After seeing yet another data breach due to inadvertent SQL dumps being left on the wrong server (or at least a similar cause) the author made the following observations:
Many organizations often dump data from databases using pipelines such as:
mysqldump mydb | bzip2 -c > dump_mydb_2016-11-01.sql.bz2
And restore in similar pipelines such as:
bzcat dump_mydb_2016-11-01.sql.bz2 | mysql mydb
The business reasons for needing to do these types of operations vary, but, with the exception of genuine backups, are often to facilitate ad-hoc operations such as restoring staging/test environment to a snapshot of production etc.
Since many of these operations are ad-hoc, often various data dumps are forgotten about, and eventually over time the environments are re-purposed and data becomes increasing likely to accidentally leak.
The safedump and saferestore tools in this repository allow easy addition of time limited encryption to your existing workflows:
mysqldump mydb | bzip2 -c | safedump -for 24h > dump_mydb_2016-11-01.sql.bz2
saferestore < dump_mydb_2016-11-01.sql.bz2 | bzcat | mysql mydb
In this manner the adhoc database dumps can easily be decrypted within their expected use period, and once that time expires, the data cannot be recovered (without invoking out of band procedures).