Tomb – A File Encryption and Personal Backup Tool for Linux

Tomb is a free open-source, small, powerful, and simple tool for encrypting files on GNU/Linux. At the time of this writing, it comprises a shell script (zsh) using generic filesystem GNU tools and the Linux kernel crypto API (cryptsetup and LUKS).

It also employs various GNU/Linux tools such as steghide, lsof, mlocate, resizefs, dcfld, and many more, to extend its functionality.

Tomb is used to create secure backups of secret or personal files in encrypted, password-protected directories called tombs. These directories can only be opened using their associated keyfiles and passwords.

After creating a tomb, you can store its key files separately, for example, your tomb file can exist on a remote server while the key file is on your laptop or desktop at home or in office.

If the tomb file is on your laptop or desktop, you can hide it within the filesystem or as a more secure option, store the key in a USB drive.

In addition, you can hide a tomb in the filesystem or move it safely over a network or in external storage media; and share it with other friends or colleagues. You can also hide a key in an image as we will see later on.

How to Install Tomb in Linux Systems

Tomb needs a few programs such as zsh, gnupg, cryptsetup, and pinentry-curses to be installed on a system in order to work.

First start by installing the following required tools using your distribution default package manager and also we will install steghide to add functionality for hiding keys in images.

sudo apt install gnupg zsh cryptsetup pinentry-curses steghide	[Debian]
sudo yum install gnupg zsh cryptsetup pinentry-curses steghide	[RHEL]
sudo dnf install gnupg zsh cryptsetup pinentry-curses steghide	[Fedora]

After installing the required packages, download the stable tomb source code for your distribution or use the following wget command to download directly in the terminal as shown.

cd Downloads/
wget -c https://files.dyne.org/tomb/Tomb-2.10.tar.gz 

Next, extract the tar archive file you just downloaded and move it into the decompressed folder.

tar -xzvf Tomb-2.10.tar.gz
cd Tomb-2.10

Finally, run the following command, as root or use the sudo command to gain root privileges, to install the binary under /usr/local/bin/.

sudo make install

How to Create Tombs in Linux Systems

After installing the tomb, you can generate a tomb by creating a new key for it and set its password as explained below.

To create a tomb, use the dig sub-command and the -s flag to set its size in MB (this size can be increased when a tomb gets full to capacity after adding files).

sudo tomb dig -s 30 tecmint.tomb      
Create a New Tomb
Create a New Tomb

Then create a new key for tecmint.tomb with the forge sub-command and set its password when asked. This operation will take some time to complete, just sit back and relax or go prepare yourself a cup of coffee.

sudo tomb forge tecmint.tomb.key

While creating the key, the tomb will complain if swap space exists on the disk, and it will terminate if that swap memory is turned on as shown in the following screenshot.

This is due to a security risk associated with swap memory on disk (refer to documentation or man page for more information).

You can either use the -f flag to force the operation or turn off swap memory with the following command.

sudo swapoff -a
Turn Off Swap
Turn Off Swap

Then try to create the tomb key once more.

Create a New Tomb Key File
Create a New Tomb Key File

Next, format tecmint.tomb to lock it with the above key. The -k flag specifies the location of the key file to use.

sudo tomb lock tecmint.tomb -k tecmint.tomb.key
Lock Tomb File with Key
Lock Tomb File with Key

How to Open a New Tomb

To open a tomb, use the open sub-command, you will be prompted to enter the password you set while creating the tomb.

sudo tomb open -k tecmint.tomb.key tecmint.tomb  
Open a New Tomb
Open a New Tomb

From the output of the previous command, the tomb has been opened and mounted on /media/tecmint/ – this is where you can add your secret files.

If you have numerous tombs, you can list all open tombs plus get some information about them as shown.

sudo tomb list 
List All Tombs
List All Tombs

How to Copy Files to Open Tomb

Now you can add your secret or important files to the tomb as follows. Every time you need to add more files, open the tomb first, as shown above.

sudo cp -v passwds.txt accounts.txt keys.txt -t /media/tecmint/
Copy Files to Open Tomb
Copy Files to Open Tomb

After opening a tomb, once you are done using it or adding files to it, use the close sub-command to close the tomb file. But if a process is working with an open tomb, if may fail to close.

sudo tomb close

You can close all tombs by running.

sudo tomb close all

To force an open tomb to close, even when a process is interacting with it, use the slam sub-command.

sudo tomb slam 
OR
sudo tomb slam all 

How to Hiding Tomb Key in an Image

It is also possible to hide/encode the tomb key in an image using the bury sub-command, as follows

sudo tomb bury -k tecmint.tomb.key zizu.jpg 
Hide Tomb Key in Image
Hide Tomb Key in Image

Then use the newly created jpeg image to open the tomb, as shown.

sudo tomb open -k zizu.jpg tecmint.tomb
Open Tomb Using Encoded Image
Open Tomb Using Encoded Image

You can also recover a key encoded in a jpeg image with the exhume sub-command.

sudo tomb  exhume zizu.jpg -k tecmint.tomb.key
OR
sudo tomb -f exhume zizu.jpg -k tecmint.tomb.key   #force operation if key exists in current directory
Reoover a Key from Image
Recover a Key from the Image

Attention: Remember to hide the tomb key, do not keep it in the same directory as the tomb. For example, we will move the key for tecmint.tomb into a secret location (you can use your own location) or keep it on an external media or move it to a remote server over SSH.

sudo mv tecmint.tomb.key /var/opt/keys/  

Unfortunately, we can not exploit all the tomb usage commands and options in this guide, you can consult its man page for more information. There, you will find instructions on how to change a tomb’s key and password, resize it, and much more.

man tomb 

Tomb Github repository: https://github.com/dyne/Tomb

Summary

Tomb is a simple yet powerful and easy-to-use encryption tool for handling files as delicate as secrets, on GNU/Linux systems. Share your thoughts about it via the comment form below.

Aaron Kili
Aaron Kili is a Linux and F.O.S.S enthusiast, an upcoming Linux SysAdmin, web developer, and currently a content creator for TecMint who loves working with computers and strongly believes in sharing knowledge.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.

3 thoughts on “Tomb – A File Encryption and Personal Backup Tool for Linux”

Got something to say? Join the discussion.

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.