You may work for a super-secret government agency, or you may be just a regular Joe or Jane citizen. Either way, you still have sensitive data that you need to protect from prying eyes. Business secrets, government secrets, personal secrets—it doesn't matter; it all needs protection. Locking down users home directories with restrictive permissions settings, as we saw in Chapter 2, Securing User Accounts, is only part of the puzzle; we also need encryption. This encryption will provide three things for us:

• Confidentiality: This ensures that only people who are authorized to see the data can see it.
• Integrity: This ensures that the original data hasn't been altered by unauthorized people.
• Availability: This ensures that sensitive data is always available, and can't be deleted by unauthorized people.

The two general types of data encryption that we'll look at in this chapter are meant to protect data at rest and data in transit. We'll begin with using file, partition, and directory encryption to protect data at rest. We'll wrap up with a look at using OpenSSL to protect data in transit.

In this chapter, we'll cover the following topics:

• GNU Privacy Guard (GPG)
• Encrypting partitions with Linux Unified Key Setup (LUKS)
• Encrypting directories with eCryptfs
• Using VeraCrypt for the cross-platform sharing of encrypted containers
• OpenSSL and the Public Key Infrastructure
• Commercial certificate authorities
• Creating keys, certificate requests, and certificates
• Creating an on-premises certificate authority
• Adding a certificate authority to an operating system

• OpenSSL and the Apache web server
• Setting up mutual authentication