7

I don't want to encrypt my whole home directory, just my work folder. So I figured that having my work stuff in an encrypted ISO would be a good idea.

How do I create an ISO?
How do I encrypt that iso?
How do I make the iso grow as the contents grow? (having it only take up as much space as it needs to)

5
  • Why do you want to have your work files in a ISO file system? ISO file systems are designed for fixed size, non changing, file systems. Even though you can change files in a ISO file, you don't remove anything, you just add a new version in the unused area of the file system (like on RW CDROM). – Anders Sep 6 '13 at 18:23
  • 1
    You can setup an ecrypted directory Private, that stores its encrypted files under .Private – Sylwester Sep 6 '13 at 18:35
  • @Anders, what about sparse image? it doesn't have to be an ISO, but that's the only format I know of that is cross platform. – NullVoxPopuli Sep 6 '13 at 21:43
  • @Sylwester: how customizable is this? I saw that it would auto-decrypt on login. which is neat. It would be cool to have the folder unmount after so much time of inactivity. I have my laptop in public quite a bit, and .. well even at work, if I'm not at my computer, it would be nice to close the encrypted folder, on unmount it, so it's just an encrypted blob – NullVoxPopuli Sep 6 '13 at 21:44
  • @NullVoxPopuli I've created an answer with encfs as an alternative, which has automatic unmount after n minutes idle time. – Sylwester Sep 7 '13 at 0:31
3

Since EncFs is deemed unsecure it is not adviced to use it. It's planned to be fixed in the next version, but it would be unwise to start using it now while it's insecure. eCryptfs is secure and you can have a private directory in your home dir with:

ecryptfs-setup-private --noautomount

And follow the direction. It will make .Private as encrypted directory and Private as the where it's mounted. With the option --noautomount it won't mount until you doubleclick "Access my private data" inside the Private directory.

Old answer

The current version of EncFs has known security flaws covered in January 2014. Please read the report before preceding using EncFs.

Based on you comments you should have a look at encfs. I have been using this long before Ubuntu got ecyptfs and even though I keep my files private under ~/Private today I still have my old ~/safe which i use for sensitive information that doesn't need to be mounted all the time.

# install encfs
sudo apt-get install encfs

# setup. directories need to be absolute paths
SAFE=~/safe
SAFE_ENC=~/.safe
mkdir $SAFE
mkdir $SAFE_ENC

# this is for mounting the fs (or create for first time mount)
encfs -i 10 $SAFE_ENC $SAFE

The first time you run this you'll be asked if you want to create a new encrypted filesystem. Just pressiong RETURN creates one with default options. The option -i 10 will make the drive get unmounted if there has been ten minutes of inactivity. Remember not to do cd $SAFE or to keep it open in a file manager since it's considered activity.

If you have several systems that are going to access this (eg. by having $SAFE_ENC in a cloud storage) you should create it with the oldest version of Ubuntu you have or else it might not work on that system if it gets created with a newer system. (it's possible but you need to specify options that are compatible) I've used this since 2006 and am very happy with it.

Encfs has several applications. E.g. lately I have started using it for my USB thumb drive as well. I have a 16GB thumb that has 2GB live ubuntu-presistence with a 14GB which the live system mounts after asking for password. When using it from other systems i mount the drive manually in the terminal, but it would be trivial to get my systems to identify it as my safe drive and mount it with my keyring. I also mount it on my Windows work machine.

When setting this up I found there are some supplimentary packages that can be used to manage encfs from the desktop environment and get it mouted like ecryptfs.

9
  • this sounds fantastic, I'll definitely try it out. – NullVoxPopuli Sep 8 '13 at 23:51
  • what is SAFE_ENC? is that where the key file is stored? I'm just wondering where the data is stored, cause I want to move my work folder to a different internal volume, but if there is a key file, I want that in my home folder. – NullVoxPopuli Sep 9 '13 at 1:32
  • 1
    @NullVoxPopuli No, it's the directory where the encrypted files are stored. It can be anywhere you have read/write access. I have one of mine in a dropbox folder, but any place will do and since it'secrypted you back it up with your unsafe files. – Sylwester Sep 9 '13 at 8:44
  • I found this guide super helpful :-) ubuntuforums.org/showthread.php?t=148600 – NullVoxPopuli Sep 9 '13 at 13:22
  • thx @Sylwester, this is a good alternative instead of truecrypt – Regisz Jul 16 '14 at 7:15
1

If you want to encrypt data stored on the computer, there exists some different choises you can make. You was offered them when you installed Ubuntu in the first place[1].

Before you do anything like this, make a back up of your data! You have been warned!!!

All Disks

The obvious one, and the most secure, is to encrypt the whole disk[2]. In that way, noone can steal your computer and use any information stored in your computer, like your passwords in /etc/passwd and /etc/shadow or look at your temporary files which will give lots of information away. So to use that, look up dm-crypt/LUKS/cryptsetup for more information.

Directories in $HOME

There are also support for encryption of directories in your $HOME directory[3]. Either you can use the older version, which encrypt a separate directory called $HOME/Private or you could encrypt whole of your $HOME.

To create an encrypted $HOME/Private, just run the command

ecryptfs-setup-private 

in a terminal and this should be set up for you.

To encrypt a users $HOME, you need to install the package encryptfs-utils and then create a new user with the command

sudo adduser --encrypt-home username

where username should be the new users login name. You could still make your $HOME encrypted after installation, but remember to back up your data before doing this[4].

Encrypting Removable Disks

Lastly, if you want to encrypt your USB Memory stick, you could do that too. Just install package cryptsetup and partition it with the graphical tool gnome-disk-utility or follow the instruktions for doing this from the command line[5].

For more information about encryption of disks and directories, please read here:

  1. https://help.ubuntu.com/community/EncryptedFilesystemHowto
  2. https://help.ubuntu.com/community/EncryptedFilesystems
  3. https://help.ubuntu.com/community/EncryptedHome
  4. http://ubuntuforums.org/showthread.php?t=1449168
  5. https://help.ubuntu.com/community/EncryptedFilesystemsOnRemovableStorage
5
  • can the removable disk be a growable iso? (sparse image)? – NullVoxPopuli Sep 6 '13 at 21:38
  • are encrypted folders mountable? how does one access the encrypted data? can the folder be closed or unmounted? – NullVoxPopuli Sep 6 '13 at 21:44
  • I can't see any use of ISO, at all. Please explain why you think that you need ISO images? None of these encrypted file systems/directories will not be cross platform anyway, if I understand this properly. I might be wrong, as I am I only interested in Linux system, has not run a MS Windows or Apple OS since 10-15 years back on my own computers. If cross platform is important for you, have a look at git-annex – Anders Sep 7 '13 at 20:47
  • Please try it out to see if it is anything you would look like to use. If not, just remove it. And a feedback what was good for you would be nice too. :-) – Anders Sep 7 '13 at 20:55
  • I need on "iso", per se, just something that functions like one. @Sylwester mentined encfs. I'll try that, and see how that goes. – NullVoxPopuli Sep 8 '13 at 23:52
0

Because of recently found security vulnerabilities in Encfs, I switched to Cryfs (disclaimer: I'm also one of the developers there). The tool does what you're asking for and has advantages over eCryptfs or Encfs.

One advantage is that it also encrypts file sizes and directory structure. With Encfs or eCryptfs, anyone can see your directory structure and file sizes. This often makes more information public than you want to. Say you have a set of directories with ~20 files each and each file ~3MB. This is probably a music CD collection. Or say you store a copy of a Windows 8 DVD in your file system. That is easily figured out by comparing directory structure and file sizes of the Windows 8 DVD with the structure of your encrypted file system.

Cryfs is a quite new project, but I already use it for some time to encrypt my Dropbox folder and didn't have any problems so far.

There is an easy Tutorial to help you get started.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.