Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are (pdf) files placed under unix with 700 permission. The files contain sensitive data. Would it be a good idea to also encrypt these files? Would it make them any more secure?


migration rejected from Oct 18 '15 at 21:03

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as primarily opinion-based by kasperd, womble Oct 18 '15 at 21:03

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

Where are the files? Are they on a server in your office? A server in a data center? Your desktop at home? Your laptop? The answer may depend on that. – user76967 Apr 20 '11 at 11:47

You need to first determine who your foes are.

If you're a lowly user, and you don't want root to be able to read your files by accident while he's tracking down some problem you ask him to look into, then yes, encryption of files is a good solution.

If you're using files on a laptop which can be carried around the city, and potentially any thief can take your laptop and become root, then yes, encryption is a good solution. In that case though, encrypting the whole drive or at least your home directory would be better.

If you're working in some relatively high-security office setup where you want two-factor authentication (password + a key on a keycard/usb drive/etc.) because you don't trust co-workers not to gain access with your password by watching you type or something, then yes, file encryption would make sense.

In most other cases, encrypting files isn't helpful. File permissions/security and web permissions/security are more appopriate focuses for your attention.


If you trust both the physical security of the computer (which includes trusting the honesty of anyone who has physical access that computer), and the security of the operating system (including its configuration), then encrypting the files is unnecessary.

But you may not want to trust the physical security of the computer after it's been hauled away by serious people, in which case you ought to put some effort into doing encryption. The simplest way to have it is to do it at the lowest level - i.e. whole-disk encryption. That way you only have to worry about passwords when rebooting, and there are ways around that, too.

Your first sentence implies you're not running anything that is on the network, is Windows, or has a keyboard. Just saying. – Michael Graff Jan 18 '10 at 18:41
@Michael Graff: If you don't trust the security of the OS or the hardware, you're hosed anyway. I'm sorry, what was your point again? – Teddy Jan 19 '10 at 9:59
OSs have bugs. Administrators make mistakes. People run untrusted things all the time. Encrypting private data keeps it private. – Michael Graff Jan 19 '10 at 10:00
@Michael Graff: If the OS has a bug, or if an admin makes a mistake, or if you run an untrusted program, you can no longer trust the security of your encrypted files - some sniffer may have been installed to log your password for the next time you decrypt the files. If you can't trust the OS or hardware, you have no place to stand. – Teddy Jan 20 '10 at 5:11
I think we'll have to agree to disagree on this. I don't trust the OS to never make a mistake, I don't trust a laptop not to be stolen, and I don't trust that what may be secure today is forever secure. But then again, I work in security, so perhaps I'm just looking at things differently. – Michael Graff Jan 20 '10 at 14:22

I routinely encrypt files that I don't want others to touch. Note that a lot of encryption relies mostly on the selection of a good password. I also distrust most built-in encryption systems and just choose to use PGP (well, GnuPG actually.)

PGP is reliable, well-tested, and understood. Of course I have to decrypt the files while working or viewing them, but generally, for my uses, this is not an issue.

I also use an encrypted filesystem on my flash drives and the home directories and swap on my NetBSD laptops. After all, I never know when I'll drop one on accident or have one stolen. It's just easier to not worry about it and encrypt the whole drive rather than file by file. I still use PGP for the really private things, as it protects one step further from someone typing on my keyboard.

But then again, I'm paranoid.

Just because you're paranoid, it doesn't they're not out to get you, you know. Join the club. – pavium Jan 17 '10 at 11:11
paranoid isn't thinking they are out to get you; they are. paranoid is thinking they are co-ordinated about it... whens this club meet? – Antitribu Jan 18 '10 at 9:42
It meets at: ---BEGIN PGP ENCRYPTED MESSAGE--- kjsdAsdJD3kj23hasd== ---END PGP ENCRYPTED MESSAGE--- – Michael Graff Jan 18 '10 at 18:44

Well encryption won't make them any less secure. It will certainly help protect against physical theft, provided you don't document any passwords, passphrases, keys etc on the same system.


Check your organization's Sensitive Data Handling policy, and the absence of that talk the group most responsible for data security. You may be required to encrypt the data (or much stronger measures) depending on exactly what it is.

My general rule of thumb is to recommend encryption whenever in doubt wherever feasible. The trick, of course, is choosing an encryption method that protects against the threat you are attempting to mitigate.


Its only safe to do it . But if its a Unix box and other dont have access to it then it should be fine . But its always better to encrypt critical datas .

It's not "always better". No security is good unless it's done right. They talk about a "false sense of security" for a reason: thinking your data is safe when it's not is a good deal more dangerous than knowing that it's not safe. – Lee B Apr 28 '10 at 19:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.