I set up ecryptfs to test it and see how well it worked. These are the steps that I took to set it up. I am using Fedora so I used yum to install ecryptf. You should use whatever your particular Linux distribution uses to install software.
# yum install ecryptfs-utils.x86_64
There are certainly different ways to backup the target directory. But, the key point is, you must back it up and then restore it to the encrypted directory.
# move /home/mystuffdir /home/mystuffdir.old # mkdir /home/mystuffdir # chown mystuffguy:mystuffguy /home/mystuffdir
As root:
# mount -t ecryptfs /home/mystuff /home/mystuffdir Select key type to use for newly created files: 1) openssl 2) passphrase 3) pkcs11-helper 4) tspi Selection: 2 Passphrase: <= input a good passphrase Select cipher: 1) aes: blocksize = 16; min keysize = 16; max keysize = 32 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16 Selection [aes]: Select key bytes: 1) 16 2) 32 3) 24 Selection [16]: Enable plaintext passthrough (y/n) [n]: Enable filename encryption (y/n) [n]: y <= I encrypt everything including file names Filename Encryption Key (FNEK) Signature [abcdef12345678]: <=Enter Attempting to mount with the following options: ecryptfs_unlink_sigs ecryptfs_fnek_sig=abcdef12345678 ecryptfs_key_bytes=16 ecryptfs_cipher=aes ecryptfs_sig=abcdef12345678 Mounted eCryptfs
verify:
# mount
/home/mystuffdir on /home/mystuffdir type ecryptfs (rw,relatime,ecryptfs_fnek_sig=abcdef12345678 , ecryptfs_sig=abcdef12345678,ecryptfs_cipher=aes,ecryptfs_key_bytes=16, ecryptfs_unlink_sigs)
Now while the encrypted directory is mounted you have to restore the original files. If you try to restore to the directory while it is not mounted, and then you mount it with encryption accessing the files will result in an Input/output error.
I used cpio to restore. considering I used a move method to back it up I could certainly use the mv command to move it back. This would be faster. But I’ll use a copy method just in case my encryption went wrong somewhere. I can always remove the original files.
# cd /home/mystuffdir.old # find . -depth -print | cpio -pamvd /home/mystuffdir
You must always have the volume mounted with encryption while you are doing any work on it. This should avoid the input/output error that would result. The fact that you have encrypted the files within the /home/mystuffdir directory will immediately let you know that it is or is not encrypted, assuming you are actually working and viewing in the encrypted directory.
verify
umount /home/mystuffdir cd /home/mystuffdir
you should see a lot of encrypted file names and accessing any of them should give you a binary mess. Now remount it using the first mount command above, answer all the questions in a similar fashion and you should be able to see all the files as expected.
Now we want to set it up to be as automatic as possible. So we create a file in the root owners directory called
/root/.ecryptfsrc
The following is found from the output of the first mount. see above.
key=passphrase:passphrase_passwd_file=/media/keys/keys.txt ecryptfs_sig=abcdef12345678 ecryptfs_cipher=aes ecryptfs_key_bytes=16 ecryptfs_passthrough=n ecryptfs_enable_filename_crypto=y ecryptfs_fnek_sig=abcdef12345678
/media/keys/keys.txt is a file found on a USB file system. Depending upon what method you used to mount the USB key, the USB file system may be in a different location then what you specified in the “.encryptfsrc” file. This might cause the following error when you attempt to mount your encrypted file system:
Error attempting to evaluate mount options: [-2] No such file or directory Check your system logs for details on why this happened. Try updating your ecryptfs-utils package, and/or submit a bug report on https://bugs.launchpad.net/ecryptfs
It does not really help to encrypt anything if anyone can get to the keys. So the USB files systems where the key exist is also encrypted. I am using a fedora system so I used the fedora “Disk Utility” to format, mount and encrypt the USB file system. This is a graphical interface for dealing with disks. There are plenty of instructions on the internet providing information on how to encrypt a file system from the command line. The “Disk Utility” is pretty easy to use and should pose no problem.
Here is a quick synopsis of out to mount the USB file system from the command line. The name of the file system is “keys”. Find the raw device first.
# fdisk -l
or use something that is easier to read.
# parted
(parted) print list all
Model: USB NAND FLASH DISK (scsi)
Disk /dev/sdg: 32.8MB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 16.4kB 32.8MB 32.8MB primary lba
(parted) quit
Now unlock the USB device:
# cryptsetup -v luksOpen /dev/sdg1 keys
Enter passphrase for /dev/sdg1: Enter passphrase
Key slot 0 unlocked.
Command successful.
Now find the device and mount it as a file system.
fdisk -l
. . . . . . .
Disk /dev/mapper/keys doesn't contain a valid partition table
# mount /dev/mapper/keys /mnt
#or somewhere appropriate like /media/keys/.
# mkdir /media/keys if you have too
and it is mounted and readable.
Note:
Use the following to close the mapping and discover other information.
# cryptsetup luksClose /dev/mapper/keys $ man cryptsetup
You can set up /etc/fstab to automatically mount on reboot. But this is a directory not an entire file system.
For ease of use, testing and documentation I set up the following in my fstab but commented it out after the testing was done. I’ll print it here for reference. I think trying to mount things automatically in this sense is asking for trouble. Don’t mess up any fields in your /etc/fstab file or your system may fail to boot.
# encrypted partition /dev/sdf1 /media/keys vfat ro 0 0 /home/mystuffdir /home/mystuffdir ecryptfs defaults 0 0
I use KeePassX to keep track of passwords. This makes mounting it and un-mounting it fairly easy. And I am not rebooting often so this does not seem to me to be a serious operational issue considering I am getting full encryption on a specific directory, not a file system.
Note:
If you see this error
mount: wrong fs type, bad option, bad superblock on /home/msimoni2,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so.
you may have to install encryptfs.
======================================================================================== Package Arch Version Repository Size ======================================================================================== Installing: ecryptfs-utils x86_64 103-2.fc19 fedora 181 k Installing for dependencies: trousers x86_64 0.3.10-3.fc19 fedora 284 k Transaction Summary ========================================================================================