdir -p "$output_dir"
    
    local count=0
    local success=0
    
    # Process .enc files
    while IFS= read -r -d '' file; do
        if [[ -f "$file" && "$file" == *.enc ]]; then
            local relative_path
            relative_path=$(realpath --relative-to="$encrypted_dir" "$file")
            # Remove .enc extension
            local decrypted_file="$output_dir/${relative_path%.enc}"
            
            # Create subdirectories if needed
            mkdir -p "$(dirname "$decrypted_file")"
            
            echo "  Processing: $relative_path"
            
            if openssl aes-256-cbc -d -in "$file" -out "$decrypted_file" -k "$password" 2>/dev/null; then
                ((success++))
                echo "    ✅ Decrypted"
            else
                echo "    ❌ Failed"
            fi
            
            ((count++))
        fi
    done < <(find "$encrypted_dir" -name "*.enc" -type f -print0)
    
    echo "🎉 Batch decryption completed: $success/$count files decrypted"
}

# Usage example
batch_decrypt "/Users/john/Encrypted" "/Users/john/Decrypted" "batch_password123"

Enterprise Encryption Management Script

#!/bin/bash

# Roundfleet File Encryption Management System
# Comprehensive encryption/decryption management for enterprise environments

# Configuration
LOG_FILE="/var/log/roundfleet_encryption.log"
CONFIG_FILE="/etc/roundfleet/encryption_policy.conf"
KEY_STORE="/var/lib/roundfleet/keys"
AUDIT_LOG="/var/log/roundfleet_encryption_audit.log"

# Logging function
log_action() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Audit logging
audit_log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$AUDIT_LOG"
}

# Setup environment
setup_environment() {
    sudo mkdir -p "$(dirname "$LOG_FILE")" 2>/dev/null
    sudo mkdir -p "$(dirname "$CONFIG_FILE")" 2>/dev/null
    sudo mkdir -p "$KEY_STORE" 2>/dev/null
    sudo chmod 700 "$KEY_STORE" 2>/dev/null
}

# Load configuration
load_config() {
    if [[ -f "$CONFIG_FILE" ]]; then
        source "$CONFIG_FILE"
        log_action "Configuration loaded from $CONFIG_FILE"
    else
        # Default configuration
        DEFAULT_ALGORITHM="aes-256-cbc"
        REQUIRE_STRONG_PASSWORDS=true
        MIN_PASSWORD_LENGTH=12
        ENCRYPTION_ENABLED=true
        AUTO_BACKUP_KEYS=true
        COMPLIANCE_MODE="HIPAA"  # HIPAA, PCI-DSS, GDPR
        
        log_action "Using default encryption configuration"
    fi
}

# Validate password strength
validate_password() {
    local password="$1"
    
    if [[ "$REQUIRE_STRONG_PASSWORDS" != "true" ]]; then
        return 0
    fi
    
    # Check minimum length
    if [[ ${#password} -lt $MIN_PASSWORD_LENGTH ]]; then
        echo "❌ Password too short (minimum $MIN_PASSWORD_LENGTH characters)"
        return 1
    fi
    
    # Check complexity
    local has_upper has_lower has_digit has_special
    has_upper=$(echo "$password" | grep -c '[A-Z]')
    has_lower=$(echo "$password" | grep -c '[a-z]')
    has_digit=$(echo "$password" | grep -c '[0-9]')
    has_special=$(echo "$password" | grep -c '[^A-Za-z0-9]')
    
    if [[ $has_upper -eq 0 ]] || [[ $has_lower -eq 0 ]] || [[ $has_digit -eq 0 ]] || [[ $has_special -eq 0 ]]; then
        echo "❌ Password must contain uppercase, lowercase, digit, and special character"
        return 1
    fi
    
    return 0
}

# Generate secure key
generate_secure_key() {
    local key_name="$1"
    local key_file="$KEY_STORE/${key_name}.key"
    
    # Generate random 256-bit key
    openssl rand -base64 32 > "$key_file"
    chmod 600 "$key_file"
    
    log_action "Generated secure key: $key_name"
    audit_log "KEY_GENERATED: $key_name by $(whoami)"
    
    echo "$key_file"
}

# Encrypt file with enterprise features
enterprise_encrypt() {
    local input_file="$1"
    local output_file="$2"
    local key_name="$3"
    local algorithm="${4:-$DEFAULT_ALGORITHM}"
    
    if [[ "$ENCRYPTION_ENABLED" != "true" ]]; then
        echo "❌ Encryption is disabled by policy"
        return 1
    fi
    
    # Validate input file
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Input file not found: $input_file"
        return 1
    fi
    
    # Get or generate key
    local key_file="$KEY_STORE/${key_name}.key"
    if [[ ! -f "$key_file" ]]; then
        echo "🔑 Generating new encryption key: $key_name"
        generate_secure_key "$key_name"
    fi
    
    local password
    password=$(cat "$key_file")
    
    echo "🔒 Enterprise encryption starting..."
    echo "  Algorithm: $algorithm"
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    echo "  Key: $key_name"
    
    # Create metadata file
    local metadata_file="${output_file}.meta"
    cat > "$metadata_file" << EOF
{
    "algorithm": "$algorithm",
    "key_name": "$key_name",
    "encrypted_by": "$(whoami)",
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "hostname": "$(hostname)",
    "compliance_mode": "$COMPLIANCE_MODE",
    "file_size": $(stat -f%z "$input_file"),
    "original_name": "$(basename "$input_file")"
}
EOF
    
    # Perform encryption
    if openssl "$algorithm" -salt -in "$input_file" -out "$output_file" -pass file:"$key_file"; then
        # Generate integrity hash
        local hash
        hash=$(shasum -a 256 "$output_file" | cut -d' ' -f1)
        echo "  \"integrity_hash\": \"$hash\"" >> "$metadata_file"
        
        log_action "File encrypted: $input_file -> $output_file (key: $key_name)"
        audit_log "ENCRYPT: $input_file -> $output_file by $(whoami) using $key_name"
        
        echo "✅ Enterprise encryption completed"
        echo "  Metadata: $metadata_file"
        
        # Backup key if enabled
        if [[ "$AUTO_BACKUP_KEYS" == "true" ]]; then
            backup_key "$key_name"
        fi
        
        return 0
    else
        echo "❌ Encryption failed"
        log_action "Encryption failed: $input_file"
        return 1
    fi
}

# Decrypt file with enterprise features
enterprise_decrypt() {
    local input_file="$1"
    local output_file="$2"
    local key_name="$3"
    
    # Check if encrypted file exists
    if [[ ! -f "$input_file" ]]; then
        echo "❌ Encrypted file not found: $input_file"
        return 1
    fi
    
    # Load metadata
    local metadata_file="${input_file}.meta"
    if [[ ! -f "$metadata_file" ]]; then
        echo "⚠️  Metadata file not found, using default algorithm"
        local algorithm="$DEFAULT_ALGORITHM"
    else
        local algorithm
        algorithm=$(grep '"algorithm"' "$metadata_file" | cut -d'"' -f4)
        echo "📋 Loaded metadata: algorithm=$algorithm"
    fi
    
    # Get key
    local key_file="$KEY_STORE/${key_name}.key"
    if [[ ! -f "$key_file" ]]; then
        echo "❌ Decryption key not found: $key_name"
        return 1
    fi
    
    echo "🔓 Enterprise decryption starting..."
    echo "  Algorithm: $algorithm"
    echo "  Input: $input_file"
    echo "  Output: $output_file"
    echo "  Key: $key_name"
    
    # Perform decryption
    if openssl "$algorithm" -d -in "$input_file" -out "$output_file" -pass file:"$key_file"; then
        # Verify integrity if hash available
        if [[ -f "$metadata_file" ]]; then
            verify_integrity "$input_file" "$metadata_file"
        fi
        
        log_action "File decrypted: $input_file -> $output_file (key: $key_name)"
        audit_log "DECRYPT: $input_file -> $output_file by $(whoami) using $key_name"
        
        echo "✅ Enterprise decryption completed"
        return 0
    else
        echo "❌ Decryption failed"
        log_action "Decryption failed: $input_file"
        audit_log "DECRYPT_FAILED: $input_file by $(whoami)"
        return 1
    fi
}

# Verify file integrity
verify_integrity() {
    local encrypted_file="$1"
    local metadata_file="$2"
    
    if [[ -f "$metadata_file" ]]; then
        local stored_hash current_hash
        stored_hash=$(grep '"integrity_hash"' "$metadata_file" | cut -d'"' -f4)
        current_hash=$(shasum -a 256 "$encrypted_file" | cut -d' ' -f1)
        
        if [[ "$stored_hash" == "$current_hash" ]]; then
            echo "✅ File integrity verified"
        else
            echo "⚠️  File integrity check failed - file may be corrupted"
            log_action "Integrity check failed: $encrypted_file"
        fi
    fi
}

# Backup encryption key
backup_key() {
    local key_name="$1"
    local key_file="$KEY_STORE/${key_name}.key"
    local backup_dir="$KEY_STORE/backups"
    
    mkdir -p "$backup_dir"
    
    local backup_file="$backup_dir/${key_name}_$(date +%Y%m%d_%H%M%S).key"
    cp "$key_file" "$backup_file"
    
    log_action "Key backed up: $key_name -> $backup_file"
}

# Generate encryption report
generate_encryption_report() {
    local report_file="/tmp/roundfleet_encryption_report_$(date +%Y%m%d_%H%M%S).txt"
    
    {
        echo "Roundfleet Encryption Management Report"
        echo "===================================="
        echo "Generated: $(date)"
        echo "Hostname: $(hostname)"
        echo "Compliance Mode: $COMPLIANCE_MODE"
        echo ""
        
        echo "Configuration:"
        echo "  Default Algorithm: $DEFAULT_ALGORITHM"
        echo "  Strong Passwords: $REQUIRE_STRONG_PASSWORDS"
        echo "  Min Password Length: $MIN_PASSWORD_LENGTH"
        echo "  Encryption Enabled: $ENCRYPTION_ENABLED"
        echo ""
        
        echo "Available Keys:"
        if ls "$KEY_STORE"/*.key >/dev/null 2>&1; then
            for key_file in "$KEY_STORE"/*.key; do
                local key_name
                key_name=$(basename "$key_file" .key)
                echo "  $key_name ($(stat -f%Sm "$key_file"))"
            done
        else
            echo "  No keys found"
        fi
        echo ""
        
        echo "Recent Encryption Activity:"
        if [[ -f "$AUDIT_LOG" ]]; then
            tail -10 "$AUDIT_LOG"
        else
            echo "  No activity logged"
        fi
        
    } > "$report_file"
    
    echo "📄 Encryption report generated: $report_file"
    log_action "Report generated: $report_file"
}

# Main function
main() {
    case "${1:-status}" in
        "encrypt")
            setup_environment
            load_config
            log_action "=== File Encryption Request ==="
            enterprise_encrypt "$2" "$3" "$4" "$5"
            ;;
        "decrypt")
            setup_environment
            load_config
            log_action "=== File Decryption Request ==="
            enterprise_decrypt "$2" "$3" "$4"
            ;;
        "generate-key")
            setup_environment
            load_config
            log_action "=== Key Generation Request ==="
            generate_secure_key "$2"
            ;;
        "report")
            setup_environment
            load_config
            generate_encryption_report
            ;;
        "list-algorithms")
            echo "📋 Available encryption algorithms:"
            openssl list-cipher-commands | tr ' ' '\n' | sort
            ;;
        "status"|*)
            setup_environment
            load_config
            echo "📊 Roundfleet Encryption Status:"
            echo "=============================="
            echo "Encryption Enabled: $ENCRYPTION_ENABLED"
            echo "Default Algorithm: $DEFAULT_ALGORITHM"
            echo "Compliance Mode: $COMPLIANCE_MODE"
            echo "Key Store: $KEY_STORE"
            
            if ls "$KEY_STORE"/*.key >/dev/null 2>&1; then
                echo "Available Keys: $(ls "$KEY_STORE"/*.key | wc -l)"
            else
                echo "Available Keys: 0"
            fi
            ;;
    esac
}

# Execute main function with parameters
main "$@"

Encryption Algorithms Reference

Quick Comparison

Algorithm	Key Size	Security	Performance	Use Case
DES	56-bit	Low	Fast	Legacy systems only
AES-128-CBC	128-bit	Good	Fast	General purpose
AES-256-CBC	256-bit	Excellent	Medium	High security
AES-256-GCM	256-bit	Excellent	Medium	Authenticated encryption
ChaCha20	256-bit	Excellent	Fast	Modern alternative

List Available Algorithms

# Display all available encryption algorithms
openssl list-cipher-commands

# Common secure algorithms
openssl enc -ciphers | grep -E "(aes|chacha)"

Security Best Practices

Password Management

#!/bin/bash

# Generate secure password
generate_secure_password() {
    local length="${1:-16}"
    
    # Generate password with mixed characters
    openssl rand -base64 "$length" | tr -d "=+/" | cut -c1-"$length"
}

# Example: Generate 20-character password
secure_password=$(generate_secure_password 20)
echo "Generated password: $secure_password"

Key Rotation

#!/bin/bash

# Rotate encryption keys
rotate_encryption_key() {
    local old_key="$1"
    local new_key="$2"
    local files_dir="$3"
    
    echo "🔄 Rotating encryption key: $old_key -> $new_key"
    
    # Generate new key
    generate_secure_key "$new_key"
    
    # Re-encrypt files with new key
    while IFS= read -r -d '' file; do
        if [[ "$file" == *.enc ]]; then
            local temp_file="/tmp/temp_decrypt_$$"
            
            # Decrypt with old key
            if enterprise_decrypt "$file" "$temp_file" "$old_key"; then
                # Re-encrypt with new key
                if enterprise_encrypt "$temp_file" "$file" "$new_key"; then
                    echo "  ✅ Rotated: $(basename "$file")"
                fi
            fi
            
            # Clean up
            rm -f "$temp_file"
        fi
    done < <(find "$files_dir" -name "*.enc" -type f -print0)
    
    echo "🎉 Key rotation completed"
}

Troubleshooting

Common Issues

Encryption fails with "bad decrypt"
- Verify correct algorithm is used
- Check password/key file integrity
- Ensure sufficient disk space
Permission denied errors
- Check file permissions
- Verify key store access rights
- Run with appropriate user privileges
Corrupted encrypted files
- Verify file integrity hashes
- Check for disk errors
- Restore from backups if available

Verification Commands

# Test encryption/decryption cycle
test_encryption() {
    local test_file="/tmp/test_encrypt.txt"
    local encrypted_file="/tmp/test_encrypt.enc"
    local decrypted_file="/tmp/test_decrypt.txt"
    
    # Create test file
    echo "This is a test file for encryption" > "$test_file"
    
    # Encrypt
    openssl aes-256-cbc -in "$test_file" -out "$encrypted_file" -k "testpassword"
    
    # Decrypt
    openssl aes-256-cbc -d -in "$encrypted_file" -out "$decrypted_file" -k "testpassword"
    
    # Compare
    if diff "$test_file" "$decrypted_file" >/dev/null; then
        echo "✅ Encryption/decryption test passed"
    else
        echo "❌ Encryption/decryption test failed"
    fi
    
    # Cleanup
    rm -f "$test_file" "$encrypted_file" "$decrypted_file"
}

Important Notes

Algorithm selection: Use AES-256-CBC or stronger for sensitive data
Password security: Implement strong password policies for enterprise use
Key management: Securely store and backup encryption keys
Compliance: Ensure encryption methods meet regulatory requirements
Performance: Consider file size and system resources when choosing algorithms
Backup strategy: Always maintain secure backups of encryption keys

Enterprise Deployment

For enterprise deployment, consider:

Policy definition - Establish encryption standards and procedures
Key management - Implement secure key storage and rotation
Compliance monitoring - Ensure adherence to regulatory requirements
User training - Educate users on proper encryption practices
Audit trails - Maintain comprehensive logs of encryption activities

Tutorial

Important notice