We do daily backup for some configuration files of many servers. Each conf file (compressed) is from 100KB to a few MB. Number of new files increased everyday is about 650. They are very important and confidential, so we encrypt each conf file with same pass phrase. However, we must change this phrase every 3 months. And old files can't be deleted, we need to re-encrypt all of them with new phrase. Currently, we have more than 300,000 files. They are stored in a network storage. It's very painful to decrypt and encrypt so many files every 3 months.
I was considering of using GPG:
- gen a new GPG key
- set a pass phrase for it, using pass phrase which is updated every 3 months
- encrypt every conf file use this GPG key
- 3 months later
- only change pass phrase of GPG key to latest one, no need to decrypt and encrypt all old files
But this seems insecure. All files can be decrypted use same GPG key with older pass phrase if some one have the old GPG database.
Is there any smarter way to do this kind of task? Thanks.
Backup task is running daily on one server, all encrypted files are saved to network storage. Only a few have encryption key and access to the backup server.