Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to encrypt our tape backups, using tar and openssl but also write to a local file, so far I have :

tar --total -czp ./tmp ./home | tee /tmp/Archive.tar.gz | tee > /dev/nst0

I'm not sure if this is the correct tee sytax but it works, because

tar -tzvf /dev/nst0


tar -tzvf /tmp/Archive.tar.gz

give the correct results.

However if I try to add encryption using openssl :

tar --total -czp ./tmp ./home | openssl aes-256-cbc -e -salt -pass file:/encrp_file  | tee /tmp/Archive.tar.gz | tee > /dev/nst0

I get :

tee: standard output: Invalid argument
tee: write error

I assume that there is something in the output from openssl that is causing a problem for tee when it writes to the tape because the file is created properly and if I remove the output to tee and just send it to the tape it also works.

Any suggestions?

share|improve this question
Is that last tee necessary ? Maybe you can replace it with |tee /tmp/Archive.tar.gz >/dev/nst0 – b0fh Nov 9 '11 at 13:06
up vote 1 down vote accepted

These are the relevant line from my home backup script:

tar czfTP - $FILELIST --use-compress-program xz | openssl bf -salt -pass file:passkey.txt | tee /backup/location/file_name.txz.bfe | dd bs=10k of=/dev/tape

You can just create the backup files and copy them to tape later with

dd if=/backup/file.tar of=/dev/tap bs=10k

And there are plenty of other possible combinations. I'm using Blowfish Encryption, looks like you're wanting AES, but that's easy to swap out. I know others commonly use GPG instead of OpenSSL. It's also possible to setup asymmetric keys (AES or DSS) to generate a unique session key and prepend that to the file stream, but this is quite a bit more complicated, and makes parsing the encrypted file more complicated as well. But it's very useful for environments where the backup will be shipped off site and you don't want people onsite to be able to tamper with the backups.

share|improve this answer
Thanks, dd useful again. – Tim the Enchanter Nov 9 '11 at 16:04

I tried the following and it worked on decryption:

$ tar --total -czp /home |openssl aes-256-cbc -e -salt -pass file:pass.txt | tee /tmp/archive.tgz.encrypted > /tmp/archive2.tgz.encrypted

I don't have a tape device, so I'm sending it to two different files. Should work with a tape drive, though.

So, the decryption looks like:

$ openssl aes-256-cbc -d -salt -pass file:pass.txt -in /tmp/archive.tgz |tar --total -xzvf -

and I get no errors.

b0fh's comment to your post is correct. The proper "tee" syntax is along the lines of

$ command | tee outputfile1 > outputfile2
share|improve this answer
Thanks for the tee syntax suggestion, the command works when outputting to two files as above but if I replace the > /tmp/archive2.tgz.encrypted with > /dev/nst0 I get the same error. – Tim the Enchanter Nov 9 '11 at 13:33
What if you put the tape devices first, as the argument of the tee? tee /dev/nst0 > /tmp/Archive.tar.gz – cjc Nov 9 '11 at 13:39
Most tape devices require 10k blocks, you'll have to pipe to a dd of=/dev/tape bs=10k to marshal the block size. – Chris S Nov 9 '11 at 13:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.