Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Recently i've found this interesting tutorial:

http://flossstuff.wordpress.com/2011/08/07/using-a-file-as-a-storage-device/

It explains how to create an empty file, format it as ext4, and mount it as a device.

I'd like to know if it can be created as an encrypted ext4 file system. I've tried using palimpsest (the disk utility found in System menu) to format the already created file system but it doesn't works as it detects the file system being used. If I try to unmount the file system, it won't work neither because it doesn't detect the device (since it's not a real device like a hardrive or a usb drive).

So my question is, is there an option to create the file system encrypted from the begining? I've used these commands:

Create an empty file 200Mb size:

dd if=/dev/zero of=/path/to/file bs=1M count=200

Make it ext4:

mkfs -t ext4 file

Mount it in a folder inside my home:

sudo mount -o loop file /path/to/mount_point

Is there any way the mkfs command creates the ext4 encrypted asking for a decryption password?

I'm planing to use this as a way to encrypt files inside Dropbox.

share|improve this question

2 Answers 2

up vote 7 down vote accepted

You can use cryptmount to encrypt a filesystem, also if the filesystem is on a file.

The cryptmount manual page has a very simple and detailed explanation that I report (modified) here, and it do mention explicitly a file based filesystem.

  • Step 1
    Add an entry in /etc/cryptmount/cmtab, as follows:

       mycrypt {
           dev=/media/data/mycrypt dir=/home/enzotib/mycrypt
           fstype=ext4 mountoptions=defaults cipher=twofish
           keyfile=/etc/cryptmount/mycrypt.key
           keyformat=builtin
       }
    

    where /media/data/mycrypt is the support file created by dd and /home/enzotib/mycrypt is the desired mountpoint.

  • Step 2
    Generate a secret decryption key

       sudo cryptmount --generate-key 32 mycrypt
    
  • Step 3
    Execute the following command

       sudo cryptmount --prepare mycrypt
    

    you will then be asked for the password used when setting up the key

  • Step 4
    Create the filesystem

       sudo mkfs.ext4 /dev/mapper/mycrypt
    
  • Step 5
    Execute

       sudo cryptmount --release mycrypt
    
  • Step 6
    Now mount the filesystem

       mkdir /home/enzotib/mycrypt
       cryptmount -m mycrypt
    

    then unmount it

       cryptmount -u mycrypt
    

Also, if you need to crypt a directory, encfs may be worth to take into consideration.

share|improve this answer
    
Thanks for your answer, I've created the file system, encrypted, and uploaded to Dropbox. Later I'll try to mount that file in the other pc. Just one thing, can it be done without sudo? If I want to keep the file and the file system mounted inside my home (not in media like usb's or hardrive) the commands would be the same without sudo or does cryptmount always need root privileges? –  darent Aug 28 '11 at 15:25
1  
@darent: it seems the command need root privileges only in filesystem setup, but mounting/unmounting is a user action, provided the image-file and the mountpoint are owned by user. To setup the same image-file on another machine, I suppose you should copy /etc/cryptmount/mycrypt.key and skip the --generate-key, step. –  enzotib Aug 28 '11 at 15:36
    
I get this error in the last step:$ sudo cryptmount -m encriptat Enter password for target "encriptat": e2fsck 1.41.14 (22-Dec-2010) fsck.ext4: Súperbloc no vàlid, provant els blocs de còpia de seguretat... fsck.ext4: Bad magic number in super-block en intentar obrir /dev/mapper/encriptat –  darent Aug 28 '11 at 16:51
1  
@darent: have you created the filesystem as shown in the step 4? have you been consistent in the substitution of the name "mycrypt" with "encriptat"? –  enzotib Aug 28 '11 at 16:58
    
Sorry, the error was because instead of (sudo mkfs.ext4 /dev/mapper/mycrypt) i was typing (sudo mkfs.ext4 mycript). I was poiting to the file directly, not the device. Now it works perfect. And sorry about the format of this message, don't know why i can't separate the lines (if I press enter it publishes the comment instead of creating a new line, maybe a firefox glitch...) Cheers! EDIT: now I readed your answer, the encriptat name wasn't a problem (just adapted your post and put the files with catalan names, but it's all consistent). Everithing is working ok now, thanks again :) –  darent Aug 28 '11 at 17:05

You can use the losetup command with the -e parameter to create an encrypted loop device. Details available at http://tldp.org/HOWTO/Cryptoloop-HOWTO/loopdevice-setup.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.