Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

(This is not about restricting client access, for which ext3 permissions do the trick)

I'd like to encrypt the data on my NAS drive (Buffalo LinkStation Pro with SSH access enabled, if that matters) in a user-friendly way. Currently, a truecrypt container has to be manually mounted via SSH and also unmounted again (unless you solve my timeout question). Using a passwordless (but EFS encrypted) SSH key this is reduced to two PuTTY desktop shortcuts and entering the truecrypt password (until simplified further) for mounting.

However, the ideal solution would be transparent. I first thought about trying to somehow have the share allow for EFS encryption, but that would probably involve more work and EFS for multiple users without an Active Directory server seems to be troublesome.

But now my idea is an automated mount of e.g. an EncFS encrypted directory triggered automatically by a samba access from authorized users (using Windows clients). How can that be achieved? (Bonus points for displaying a honeypot share for unauthorized users...)

share|improve this question
    
I still don't understand who has the encryption credentials in the scenario: are they provided by the user when mounting? Does it have to be a password, or can it be a key file (which itself might be password-protected) on the client or the server (which)? –  Gilles Oct 11 '12 at 9:48
    
@Gilles In this scenario, the Windows username/password transmitted to samba would also be used as encryption credentials (Ideally in such way that multiple users can mount the same volume with different credentials). –  Tobias Kienzler Oct 11 '12 at 9:52
1  
Server-side encryption then, to protect against attackers with physical access when the storage device is not in use? Ok. –  Gilles Oct 11 '12 at 9:57
    
@Gilles Precisely that, thanks for the better wording –  Tobias Kienzler Oct 11 '12 at 10:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.