5

I've encrypted my home partition in Ubuntu (15.10 currently). Now I am trying to encrypt a single directory so that I can use it to sync. with e.g. dropbox securely.

Therefore, I need a new ecryptfs-directory.

  • A nested encryption (encrypted directory inside home) does not work.
  • The command ecryptfs-mount-private shows the error that I already have an encrypted passphrase (probably from the encrypted home directory?).

Therefore, I created via sudo mount -t ecryptfs /encrypted /decrypted a new directory pair at the root level (outside home). While I am able to mount it manually, I am not sure how I can mount it automatically - in addition to the encrypted home directory. I've found a description here (see here), where I put the mount command into the fstab file. First, it does not work. Second, it also seems that my passphrase would be stored in clear text with this solution?

So I am wondering whether there are better solutions? Thank you very much ;) Certainly, this will help everybody who encrypts her/his home partition and wants to encrypt the files which are uploaded to dropbox or owncloud.

Improve this question
8
  • I looked into eCryptFS and directly calling with a mount command, wasn't easy, trouble adding keys to kernel keyring, trouble removing them when finished, all around too much of a headache. I did modify the ecryptfs-recover-private` in this answer to mount any other folder, though I didn't look too closely into removing the key from the keyring when it's done.
    – Xen2050
    Nov 25, 2015 at 9:02
  • Thank you :), but EncFS in the current version is currently not secure for cloud encryption, as the same file is uploaded in different versions.
    – PeteChro
    Nov 25, 2015 at 9:05
  • I've read that any encryption program can produce encrypted files incompatible with older or newer versions, though a newer version should be backwards-compatible, in planning at least. Do you have a source for the EncFS incompatibilities?
    – Xen2050
    Nov 25, 2015 at 9:12
  • Its not incompatible, its just unsecure when used to encrypt files stored in the cloud like dropbox or owncloud. (see the security audit)
    – PeteChro
    Nov 25, 2015 at 9:17
  • Never heard that before, afaik EncFS and eCryptFS are very secure. Please provide a link
    – Xen2050
    Nov 25, 2015 at 9:29

3 Answers 3

Reset to default
2

eCryptFS is not designed for cloud storage. It assumes it is the only application accessing your ciphertexts and runs into undefined behavior when some other application (say your Dropbox client) modifies them. EncFS also has its problems as explained here.

You might want to take a look at CryFS https://www.cryfs.org

Improve this answer
0

You may want to use EncFS and it's --reverse option. Here's a quote from it's man page:

   --reverse
       Normally EncFS provides a plaintext view of data on demand.  Nor‐
       mally it stores enciphered data and displays plaintext data.  With
       --reverse it takes as source plaintext data and produces enciphered
       data on-demand.  This can be useful for creating remote encrypted
       backups, where you do not wish to keep the local files unencrypted.

       For example, the following would create an encrypted view in
       /tmp/crypt-view.

           encfs --reverse /home/me /tmp/crypt-view

       You could then copy the /tmp/crypt-view directory in order to have
       a copy of the encrypted data.

You must also keep a copy of the file /home/me/.encfs6 which contains the filesystem information.

       Together, the two can be used to reproduce the unencrypted data:

           ENCFS5_CONFIG=/home/me/.encfs6 encfs /tmp/crypt-view /tmp/plain-view

       Now /tmp/plain-view contains the same data as /home/me

       Note that --reverse mode only works with limited configuration
       options, so many settings may be disabled when used.

Especially if the files are already kept in your encrypted home, this would be a good solution to avoid having a 2nd encrypted copy, and not having to manage 2 encrypted folders, just keep the EncFS config file .encfs6

Improve this answer
0

For those who might visit nowadays, consider using encrypted filesystem on cloud-drive simply with impressive GUI-based cryptomator.org as discussed by Cryptomator Cloud Storage Encryption Tool 1.4.0 Released With FUSE / Dokany Support - Linux Uprising Blog. It's multi-platform (including Android, iOS) as well as (built on) open-source. HTH

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .