24

How to make some file that contains crucial data protected? For instance, suppose I have some files that are important, is there any method or strategy to make these kind of file more protected on Ubuntu? I even want to make some files ask for a password whenever someone tries to open it. Does it affect the version of Ubuntu in terms of security policy? May I use any encryption algorithm externally? Regards.

  • what do you mean by protective? You want to make it more difficult to modify or delete the file? – Zanna Oct 12 '16 at 7:40
  • protective in sense no one can access it without my permission or not even easy to delete any modify. OR it need some password to open it by tricky way. – Avani badheka Oct 12 '16 at 7:53
  • do you mean simply chown root and chmod go-rwx? – njzk2 Oct 12 '16 at 18:45
  • To require a password, use an encrypted disk or disk image file that does not automount. – Joshua Oct 14 '16 at 19:25
32

The best method you have is chattr +i {file}. This sets the immutable attribute and then a file can not be modified, deleted, renamed or a hardlink created by anyone including root.

The only person that can edit the file is root. (S)he has to undo this by removing the immutable bit: chattr -i {file} and can then do whatever with the file. Setting the +i again locks the file from any modification.

This will not prevent from formatting the partition where the file is stored though. It will prevent theft of the file.


You can even do this on a complete mountpoint if you want:

chattr +i -R /discworld

would make the whole "discworld" and anything in it immutable (chattr -i -R /discworld to undo it ;) )


  • I would like to modify ,delete , rename etc can only done by root . Even if root can't change then it will read only for everyone , that I don't want in my case. – Avani badheka Oct 12 '16 at 7:57
  • @Avanibadheka root can do chattr -i before editing and then do chattr +i again to lock it. – Rinzwind Oct 12 '16 at 8:00
  • 1
    You can also permanently (until reboot) remove the capability to modify ANY immutable bit from the system. – rackandboneman Oct 12 '16 at 11:40
  • It can't even be copied? So cat file>output or dd don't work? – Konerak Oct 13 '16 at 6:39
  • 1
    An immutable file can be copied (unless it's set as chmod a-r). See my terminal log for example test. – Ruslan Oct 14 '16 at 18:49
18

Without doing anything special, you can make it difficult for others to read, change or delete the file by removing permissions for everyone but the owner. Make root the owner of the file and put it inside a directory that only root has access to...

sudo mkdir /home/secret     #this directory will be owned by root, no need to chown
sudo chmod 700 /home/secret

move (sudo mv file /home/secret) your file in there and do

sudo chown root: /home/secret/file
sudo chmod 600 /home/secret/file

chmod and chown take multiple arguments: chmod 600 file1 file2 or chmod 600 file*

other than that, use encryption...

  • 3
    Perhaps easier to understand if you use character permissions instead of octal. So it would be e.g. "chmod go-rwx" to remove read, write, and execute permissions from group and others. See the chmod man page. – jamesqf Oct 12 '16 at 17:19
12

A quite secure way to protect documents is encryption (provided you destroy the original and store the encrypted version properly).

Permissions (as suggested by the other answers) can be circumvented (see this).

Therefore, I recommend you properly encrypt the file. Here is how:

(For a graphical interface method, see the end of this answer)

Ensure you have gpg installed.

For example, to encrypt a file named Important_File.txt, use

$ gpg -c Important_File.txt

Now enter the password (this will be used later when having to read it).

You will now get a file with the original's name and a .gpg extension, for example Important_File.txt.gpg.

Remove the original file, and keep the .gpg version. It might be easy to get the original file from the disk if you don't use the secure shred utility (which will still not work on SSD drives or SD cards):

$ shred Important_File.txt

Now we only have Important_File.txt.gpg with us.

Whenever you need to read it, simply

$ gpg Important_File.txt.gpg

Then enter the password you set in the first command. You will get the original Important_File.txt.

NOTE: This will only protect the contents of the encrypted .gpg file from being read by anyone (using encryption), but anyone can remove, copy or move it! For basic protection from that, use the permission methods of the other answers on the encrypted .gpg file.

Graphical Interface (GUI) method

Install the Seahorse application.

Then you can do this from the Files application:

Screenshot of GNOME Files encrypting

  • 1
    "The only secure way to protect documents is encryption" I disagree. The act of encrypting is not secure what makes it secure. It is the social part after that that does. If you create a readme next to the encrupted file with "this is the password: 11212324234" you can encrypt all you want secure it is not. – Rinzwind Oct 12 '16 at 14:13
  • 1
    @Rinzwind Edited. Anyway, with that level of stupidity, nothing is secure. – UniversallyUniqueID Oct 12 '16 at 14:20
  • Upvoted in anticipation ;-) – Rinzwind Oct 12 '16 at 15:20
  • Note that it might be easy to retrieve the original unencrypted file if you dust delete it (rm or delete from file manager). You would need to overwrite it to make it unrecoverable, e.g. using shred. That's also useless on SSDs and flash drives though... – Byte Commander Oct 12 '16 at 21:53
  • @ByteCommander Thanks, I've added it to the answer. – UniversallyUniqueID Oct 13 '16 at 5:54
9

Just set a very strict permission 600, so that only the owner can read, and write it (if you need execution permissions, that would be 700).

You can also do it graphically -- simply right click on the file, select Properties > Permissions > Set, and set all but the owner field to nothing.

See the picture as an example:

the picture

  • Hey, I think your answer would benefit from a screenshot showing how to do it with the GUI. – grooveplex Oct 12 '16 at 8:19
  • Done, thanks :) (but my system is in Italian...) – dadexix86 Oct 12 '16 at 8:21
  • @Zanna good observation (I modified the answer) – dadexix86 Oct 12 '16 at 22:36
8

If you're the single user on the system, and nobody can reasonably access your computer without your permissions, then you can just block access by using this command, as per Zanna's answer:

sudo chown root:root /my/secret/file.txt
sudo chmod 600 /my/secret/file.txt

In this case, the file can only be read and/or written to by the root user. This is considered "secure enough" if nobody can boot your computer without your permission, or lift your hard drive. We're using the root user in this case, because the root user can always read files, even if they don't have permission. By using the root user, we enforce that only one user can access it.

If you want to mark the file as unchangeable in any way, shape, or form, you can use the i attribute to mark the file as immutable. In this case, the file's permissions are locked in and may not be changed under any circumstance. Thereby, you can do the following command to make the file unchangeable, and protect it from deletion and permission changes:

sudo chattr +i /my/secret/file.txt

If you want to change it, replace the +i with a -i to unlock the file temporarily. See Rinzwind's answer for a more in-depth view.

Now, if other people have access to your computer (either remote sudo access or any form of physical access), this falls apart instantly. An attacker can use root powers to read your file, insert a Live USB, or just pull your hard drive.

Therefore, we need to encrypt the file. I personally prefer to use "file containers," so that you can stick more in there and have it grow as needed. chattr +i is still recommended so that the file isn't accidentally deleted (or altered). Finally, if you're using an encrypted image, you can set permissions to let others access a very limited subset of files when the disk is mounted, making it good for a server. This guide was originally available here, and was adapted for use here.

First off, you want to create a disk image for your use. In this example, we're gonna make it 5 GB.

dd if=/dev/zero bs=1M count=5000 of=~/NSA-Data-Dump-20161012.img

Then, we need to make your image encrypted:

sudo cryptsetup luksFormat ~/NSA-Data-Dump-20161012.img

You will have a choice here to enter your preferred encryption password. Once this is done, we need to expose the raw block device:

sudo cryptsetup luksOpen ~/NSA-Data-Dump-20161012.img my-secret-device

Right now, we have a decrypted file container, but there's no filesystem, and it's as good as useless. Let's fix that:

sudo mkfs.ext4 /dev/mapper/my-secret-device

Now, we need a place to mount our new partition. In this case, I'll be putting it at /crypt. I'm user 1000, so, I'm going to set my partition to only allow me (and root) to read/write from it.

sudo mkdir /crypt
sudo mount /dev/mapper/my-secret-device /crypt -o umask=0700,gid=1000,uid=1000

Now, I can use my file tool to navigate to /crypt and I can store all of my sensitive files there. Once I'm done, I'll need to unmount and re-encrypt my partition.

sudo umount /crypt
sudo cryptsetup luksClose my-secret-device

Now, I'm going to set appropriate partitions on my image file, such that only I and root can access it, and that it can't be changed anymore.

chmod 400 ~/NSA-Data-Dump-20161012.img
sudo chattr +i ~/NSA-Data-Dump-20161012.img

Whenever I want to open this file for reading, I just need to run these two commands, which I can easily alias:

sudo cryptsetup luksOpen ~/NSA-Data-Dump-20161012.img my-secret-device
sudo mount /dev/mapper/my-secret-device /crypt -o umask=0700,gid=1000,uid=1000,ro

My encrypted data will be available at /crypt and it will remain read-only and only accessible to me and root.

If I want to alter the file, I need to change permissions and then mount:

sudo chattr -i ~/NSA-Data-Dump-20161012.img
chmod 700 ~/NSA-Data-Dump-20161012.img
sudo cryptsetup luksOpen ~/NSA-Data-Dump-20161012.img my-secret-device
sudo mount /dev/mapper/my-secret-device /crypt -o umask=0700,gid=1000,uid=1000,ro

Now, you need to be careful here because if a user has root on their system, they can modify/destroy your encrypted partition, rendering it useless. They can also steal data from the drive, but only when it's open. However, they can't steal data or even see that data exists without you explicitly opening it. Therefore, it's your duty to make sure that your system is secure enough to not have any root users online when you're opening your encrypted volume.


TL;DR:

  1. Make the vault:

    dd if=/dev/zero bs=1M count=5000 of=~/NSA-Data-Dump-20161012.img
    sudo cryptsetup luksOpen ~/NSA-Data-Dump-20161012.img my-secret-device
    sudo mkfs.ext4 /dev/mapper/my-secret-device
    
  2. Fill the vault:

    sudo mkdir /crypt
    sudo mount /dev/mapper/my-secret-device /crypt -o umask=0700,gid=1000,uid=1000
    
  3. Lock the vault:

    sudo umount /crypt
    sudo cryptsetup luksClose my-secret-device
    
  4. Freeze the vault:

    chmod 400 ~/NSA-Data-Dump-20161012.img
    sudo chattr +i ~/NSA-Data-Dump-20161012.img
    
  5. Open the vault:

    sudo cryptsetup luksOpen ~/NSA-Data-Dump-20161012.img my-secret-device
    sudo mount /dev/mapper/my-secret-device /crypt -o umask=0700,gid=1000,uid=1000,ro
    
  • Of course a user with root access might also replace cryptsetup with something that logs any passwords entered ... – Hagen von Eitzen Oct 12 '16 at 20:29
  • @HagenvonEitzen Yeah, well, there's nothing such as "truly secure" on computers. There's a point where you draw the line. – Kaz Wolfe Oct 12 '16 at 22:45
7

You can use encfs for directory encryption.

Basically you need to create 2 directories, 1 in which the encrypted data will be stored and 1 where you will access that data:

mkdir ~/.encrypted
mkdir ~/private

Then execute (you need to execute this line every time you want to 'mount' your directory):

encfs ~/.encrypted/ ~/private/

Unless you know more about it, just press ENTER to go with the standard settings (asked only the first time).

Then enter your password and it will be mounted.

Your data will be accessed only by your user safely in ~/private/ (you can pretty much ignore ~/.encrypted)

To unmount it:

sudo umount ~/private/

or

fusermount -u ~/private/

Simple as that.

3

You can encrypt the data using cryptkeeper which is really a very good application and can provide security to your file. You can install it with:

sudo apt-get update
sudo apt-get install cryptkeeper

I generally recommend you encrypt the folder with name starting with . because putting it before the name of file would hide it. It’s a little trick but it works.

To unhide the folder, use Ctrl+h or vise-versa.

  • 1
    The keystroke Ctrl+h applies for what application? It won’t work for ls definitely. – Melebius Oct 12 '16 at 8:49
  • Ctrl-H at least works for Nautilus (and forks of it, like Nemo). As for other file managers, I cannot tell. When using ls, you can use the -a switch to show all (i.e. including hidden) files. – s3lph Oct 12 '16 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.