6

I'm trying to encrypt some sensitive files on my computer, and I'm trying to figure out what the best option is. I'm considering using ecryptfs-setup-private or a True Crypt file container. I like ecryptfs because it seems more native to Ubuntu (it's in the repository after all), and it makes sense to have Private in my home directory.

What I want to know is this: if I hibernate or have a hard power off while the Private directory is mounted, can someone use a live cd or mount my hard drive on another computer and see the contents of Private, or is Private encrypted real time while I am accessing files?

Improve this question
3
  • I believe I answered my own question. I ran ecryptfs-setup-private, and I did a hard shut down. When I booted using the live cd, I was able to list the contents of my personal home directory using ls /media/<UUID>/home... and in the ~/Private directory, there was the usual link to access the files, and there was no way to make it work. The files were safe!
    – Chad
    Dec 13, 2011 at 14:58
  • your files are safe the encryptfs is one of the best encryptions your question itself is a answer
    – paru38
    Dec 13, 2011 at 15:17
  • You should post that as an answer to your own question.
    – Octavian Helm
    Dec 13, 2011 at 23:25

2 Answers 2

Reset to default
9

I'll answer this question, as the author of ecryptfs-setup-private, and one of the maintainers of eCryptfs.

eCryptfs provides very strong cryptographic protection of your data "at rest" -- ie, when your system is powered off or hibernated. However, you should beware that when your system is running, and your home directory is mounted, your data is protected exclusively by DAC (Discretionary Access Controls) -- ie, UNIX filesystem permissions. By default in Ubuntu, if you're using an Encrypted Home Directory, then your $HOME directory has 700 permissions -- so no other users on the system besides you (and root) will be able to see your data while its mounted. Now when your data is mounted, then it is safely locked away in encryption.

As always, you should still have a very strong LOGIN passphrase, however. Your LOGIN passphrase is used to encrypt and decrypt a much longer and strong randomly generated mount passphrase, which is stored in $HOME/.ecryptfs/wrapped-passphrase. If an attacker has access to $HOME/.ecryptfs/wrapped-passphrase, then they can try and decrypt that file by guessing your LOGIN passphrase. If they do decrypt that, then they will have access to your long/random MOUNT passphrase and your data is no longer safe. As a stronger measure of security, some paranoid users (such as myself) store their wrapped-passphrase file on secure removable media such as a USB key or an SD-card, and use a symbolic link to link it into place at $HOME/.ecryptfs/wrapped-passphrase. This should only be attempted by expert users.

Cheers!

Improve this answer
2
  • What happens if you lose/break the USB key? Is your data then unrecoverable?
    – scottl
    Dec 15, 2011 at 4:08
  • scottl: Correct -- if you lose the encryption passphrase (stored on the USB key in your example), the data is unrecoverable. That is -- unless you've backed up the (wrapped or unwrapped) passphrase, which Ubuntu prompts you to do when you run with an encrypted home directory.
    – dholbert
    Jun 26, 2012 at 23:57
2

I believe I answered my own question. I ran ecryptfs-setup-private, and I did a hard shut down. When I booted using the live cd, I was able to list the contents of my personal home directory using ls /media//home... and in the ~/Private directory, there was the usual link to access the files, and there was no way to make it work. The files were safe!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .