You may work for a super-secret government agency, or you may be just a regular Joe or Jane citizen. Either way, you will still have sensitive data that you need to protect from prying eyes. Business secrets, government secrets, personal secrets—it doesn't matter; it all needs protection. Locking down user's home directories with restrictive permissions settings, as we saw in Chapter 2, Securing User Accounts, is only part of the puzzle; we also need encryption.

The two general types of data encryption that we'll look at in this chapter are meant to protect data at rest and data in transit. We'll begin with using file, partition, and directory encryption to protect data at rest. We'll then cover Secure Shell (SSH) to protect data in transit.

In this chapter, we'll cover:

• GNU Privacy Guard (GPG)
• Encrypting partitions with Linux Unified Key Setup (LUKS)
• Encrypting directories with eCryptfs
• Using VeraCrypt for the cross-platform sharing of encrypted containers
• Ensuring that SSH protocol 1 is disabled
• Creating and managing keys for password-less logins
• Disabling root user login
• Disabling username/password logins
• Setting up a chroot environment for SFTP users