Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is there any simple (IE: right click in Nautilus) way to password protect a particular folder/file in Ubuntu? I've got a few files containing sensitive info and I'd much prefer that if/when I leave my computer alone, they aren't accidentally accessed by someone else.

The secruty does not have to be extremely tight. My only concern is that when family/friends come over, I don't really like the idea of them looking at my bank details, accounts or, you guessed it, porn collection.

A simple, effective way to let me put my machine in the hands of someone else knowing that said machine can not cause me embarresment is the sole reason why I'd like to see this in Ubuntu.

share|improve this question

14 Answers 14

up vote 13 down vote accepted

You can use the Archive Manager to zip the file and password protect the zip file.

That is probably the closest thing to right clicking and entering a password that you describe.

To do this right click on the file and choose "Compress" then choose zip as the archive type and in "Other options" you have the option to enter a password.

This is simple to do and stops the problem of someone mounting the file system from a live CD and getting the file that way.

Also you can easily email the file or copy to USB stick, etc without having to worry about having the means to unencrypt the files at the other end, you just need the password.

share|improve this answer
    
ZIP passwords aren't very secure at all, but this would certainly prevent ‘accidental’ viewing. –  bobince Sep 28 '10 at 11:12
6  
bobince: I don't know enough about it to disagree, but I have personal experience of not cracking zip passwords. Could you provide resources backing you claim so I can learn more? –  Richard Holloway Sep 28 '10 at 20:27

If you want to encrypt a lot of files that you access regularly, an encrypted filesystem is the way to go. But if you have single files that you want to encrypt/decrypt quite rarely (say, a list of passwords) you can do it very easily with a right-click in nautilus:

  • Install the seahorse-plugins package
  • Create a new key for GPG/PGP (Applications - Accessories - Passwords and Encryption Keys)
  • After a restart of nautilus (enter nautilus -q in a terminal or simply log out of your GNOME session) you have two new entries in your right-click menu: Encrypt and Sign, respectively Decrypt for encrypted files
share|improve this answer
    
I do not recommend this workflow. It requires more effort than an encrypted filesystem, and it's very unreliable (you might forget to reencrypt the file and delete the cleartext, leaving it available to a snooper; you might forget to reencrypt the file or delete the cleartext and end up with two versions of the file; the data is still there on the disk). –  Gilles Sep 27 '10 at 20:58
    
@Gilles: I agree that an encrypted filesystem is in general a better way -- but I was answering the OPs question. An encrypted filesystem has some disadvantages as well (e.g. performance) and actually may be less secure under some circumstances: If due to a security bug an application tries to read local data, it succeeds -- for GPG encrypted files you have to explicitly decrypt them manually. –  Marcel Stimberg Sep 27 '10 at 21:07
    
Performance is in favor of gpg only if you make multiple edits to a large file (not modifying the file in place). You can also mount the encrypted filesystem manually if you want. An advantage of the manual gpg method is that it's completely cross-platform, whereas not every OS has an encrypted filesystem and they're rarely compatible (that's relevant if you're going to carry encrypted files on a removable drive and want to access them on multiple OSes). –  Gilles Sep 27 '10 at 21:20
    
An encrypted filesystem is no help in the OP's situation though, where they want everything else open and usable except a few files. You'd have to store those few other files on a separate filesystem, and it'd really just be more mess than this. –  maco Sep 28 '10 at 21:12

As many pointed out, access control based on user id and encrypted filesystem is the only real way of securing user data. If, however, all that is stopping you from using Truecrypt is because you don't have a free partition / filesystem that you can use exclusively for storing encrypted data, then you can still make an encrypted file-system inside a file within your existing filesystem.

For this you need to have "sudo" rights, i.e., you must be able to run sudo.

  1. Get the latest version of truecrypt
  2. Open TrueCrypt (normally found in Applications -> Accessories)
  3. Using the gui you can create a new volume contained in a file. You can choose the location of this file.
  4. Steps 1-3 are one-time setup. After this whenever you mount this file-system using truecrypt GUI, you will see it in nautilus.
  5. You can move the sensitive files and directories within this filesystem.
  6. When "you are leaving your computer alone", unmout this using the "dismount" option in the truecrypt GUI.
  7. It is also important to use a good password (more than 20 characters at least, as recommended by the developers).
share|improve this answer

greyfade's answer is correct. Ubuntu is a multi-user system. If anyone else uses your computer they should have their own user account. One user per account; there is no good reason for users to share accounts, ever. You can set up a hotkey to log out when you leave your computer. Using Ctrl+Alt+L when you leave locks the computer. If someone else wants to use it, they can log in to their own account without affecting your session. Again, sharing user accounts is a bad habit and a bad idea for many reasons. Please don't do it.

share|improve this answer
1  
I think this may be better as a comment. –  hexafraction Oct 6 '12 at 13:54

If you're only concerned about other users on your system who don't have administrator rights, it's enough to use file permissions to control access. If there are other people with administrator rights or physical access, password protection means encryption¹.

The easiest way to encrypt a few files under Linux is the encfs filesystem. On the command line, run

encfs ~/.encfs ~/encrypted

Then create files under the encrypted directory. They are in fact stored in encrypted form inside ~/.encfs. When you've finished working, run

fusermount -u ~/encrypted

If you want to encrypt your whole home directory, ecryptfs is a better option. For more information, see What is the easiest way to encrypt a dir? (on Ubuntu) on Super User.

¹ Strictly speaking, you also need protection against someone installing a keylogger (“evil maid attack”), but that's a lot harder to achive on current desktop operating systems and hardware.

share|improve this answer
    
+1! For many, this is the best solution, and very easy, too! Though it does require a few keystrokes in the terminal - is there a GUI for this? –  loevborg Sep 29 '10 at 12:18
    
To answer the question, tom.noflag.org.uk/cryptkeeper.html might be a simple solution. –  loevborg Sep 29 '10 at 12:23
    
encfs gui: launchpad.net/~vault/+archive/ppa - clepto.github.com –  medigeek Feb 15 '12 at 21:41
    
@askadink An on-screen keyboard doesn't protect against software keyloggers (most keyloggers understand them just fine). It does protect against a hardware keylogger, but that's a very limited use case. If you don't trust the machine, don't type your password at all. See e.g. How easily are keyloggers foiled?, How can I avoid my password being harvested by key loggers from internet cafes? –  Gilles Oct 7 '12 at 21:16

No, not really.

You can use Truecrypt to create a volume to store sensitive files in (sudo apt-get install easycrypt for a nice front-end), but otherwise there isn't really a way to password-lock your files.

I'd suggest that you lock or log out when you leave your computer.

share|improve this answer
2  
You can also add a nautilus script, so right-clicking on a file/folder will appear the command "Crypt this folder/file"... the power of open-source is in this kind of customizations, imho ;) –  Strae Sep 27 '10 at 12:07

Password-protecting a file is nice and fine in a system which is otherwise not physically accessible, ie one that you cannot turn off and restart using a live CD for example. If the computer is a desktop that anyone can turn off, one can restart it with a live CD and gain access to all files on the hard disk, whether those are system files, config files, home directories, etc.

I would rather recommend that you use an encrypted file system, such as TrueCrypt, which will remain useless on any system unless the authorized user enter the proper credentials. It will do more than just password-protect your files, but will also protect them from external accesses.

Everything also depends on what would be the cost of some of those files were getting shared, vs the cost and effort to implement something as TrueCrypt and the tool presented earlier, easycrypt.

share|improve this answer

Try to search for and install ‘ecryptfs-utils’ in Ubuntu Software Center

enter image description here

After installing, go to Applications –> Accessories –> Terminal and run the command below:

ecryptfs-setup-private

enter image description here

You’ll be prompted to type your login passphrase (password), and to create one for your private folder.

enter image description here

When you’re done creating your password, Log Out and Log back in.

enter image description here

Next, go to Places –> Home Folder.

enter image description here

And new folder should be created in your home directory called ‘Private’. This folder in encrypted and password-protected. Move all your personal stuff into this folder to secure them.

enter image description here

Users without access to the folder will be denied.

enter image description here

For More Help

share|improve this answer

Thank you all for your answers; it seems there is no way to easily stop accidental viewing of certain files and folders. This is very unfortunate; the closest is the .zip file method, but as I'd rather not compress and decompress, I suppose I'll have to make do with the risk.

share|improve this answer
2  
There is, in fact, an easy way to stop accidental viewing of files and folders. DO NOT SHARE USER ACCOUNTS. Each user's directory can be individually encrypted when the account is created. Seriously, one account per user. Sharing accounts will end in tears, I promise! –  koanhead Oct 1 '10 at 1:59
    
Well, the 'sharing' I'm having problems with wasnt exactly given permission by me, if you know what I mean. –  Dante Ashton Oct 2 '10 at 8:26
3  
I'm afraid I misunderstood you. I forgot that in Ubuntu users on the same machine can view some folders and files in other users' home directories by default. The solution to this is to change the permissions of the folder in which your sensitive files are located. This can be accomplished by right-clicking the folder icon, choosing Properties, and then clicking the Permissions tab. Under Others, Select "None" from Folder access list and None from File access list, and click Apply Permissions to Enclosed Files. That and locking your session should keep out prying eyes. –  koanhead May 23 '11 at 1:36

How about hiding the folders in a location they wont see and set the nautilus option on not to show the hidden folders by default ? The easiest way to make a folder hidden is by making its name start with . I know this is not the solution for the question you have asked but just a solution i thought might work for your problem.

share|improve this answer

Use a Guest session!

Unless you expect people to gain increased privileges (e.g. root) in your machine, or for example boot from a CD-ROM and mount and browse your filesystems (or even reading the raw disk sectors), you may not have to encrypt some/all files on your hard drive. You can simply set permissions on directories and/or files to keep the "curious" from opening and browsing them. This is why, in normal operations, you

  1. Don't use a root account as your normal user.
  2. Don't give out your password (or root's password) to other users. ;-)

The Session applet on the top right of your window allows you to start a Guest session, which disappears when you log out. See for example this image. The Guest Session option starts a temporary session for anyone borrowing your computer. Your files are not visible -- unless you've specifically given universal read permissions. This is the ideal when you just want to "borrow" your computer to a guest who wants to do some quick browsing. It might not be what you want if you'd like to provide permanent accounts (i.e. residing under /home, as your account is likely to be). The Guest account cannot "see" anything under /home because the session doesn't have the right permissions.

Change the permissions

(Note: If someone has root permissions, this won't make a difference. Such a person will be able to access your unencrypted files just the same.) Suppose you have a folder (or a set of files) that you want to keep other users from reading/accessing.

  1. Select the folder (or files) you want to affect, then right-click on the selection (with your mouse).
  2. Select Properties.
  3. Go to the Permissions tab.
  4. Under the "Others" group, select "Access to folder" and "Access to file" as "None".

This doesn't encrypt the affected files and directories, but it does keep people (not having root permissions, of course) from prying into your account.

Allow some users

(Note: If someone has root permissions, this won't make a difference. Such a person will be able to access your unencrypted files just the same.) If you want to allow only a group of users to access a set of files or folders, you can do the same. For example, you may want to reserve read+write permissions for yourself, but only read permissions for a group (or even read+write for them as well) on those files and folders.

  1. If the group name you want to select doesn't yet exist, you'll have to create it. Go to System > Administration > Users and Groups.
    1. Click on the Manage groups button.
    2. Click Add. You'll need to enter your password (if your account has admin permissions, otherwise use the root password if you have it).
    3. Enter a group name. The group names follow the same rules when providing a user name; I suggest you only use letters and numbers, without spaces. You can leave the suggested Group ID (starting at 1001 for example). Select the users that will belong to the group.
    4. Click OK to apply. Click Close on the previous window. Click Close to close Users and Groups.
    5. You may need to logout+login for your account to "see" the new group. It also applies to any already-logged in users.
  2. Use the same procedure as above to apply Group permissions. Please note that you'll have to provide the Group name when applying permissions. You can only use one group.

This doesn't encrypt the affected files and directories, but it does keep people (not having root permissions, of course) from prying into your account.

Encryption

Other users here have provided more details specifically for solutions using encryption. If you really require encryption -- and not just controlling access to your files -- you may want to look into those answers. But please note that access to those files will always be slower, due to the necessary overhead for applying the encryption/decryption algorithms. The description I provided above implements a (very!) basic measure of access control with virtually no performance impact.

share|improve this answer

Here is a simplest way, you can use application named cryptkeeper,a GNOME applet for managing encrypted folders and defaultly available in ubuntu 11.04 repository and previous. Such a simple way to securing your folder using password and encrypted folder. Some reference can be see here

share|improve this answer

GPG has a symmetrical encryption option (ie password protect) gpg -c. With a bit of scripting, maybe there's a way to add this to the right-click menu in nautilus?

share|improve this answer

sudo apt-get install cryptkeeper

                                After installing, go to Applications –> System Tools –> Cryptkeeper.

                                        Cryptkeeper will automatically attach itself to the top panel

                   enter image description here

                     To create an encrypted protected folder, click on Cryptkeeper applet and select                                                                             ‘New encrypted folder’

                   enter image description here

                          Then type the folder name and where to save the folder and click ‘Forward’.

                   enter image description here

                                                              Type the password and click ‘Forward’.

                   enter image description here

                                                      The folder will be created and ready to be used.

                   enter image description here

                   To access all encrypted folder, click on Cryptkeeper applet on the panel and select                                                                                                each folder.

                   enter image description here

                                                   Type the password before it is mounted to be accessed.

                   enter image description here

                                                       Done

                   enter image description here

                 To delete a folder or change the password, right-click the folder in the panel-applet.

                                                                                      For More Help

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.