easy it is to do, and just how costly it is to lose data. In this article I'll show you how to add encryption to your backups - and some of the pitfalls to watch out for. Backup scripts with encryption There are a couple of good open source tools which will do encryption nicely. Probably the best one is OpenSSL, which supports a wide range of ciphers and is very easy to add into existing backup scripts. Quite simply, the command: openssl enc -aes-256-cbc -salt -pass pass:123456 will encrypt standard input with the key "123456" and write to standard output. Note that the output stream will be 8-bit binary unless you specify the -a option for base64 output encoding. The -salt option should always be used to use a salt in the encrypting key derivation functions. For the key, or password, you really shouldn't specify it on the command line like in the example above because any user will be able to see it if they run the 'ps' command. It is better for automated scripts to put the key into a file which is set to be read- only by root and use the file:filename construct as in the following backup example: GPG is also a good tool for encryption, and a number of encrypting backup systems prefer to use GPG. GPG is well-known as a public-key, or asymmetric, encryption tool. This allows the data to be encrypted with one key and require a separate key for the