5

I've encrypted my home partition in Ubuntu (15.10 currently). Now I am trying to encrypt a single directory so that I can use it to sync. with e.g. dropbox securely.

Therefore, I need a new ecryptfs-directory.

  • A nested encryption (encrypted directory inside home) does not work.
  • The command ecryptfs-mount-private shows the error that I already have an encrypted passphrase (probably from the encrypted home directory?).

Therefore, I created via sudo mount -t ecryptfs /encrypted /decrypted a new directory pair at the root level (outside home). While I am able to mount it manually, I am not sure how I can mount it automatically - in addition to the encrypted home directory. I've found a description here (see here), where I put the mount command into the fstab file. First, it does not work. Second, it also seems that my passphrase would be stored in clear text with this solution?

So I am wondering whether there are better solutions? Thank you very much ;) Certainly, this will help everybody who encrypts her/his home partition and wants to encrypt the files which are uploaded to dropbox or owncloud.

  • I looked into eCryptFS and directly calling with a mount command, wasn't easy, trouble adding keys to kernel keyring, trouble removing them when finished, all around too much of a headache. I did modify the ecryptfs-recover-private` in this answer to mount any other folder, though I didn't look too closely into removing the key from the keyring when it's done. – Xen2050 Nov 25 '15 at 9:02
  • Thank you :), but EncFS in the current version is currently not secure for cloud encryption, as the same file is uploaded in different versions. – PeteChro Nov 25 '15 at 9:05
  • I've read that any encryption program can produce encrypted files incompatible with older or newer versions, though a newer version should be backwards-compatible, in planning at least. Do you have a source for the EncFS incompatibilities? – Xen2050 Nov 25 '15 at 9:12
  • Its not incompatible, its just unsecure when used to encrypt files stored in the cloud like dropbox or owncloud. (see the security audit) – PeteChro Nov 25 '15 at 9:17
  • Never heard that before, afaik EncFS and eCryptFS are very secure. Please provide a link – Xen2050 Nov 25 '15 at 9:29
2

eCryptFS is not designed for cloud storage. It assumes it is the only application accessing your ciphertexts and runs into undefined behavior when some other application (say your Dropbox client) modifies them. EncFS also has its problems as explained here.

You might want to take a look at CryFS https://www.cryfs.org

0

You may want to use EncFS and it's --reverse option. Here's a quote from it's man page:

   --reverse
       Normally EncFS provides a plaintext view of data on demand.  Nor‐
       mally it stores enciphered data and displays plaintext data.  With
       --reverse it takes as source plaintext data and produces enciphered
       data on-demand.  This can be useful for creating remote encrypted
       backups, where you do not wish to keep the local files unencrypted.

       For example, the following would create an encrypted view in
       /tmp/crypt-view.

           encfs --reverse /home/me /tmp/crypt-view

       You could then copy the /tmp/crypt-view directory in order to have
       a copy of the encrypted data.

You must also keep a copy of the file /home/me/.encfs6 which contains the filesystem information.

       Together, the two can be used to reproduce the unencrypted data:

           ENCFS5_CONFIG=/home/me/.encfs6 encfs /tmp/crypt-view /tmp/plain-view

       Now /tmp/plain-view contains the same data as /home/me

       Note that --reverse mode only works with limited configuration
       options, so many settings may be disabled when used.

Especially if the files are already kept in your encrypted home, this would be a good solution to avoid having a 2nd encrypted copy, and not having to manage 2 encrypted folders, just keep the EncFS config file .encfs6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.