110.3 Securing Data with Encryption

Introduction

This lesson is about protecting data and communication with practical public-key tools.

The main question is:

How do SSH keys, host keys, port tunnels, and GnuPG help secure access, files, and communication on Linux?

What you should be able to do after this lesson:

• Generate and use SSH key pairs.
• Understand the role of SSH host keys.
• Use ssh-agent and ssh-add.
• Understand local port forwarding and X11 forwarding.
• Use GnuPG to encrypt, decrypt, sign, and verify files.
• Understand the idea of key revocation.

Big Idea: Encryption Solves Different Problems

At beginner level, it helps to separate three common security goals:

• confidentiality: only the right people can read the data
• integrity: you can detect if the data changed
• authentication: you know who you are talking to

SSH and GPG help with these goals in different ways. If you keep that mental model, the commands make much more sense.

SSH User Keys

SSH key authentication uses a key pair:

• private key: stays secret on your machine
• public key: can be copied to systems you want to access

Generate a modern key pair:

ssh-keygen -t ed25519

Common files:

~/.ssh/id_ed25519
~/.ssh/id_ed25519.pub

Typical workflow:

1. create the key pair
2. copy the public key to the remote system
3. keep the private key secret

authorized_keys

Remote systems usually store allowed public keys in:

~/.ssh/authorized_keys

Simple idea:

• if your public key is listed there
• and permissions are correct
• SSH can authenticate you without a password prompt

SSH Host Keys

Host keys are different from your personal user keys.

They identify the server itself.

Common server-side files:

/etc/ssh/ssh_host_ed25519_key
/etc/ssh/ssh_host_ed25519_key.pub

Why this matters:

• the server proves its identity to the client
• the client can detect unexpected host-key changes

That is what SSH is warning about when it says the remote host identification has changed.

ssh-agent and ssh-add

If you use several SSH connections, repeatedly typing a passphrase can be annoying.

That is why Linux often uses:

ssh-agent
ssh-add

Typical pattern:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

This lets the agent hold unlocked key material for your session.

SSH Tunnels

SSH can also forward ports securely.

Example of local port forwarding:

ssh -L 8080:localhost:80 user@server

Simple meaning:

• your local port 8080
• is tunneled to port 80 on the remote side

This is useful when:

• a service should not be exposed directly
• you want encrypted access through SSH

X11 forwarding

LPIC also expects awareness of X11 forwarding:

ssh -X user@server

This lets graphical applications display through an SSH connection.

GnuPG

GnuPG, often called gpg, is used for:

• encryption
• decryption
• signing
• verification

Generate a key:

gpg --full-generate-key

List keys:

gpg --list-keys
gpg --list-secret-keys

Encrypt and Decrypt a File

Encrypt for a recipient:

gpg --output secret.txt.gpg --encrypt --recipient alice secret.txt

Decrypt:

gpg --output secret.txt --decrypt secret.txt.gpg

The big beginner idea:

• encryption protects confidentiality
• only the right private key should be able to decrypt the file

Sign and Verify

Sign a file:

gpg --output notes.sig --detach-sign notes.txt

Verify it:

gpg --verify notes.sig notes.txt

This does not hide the file. It proves integrity and origin.

Revocation

Sometimes a key should no longer be trusted.

Common reasons:

• private key leaked
• key lost
• person left the organization

That is why revocation matters. At LPIC-1 level, you mainly need to understand the concept and know that GPG supports revocation certificates.

Practice Step by Step

1) Generate an SSH key pair

1. Run: ssh-keygen -t ed25519
2. Inspect the result: ls -l ~/.ssh/
3. Identify the private key and public key.

2) Use `ssh-agent`

1. Run: eval "$(ssh-agent -s)"
2. Then: ssh-add ~/.ssh/id_ed25519
3. List loaded identities: ssh-add -l

3) Generate a GPG key and inspect it

1. Run: gpg --full-generate-key
2. Then: gpg --list-keys
3. If you do not want to keep the key later, you can remove it after the exercise.

4) Sign and verify a small file

1. Create a test file: printf 'LPIC encryption practice\n' > /tmp/notes.txt
2. Sign it: gpg --output /tmp/notes.sig --detach-sign /tmp/notes.txt
3. Verify it: gpg --verify /tmp/notes.sig /tmp/notes.txt

Cheat Sheet

ssh-keygen -t ed25519
ls -l ~/.ssh/
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -l
ssh -L 8080:localhost:80 user@server
ssh -X user@server
gpg --full-generate-key
gpg --list-keys
gpg --list-secret-keys
gpg --output secret.txt.gpg --encrypt --recipient alice secret.txt
gpg --output secret.txt --decrypt secret.txt.gpg
gpg --output notes.sig --detach-sign notes.txt
gpg --verify notes.sig notes.txt

Legacy / Exam Note

LPIC still mentions older SSH key types such as DSA and older file names like id_rsa and id_dsa. In modern everyday use, ed25519 is usually the cleaner first example for beginners. For the exam, recognize the older names too.