Use a Guest session!
Unless you expect people to gain increased privileges (e.g. root) in your machine, or for example boot from a CD-ROM and mount and browse your filesystems (or even reading the raw disk sectors), you may not have to encrypt some/all files on your hard drive. You can simply set permissions on directories and/or files to keep the "curious" from opening and browsing them. This is why, in normal operations, you
- Don't use a root account as your normal user.
- Don't give out your password (or root's password) to other users. ;-)
The Session applet on the top right of your window allows you to start a Guest session, which disappears when you log out. See for example this image. The Guest Session option starts a temporary session for anyone borrowing your computer. Your files are not visible -- unless you've specifically given universal read permissions. This is the ideal when you just want to "borrow" your computer to a guest who wants to do some quick browsing. It might not be what you want if you'd like to provide permanent accounts (i.e. residing under /home
, as your account is likely to be). The Guest account cannot "see" anything under /home
because the session doesn't have the right permissions.
Change the permissions
(Note: If someone has root permissions, this won't make a difference. Such a person will be able to access your unencrypted files just the same.)
Suppose you have a folder (or a set of files) that you want to keep other users from reading/accessing.
- Select the folder (or files) you want to affect, then right-click on the selection (with your mouse).
- Select Properties.
- Go to the Permissions tab.
- Under the "Others" group, select "Access to folder" and "Access to file" as "None".
This doesn't encrypt the affected files and directories, but it does keep people (not having root permissions, of course) from prying into your account.
Allow some users
(Note: If someone has root permissions, this won't make a difference. Such a person will be able to access your unencrypted files just the same.)
If you want to allow only a group of users to access a set of files or folders, you can do the same. For example, you may want to reserve read+write permissions for yourself, but only read permissions for a group (or even read+write for them as well) on those files and folders.
- If the group name you want to select doesn't yet exist, you'll have to create it. Go to
System > Administration > Users and Groups
.
- Click on the
Manage groups
button.
- Click
Add
. You'll need to enter your password (if your account has admin permissions, otherwise use the root password if you have it).
- Enter a group name. The group names follow the same rules when providing a user name; I suggest you only use letters and numbers, without spaces. You can leave the suggested Group ID (starting at 1001 for example). Select the users that will belong to the group.
- Click
OK
to apply. Click Close
on the previous window. Click Close
to close Users and Groups.
- You may need to logout+login for your account to "see" the new group. It also applies to any already-logged in users.
- Use the same procedure as above to apply Group permissions. Please note that you'll have to provide the Group name when applying permissions. You can only use one group.
This doesn't encrypt the affected files and directories, but it does keep people (not having root permissions, of course) from prying into your account.
Encryption
Other users here have provided more details specifically for solutions using encryption. If you really require encryption -- and not just controlling access to your files -- you may want to look into those answers. But please note that access to those files will always be slower, due to the necessary overhead for applying the encryption/decryption algorithms. The description I provided above implements a (very!) basic measure of access control with virtually no performance impact.